Alert Center
2. Alert Center
The Alert Center is the system-wide notification hub for security, performance, and compliance events. Alerts are generated automatically by the Theseus Guard engine when anomalies exceed configured thresholds.
2.1 Alert Table
The alert table lists all active and historical alerts with the following columns:
| Column | Description |
|---|---|
| Alert ID | Unique identifier (monospaced) |
| Title | A descriptive title for the alert (e.g., "Probe Accuracy Degradation — Finance Domain") |
| Severity | critical, high, medium, or low — displayed as a colored badge |
| Status | active or resolved |
| SLA | Time remaining before the alert SLA is breached, with color coding (green / amber / red) |
| Date | When the alert was created |
2.2 Filtering & Search
- Search by Alert ID or title keyword
- Lane Filter — Show only alerts from a specific lane:
- Runtime Review alerts
- Policy Endorsement alerts
- Operations alerts
2.3 Alert Types & Special Detail Views
Different alert types surface contextual information and direct action buttons in their detail side sheet:
Department ID Mismatch (department_format_change)
Triggered when an employee submits a department ID that doesn't match the format the Guard expects. The detail view shows: - The employee ID involved - The received department ID - The expected department ID format - A button to navigate directly to Admin → Department Migration to resolve the mismatch
Model Probe Degradation (probe_accuracy_degradation)
Triggered when a model probe's accuracy drops below its configured threshold. The detail view shows: - The active model name and tier - Current accuracy score and the threshold that was breached - The affected governance domain - A button to navigate directly to Design → Sentinel Engine for diagnosis
L2-L3 Divergence Anomaly (threshold_override_anomaly)
Triggered when a high-confidence L2 verdict is contradicted by the L3 LLM evaluator — a signal that the model may be exhibiting unexpected behavior. The detail view shows: - The L2 confidence score - The affected governance domain - The L2 verdict vs. the L3 verdict side by side - A button to navigate to the specific item in Route → Runtime Reviews for human decision
2.4 Alert Detail (Side Sheet)
All alert types share a common detail layout: - Severity and status badges - Alert ID - Full alert title and description - Detection timestamp - Playbook (if configured) — recommended remediation steps
2.5 Resolving Alerts
Users without the auditor role can resolve active alerts by clicking Mark as Resolved in the alert detail view. This sets the alert status to resolved and removes it from the active count on the Posture Overview dashboard.
RBAC: The
auditorrole can view alerts but cannot resolve them.