Operating pattern
Monitor broadly, investigate selectively
Use broad monitoring to find episodes that merit attention, then reserve deep investigation for the ones that meet clear criteria.
Use when
Continuous event streams need broad detection, but only selected episodes warrant investigation.
Operating contract
Authority, evidence, and stopping conditions.
- Job to control
- Continuous event streams are too large for deep review, while a noisy monitor can bury the few episodes that deserve attention.
- Division of work
- Detection checks look for named behaviors over defined windows. The monitor assembles the episode, checks the escalation criteria, and hands off the evidence without pretending to complete the investigation.
- Control point
- A detector hit can open an episode, but it cannot become a finding; thresholds and duplicate handling stay explicit.
- Evidence retained
- Matched behaviors, observation window, episode assembly, escalation result, duplicates checked, and handoff packet.
- Human ownership
- Own typology coverage, escalation thresholds, investigation priority, and any conclusion about the observed conduct.
- Trade-off
- Broad monitoring adds triage load; tune against missed conduct and duplicate work, not alert volume alone.
Case sequence
- 01
Observe the stream
- 02
Run named checks
- 03
Assemble an episode
- 04
Apply escalation criteria
- 05
Hand off supporting evidence
Failure watch
Control intent and failure modes.
Control intent
Overly broad surveillance, unexplained alert scores, duplicate episodes, and premature conclusions from detection signals alone.
Failure modes
- 01Treating a detector hit as a finding
- 02Opening duplicate episodes
- 03Tuning only for lower alert volume
Applied in Cadre
Packs using this operating design.
Each pack narrows the pattern to a specific financial-services decision and names the seam that remains under human review.