Responsible AI
The AI is measured against people, not the other way round.
ApexAI carries the alert volume. These rules decide what it may do, how it learns, and how you check it.
The human approval gate
Nothing that changes a real system — block, isolate, revoke, rotate — runs without a person’s approval. This is a fixed design rule, not a setting.
- The most critical cases need two approvers
- A two-person rule configurable per action type
- A kill switch stops automated proposals
- Promoting a policy never widens what may run without approval
Signed, versioned policies
Decision policies and risk-index versions are signed with ML-DSA-65 and bound to their workspace, so you know exactly which rules produced a proposal.
- Offline evaluation on judged cases before promotion
- A shadow period and a robustness range
- Champion and challenger compared in shadow
- Drift checks with automatic rollback
Every decision recorded
Each AI decision is recorded, can be reviewed and is counted against people’s verdicts. Accuracy is measured, not asserted.
- A verdict ledger of AI and human decisions
- Reproducible scorecards
- Digital-twin replay of past days
- A signed audit trail
Honest by construction
An action with no connected backend says “not applied” instead of reporting success. Nothing in an API response is invented.
- Every action result says whether it was really applied
- Undo only where undo is real
- Concept previews labelled and kept apart from product features
Autonomy earned per source
Each alert source starts in observe mode. A person steps it up one stage at a time, only past a gate measured on that source’s own cases.
- Observe: score, investigate, propose — nothing acts
- Measure: compare with your analysts
- Step up: a person decides
Your data, your model
The default model is a local, Ollama-compatible one you host. A cloud LLM is opt-in and called only through the server-side AI Gateway.
- No prompt or alert text leaves your network unless you turn a cloud LLM on
- Each tenant sees only its own data; isolation is tested
What the AI does on its own
One thing: at tier 0 it closes alerts as proven noise — only below a conformal threshold calibrated on your analysts’ verdicts, only for detections people judged benign before, and with sampled quality checks. Everything else is investigation, which changes nothing, or a proposal that a person decides.
Autonomous SOCPut the rules to the test.
Run ApexAI in observe mode and compare its verdicts with your team’s.