SHIELDMSP / SAFETY MODEL
MVP IN DEVELOPMENTAutomation with
boundaries built in.
A clear decision is not automatic permission to act. ShieldMSP’s intended safety architecture separates analysis, authorization, execution, and verification.
CONTROL BEFORE EXECUTION
The safety gate is the enforcement point.
01 / RULE PRIMACY
Decisions grounded in rules
The deterministic rule engine leads the decision. AI can explain, add context, and recommend investigation; it cannot trigger a response independently.
02 / FAIL CLOSED
Uncertainty stops automation
Unknown actions, invalid inputs, failed policy checks, or missing authorization block automated execution and route the incident for review.
03 / ASSET CRITICALITY
Critical systems need a person
Tier 1 critical infrastructure and Tier 2 privileged endpoints require human approval, regardless of decision confidence.
04 / TENANT CONTEXT
The right action, in the right environment
The design scopes incident data, credentials, and execution permissions to the owning tenant. Ownership validation is a response prerequisite.
THE DOCUMENTED ROUTING MODEL
Confidence informs the route.
Policy determines permission.
| Decision confidence | Intended route | Additional requirement |
|---|---|---|
| 90% and above | Eligible for controlled response | Confirmed rule, Tier 3/4 asset, allowed action, tenant validation, and execution enabled. |
| 70% to below 90% | Notify and suggest | A human considers the recommendation; confidence alone does not authorize execution. |
| Below 70% | Log and escalate | No automated endpoint action. |
| Any confidence · Tier 1/2 | Human approval required | Criticality takes precedence over the confidence band. |
This describes the intended MVP routing model. Execution also depends on policy, provider capability, authorization, and completed calibration.
SHADOW MODE
Build confidence before enabling action.
Shadow Mode observes alerts, evaluates rules, and records proposed outcomes without dispatching response commands. Calibration and human review precede controlled execution.
Observe → Review → Calibrate
Compare recommendations against analyst assessment and investigate false positives before enabling a tenant’s response policies.
Dispatch → Verify → Record
An API request is not proof of containment. The intended workflow checks provider state, surfaces unconfirmed results, and records the outcome.
LET’S BUILD WHAT COMES NEXT
Put control at the
center of your response.
Help shape ShieldMSP around
your MSP’s real-world operations.