Sentinel-Q

The part that decides things, and the reasons it is not allowed to decide more

Sentinel-Q investigates every alert, reaches a verdict with cited evidence, and — where you have permitted it — takes a small number of reversible actions and tells you afterwards. The interesting part of this page is not what it can do. It is the machinery that stops it doing more.

A frontier model today is a mediocre-to-decent junior analyst: 61–67% of a full investigation completed correctly, against 73–85% for a strong human. Clearly better than nobody, clearly worse than a good person. Everything below follows from taking that seriously.

The ladder

Where we actually sit

Six levels of security automation. Most vendors describe themselves as being at the top of this and mean the middle. We ship at level three by default, offer level four per action class, and have deliberately not built level five.

The six levels of security automation, what each is allowed to do, what the human does, and where Qorionix sits.
Level	What it may do	Your job	Where we are
L0Report	Surfaces raw signals: dashboards, counts, a searchable log.	Everything.	In the product
L1Explain	For a given event: what happened, in plain language, with cited evidence. Answers “is this bad?” when asked.	Asks the question, decides everything.	In the product
L2Investigate	Unprompted: gathers its own evidence across modules, correlates, reaches a verdict with calibrated confidence and citations, and ranks your queue. Changes no state.	Reads verdicts, decides actions.	In the product
L3Recommend	A fully specified, executable change: exact action, exact target, exact parameters, stated blast radius, undo plan — queued for one-tap approval.	Approves or rejects.	The default
L4Act within bounds, then report	Executes autonomously inside an envelope you declared in advance: enumerated action classes, reversible only, evidence verified, blast radius below threshold, confidence above floor.	Sets the envelope, reviews, can halt.	Opt in, per action
L5Act and adapt	Writes its own detection rules, retunes thresholds, adjusts its own autonomy envelope.	Periodic posture review.	Not built, on purpose

The three transitions that carry all the risk

L2 to L3 is gated by grounding: a verdict whose citations do not verify cannot become a recommendation.
L3 to L4 is gated by an envelope the server enforces. The model's proposal is not an input to permission — a model that asks to isolate an endpoint at the recommend tier gets a human-in-the-loop ticket, exactly as if it had asked politely.
L4 to L5 should not exist without versioning and rollback, so it does not exist.

Anatomy of a decision

What a decision looks like

Every decision is a record with a fixed shape, persisted so a reviewer — or a regulator — can later verify exactly what the software told the operator. Four things in that shape are unusual and worth pointing at.

Classification and disposition are separate fields: What we did about it is one field; whether it was actually real is another. Without the split, “how often is the AI right?” has no answer — and that question is the one you should be asking.
Every reason traces to evidence: A contributing factor carries the evidence references it rests on. A factor an operator cannot trace to evidence is not shown to them as a reason.
Counterfactuals are recomputed, not narrated: “If this factor were removed, would the outcome change?” is answered by recomputing the decision function, not by asking the model to explain itself. A model explaining its own reasoning is the least reliable available source.
Confidence is shown as a band with its reason: The underlying figure is a number, and you can see it. What the interface leads with is “Low — could not corroborate sign-in geography, source offline”, because a bare percentage reads as theatre and gets treated as one.

sentinel-q · decision DEC-91f4tier2 — act within bounds

Sample decision. The structure, fields and standing limitations are the product’s own.

Alert

Impossible travel — [email protected] — Warsaw to Singapore in 14 minutes

Confidence

High — two independent sources agree and no contradicting session was found

Classification

auto_executed

Why — every factor traced to evidence

geo_velocity_impossible0.34: Two successful sign-ins 6,100 km apart, 14 minutes apart. No VPN egress on record.
device_fingerprint_mismatch0.27: Second sign-in from an endpoint fingerprint never seen on this identity.
mfa_method_downgrade0.21: Second sign-in satisfied with SMS where this identity normally uses a passkey.
no_concurrent_legitimate_session0.11: No overlapping session from the usual location, so this is not a shared account.

Acted, then reported

Revoked all active sessions for the identity (reversible: the user re-authenticates).
Issued a step-up challenge on next sign-in (self-correcting if this is wrong).
Opened case CASE-4471 and notified the escalation contact before acting.

Waiting for you

Isolate LAPTOP-07 from the network

Blast radius:: 1 host — Marek Nowak's laptop, marked “standard”, not business-critical
Undo:: One-tap un-isolate, reachable from the mobile app. Firewall rules snapshotted before the change.

Grounding — checked before it was allowed to act

10 of 11 claims verified0 off-ledger citationsfabrication rate 0.0%

Shown on every decision, unedited

This assessment rests only on telemetry this platform holds for your organisation. Absence of evidence is not evidence of absence.
A threat-intel lookup that returned no match means the indicator is unknown to the configured feeds, not that it is safe.
1 of 11 findings was discarded because the evidence it cited could not be verified. It is recorded on the decision and is not reflected in the confidence figure.

Grounding

Ungrounded means unauthorised

Before a verdict is allowed to become an action, every claim in it is checked back against the evidence the platform actually holds. The check produces a report, and the report can refuse the action outright.

Three categories of bad citation are separated, because they mean different things. A malformed reference is a formatting error. An off-ledger reference is one no tool returned during the investigation — the model invented it. An unresolved reference was real when a tool returned it and no longer exists in your data.

A claim whose citation does not verify is stripped from the narrative before you read it, and recorded separately so you can see that it was discarded. A verdict carrying off-ledger citations never reaches the acting tier, regardless of how confident it sounds or how severe the alert is.

Why a confident answer can still be refused

Isolating one laptop needs eight conditions to hold at once

This is the most disruptive thing the platform will ever do without asking, so it is the most constrained. All eight, simultaneously, or it becomes a recommendation.

Confidence above a floor materially higher than the general acting threshold — the default is 0.95.
Evidence verified by the server: the grounding report clean, and zero citations that no tool actually returned.
The host is not flagged business-critical, which requires you to have answered the asset-criticality question. Unanswered counts as not eligible.
Blast radius exactly one host. Any action affecting more than one is downgraded to a recommendation regardless of confidence.
A one-tap un-isolate reachable from the mobile app, with the undo handle recorded before the action, not reconstructed after it.
The notification fires before or at the same moment as the action. Learning that your laptop died from the laptop dying is the failure experience.
Not during a declared change freeze or maintenance window.
You have explicitly opted in, for this action class specifically, with the risk stated in plain language.

The hard stops

What it will never do, at any setting

Some of these are policy and some are structural. The structural ones are better, and where we could make a limit structural we did — a capability that is not exposed cannot be talked into existence by a cleverly worded prompt.

Grant, extend or elevate privileged access: Not at any tier and not at any confidence. Enforced by not exposing a grant capability to the model at all, rather than by instructing it not to ask — an instruction is a suggestion, an absent tool is a wall.
Delete or deprovision a person: Always a recommendation. A revoke is recoverable by the affected person proving who they are; a deletion is not recoverable by anyone.
Rotate a domain controller, root or break-glass credential: Scheduled rotation of ordinary service credentials is automated. The credentials that would lock you out of your own recovery path are not.
Suppress a false positive permanently: Suppression is always a recommendation and it always expires. Permanent autonomous suppression manufactures a blind spot, which is precisely what an attacker wants and precisely what a busy administrator would agree to.
Act on more than one machine or person at once: Any multi-target action is a recommendation, whatever the confidence. The chain's autonomy is the minimum of its links, not the maximum.
Change its own limits: The autonomy envelope is not writable by the thing it constrains. This is the whole reason the top rung of the ladder does not exist.

The design rule underneath all of this

Prefer the action the affected person can undo by proving who they are. A step-up authentication challenge is safe to automate because the user proving their identity is the remediation — the action corrects itself when it is wrong. Suspending an account is not, because the correction requires us. That single asymmetry decides most of what is on the automated list and most of what is not.

Check it against your own estate

The console publishes Sentinel-Q's own measured figures. The fastest way to judge whether any of this is true is to connect Microsoft 365 and read what it says about your tenant.

Start the free assessment What we will not claim

No card. No sales call before you have read the report.