signal-taxonomy.md
c9 Signal Taxonomy
Purpose
This taxonomy defines the kinds of signals that should be elevated above raw entity data in the meaning-layer dashboard.
Primary Signal Classes
Unknown
A thing exists in live activity but cannot be confidently tied to known inventory or policy context.
Examples:
- unknown API key
- unknown user
- unknown endpoint
- unknown MCP client
Why it matters:
- unresolved attribution changes trust immediately
New
A thing or combination has appeared for the first time recently.
Examples:
- first-seen agent version
- new destination host
- known user on a new machine
- known key with a new model/provider
Why it matters:
- novelty may be benign, but it deserves attention because it changes the operating picture
Unusual
A thing is not new, but it is behaving outside its expected pattern.
Examples:
- unusually expensive session
- unusually long duration
- unusual tool-call density
- unusual file or destination mix
Why it matters:
- unusual behavior often surfaces drift, misuse, or early incidents
Sensitive
Observed behavior intersects with assets or operations that increase security consequence.
Examples:
- auth or secret-adjacent files
- infrastructure configuration
- credentials or token stores
- high-value external destinations
Why it matters:
- consequence is higher even if volume is low
Concentrated
Risk, spend, or activity is disproportionately centered in one place.
Examples:
- one API key dominates spend
- one model drives most cost
- one session accounts for most tool calls
- one server becomes a dependency bottleneck
Why it matters:
- concentration increases blast radius and operational fragility
Unstable
Observed behavior suggests operational degradation or unreliable trust signals.
Examples:
- elevated MCP server error rate
- repeated capability failures
- rapidly shifting destination or tool patterns
Why it matters:
- instability can obscure detection and increase incident likelihood
Exposed
Behavior suggests data or requests crossing a meaningful boundary.
Examples:
- outbound HTTP instead of HTTPS
- unusual secondary calls
- sensitive file access followed by network activity
Why it matters:
- exposure is often the bridge from local activity to material risk
Low Confidence
We suspect something important, but attribution or interpretation is incomplete.
Examples:
- endpoint fingerprint missing
- user unresolved
- destination purpose unclear
- multiple possible explanations for the same pattern
Why it matters:
- uncertainty itself must be visible so the operator knows what still needs verification
Compound Signals
The dashboard should emphasize compound patterns more than isolated fields.
High-value combinations:
- unknown credential + unknown endpoint + active session
- sensitive file access + unusual outbound destination
- known user + new machine + expensive model
- new agent version + new capability mix + error spike
- low-confidence attribution + high-consequence asset touch
Evaluation Rule
A signal should move above the raw table when at least one of these is true:
- it changes trust
- it changes consequence
- it changes urgency
- it changes the next action
If it does none of those, it likely belongs lower in the page.