[{"data":1,"prerenderedAt":516},["ShallowReactive",2],{"cycle-doc-bob-wire-c9-signal-taxonomy.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":17},{"id":5,"title":6},"c9","Meaning-Layer Dashboard",{"id":8,"label":9},"bob-wire","Bob-Wire","signal-taxonomy.md","c9 Signal Taxonomy",[13,14,15,16],"Purpose","Primary Signal Classes","Compound Signals","Evaluation Rule",{"type":18,"children":19},"root",[20,28,34,39,46,51,56,81,86,94,100,105,109,132,136,144,150,155,159,182,186,194,200,205,209,232,236,244,250,255,259,282,286,294,300,305,309,327,331,339,345,350,354,372,376,384,390,395,399,422,426,434,439,444,449,478,483,488,511],{"type":21,"tag":22,"props":23,"children":25},"element","h2",{"id":24},"purpose",[26],{"type":27,"value":13},"text",{"type":21,"tag":29,"props":30,"children":31},"p",{},[32],{"type":27,"value":33},"This taxonomy defines the kinds of signals that should be elevated above raw entity data in the meaning-layer dashboard.",{"type":21,"tag":22,"props":35,"children":37},{"id":36},"primary-signal-classes",[38],{"type":27,"value":14},{"type":21,"tag":40,"props":41,"children":43},"h3",{"id":42},"unknown",[44],{"type":27,"value":45},"Unknown",{"type":21,"tag":29,"props":47,"children":48},{},[49],{"type":27,"value":50},"A thing exists in live activity but cannot be confidently tied to known inventory or policy context.",{"type":21,"tag":29,"props":52,"children":53},{},[54],{"type":27,"value":55},"Examples:",{"type":21,"tag":57,"props":58,"children":59},"ul",{},[60,66,71,76],{"type":21,"tag":61,"props":62,"children":63},"li",{},[64],{"type":27,"value":65},"unknown API key",{"type":21,"tag":61,"props":67,"children":68},{},[69],{"type":27,"value":70},"unknown user",{"type":21,"tag":61,"props":72,"children":73},{},[74],{"type":27,"value":75},"unknown endpoint",{"type":21,"tag":61,"props":77,"children":78},{},[79],{"type":27,"value":80},"unknown MCP client",{"type":21,"tag":29,"props":82,"children":83},{},[84],{"type":27,"value":85},"Why it matters:",{"type":21,"tag":57,"props":87,"children":88},{},[89],{"type":21,"tag":61,"props":90,"children":91},{},[92],{"type":27,"value":93},"unresolved attribution changes trust immediately",{"type":21,"tag":40,"props":95,"children":97},{"id":96},"new",[98],{"type":27,"value":99},"New",{"type":21,"tag":29,"props":101,"children":102},{},[103],{"type":27,"value":104},"A thing or combination has appeared for the first time recently.",{"type":21,"tag":29,"props":106,"children":107},{},[108],{"type":27,"value":55},{"type":21,"tag":57,"props":110,"children":111},{},[112,117,122,127],{"type":21,"tag":61,"props":113,"children":114},{},[115],{"type":27,"value":116},"first-seen agent version",{"type":21,"tag":61,"props":118,"children":119},{},[120],{"type":27,"value":121},"new destination host",{"type":21,"tag":61,"props":123,"children":124},{},[125],{"type":27,"value":126},"known user on a new machine",{"type":21,"tag":61,"props":128,"children":129},{},[130],{"type":27,"value":131},"known key with a new model\u002Fprovider",{"type":21,"tag":29,"props":133,"children":134},{},[135],{"type":27,"value":85},{"type":21,"tag":57,"props":137,"children":138},{},[139],{"type":21,"tag":61,"props":140,"children":141},{},[142],{"type":27,"value":143},"novelty may be benign, but it deserves attention because it changes the operating picture",{"type":21,"tag":40,"props":145,"children":147},{"id":146},"unusual",[148],{"type":27,"value":149},"Unusual",{"type":21,"tag":29,"props":151,"children":152},{},[153],{"type":27,"value":154},"A thing is not new, but it is behaving outside its expected pattern.",{"type":21,"tag":29,"props":156,"children":157},{},[158],{"type":27,"value":55},{"type":21,"tag":57,"props":160,"children":161},{},[162,167,172,177],{"type":21,"tag":61,"props":163,"children":164},{},[165],{"type":27,"value":166},"unusually expensive session",{"type":21,"tag":61,"props":168,"children":169},{},[170],{"type":27,"value":171},"unusually long duration",{"type":21,"tag":61,"props":173,"children":174},{},[175],{"type":27,"value":176},"unusual tool-call density",{"type":21,"tag":61,"props":178,"children":179},{},[180],{"type":27,"value":181},"unusual file or destination mix",{"type":21,"tag":29,"props":183,"children":184},{},[185],{"type":27,"value":85},{"type":21,"tag":57,"props":187,"children":188},{},[189],{"type":21,"tag":61,"props":190,"children":191},{},[192],{"type":27,"value":193},"unusual behavior often surfaces drift, misuse, or early incidents",{"type":21,"tag":40,"props":195,"children":197},{"id":196},"sensitive",[198],{"type":27,"value":199},"Sensitive",{"type":21,"tag":29,"props":201,"children":202},{},[203],{"type":27,"value":204},"Observed behavior intersects with assets or operations that increase security consequence.",{"type":21,"tag":29,"props":206,"children":207},{},[208],{"type":27,"value":55},{"type":21,"tag":57,"props":210,"children":211},{},[212,217,222,227],{"type":21,"tag":61,"props":213,"children":214},{},[215],{"type":27,"value":216},"auth or secret-adjacent files",{"type":21,"tag":61,"props":218,"children":219},{},[220],{"type":27,"value":221},"infrastructure configuration",{"type":21,"tag":61,"props":223,"children":224},{},[225],{"type":27,"value":226},"credentials or token stores",{"type":21,"tag":61,"props":228,"children":229},{},[230],{"type":27,"value":231},"high-value external destinations",{"type":21,"tag":29,"props":233,"children":234},{},[235],{"type":27,"value":85},{"type":21,"tag":57,"props":237,"children":238},{},[239],{"type":21,"tag":61,"props":240,"children":241},{},[242],{"type":27,"value":243},"consequence is higher even if volume is low",{"type":21,"tag":40,"props":245,"children":247},{"id":246},"concentrated",[248],{"type":27,"value":249},"Concentrated",{"type":21,"tag":29,"props":251,"children":252},{},[253],{"type":27,"value":254},"Risk, spend, or activity is disproportionately centered in one place.",{"type":21,"tag":29,"props":256,"children":257},{},[258],{"type":27,"value":55},{"type":21,"tag":57,"props":260,"children":261},{},[262,267,272,277],{"type":21,"tag":61,"props":263,"children":264},{},[265],{"type":27,"value":266},"one API key dominates spend",{"type":21,"tag":61,"props":268,"children":269},{},[270],{"type":27,"value":271},"one model drives most cost",{"type":21,"tag":61,"props":273,"children":274},{},[275],{"type":27,"value":276},"one session accounts for most tool calls",{"type":21,"tag":61,"props":278,"children":279},{},[280],{"type":27,"value":281},"one server becomes a dependency bottleneck",{"type":21,"tag":29,"props":283,"children":284},{},[285],{"type":27,"value":85},{"type":21,"tag":57,"props":287,"children":288},{},[289],{"type":21,"tag":61,"props":290,"children":291},{},[292],{"type":27,"value":293},"concentration increases blast radius and operational fragility",{"type":21,"tag":40,"props":295,"children":297},{"id":296},"unstable",[298],{"type":27,"value":299},"Unstable",{"type":21,"tag":29,"props":301,"children":302},{},[303],{"type":27,"value":304},"Observed behavior suggests operational degradation or unreliable trust signals.",{"type":21,"tag":29,"props":306,"children":307},{},[308],{"type":27,"value":55},{"type":21,"tag":57,"props":310,"children":311},{},[312,317,322],{"type":21,"tag":61,"props":313,"children":314},{},[315],{"type":27,"value":316},"elevated MCP server error rate",{"type":21,"tag":61,"props":318,"children":319},{},[320],{"type":27,"value":321},"repeated capability failures",{"type":21,"tag":61,"props":323,"children":324},{},[325],{"type":27,"value":326},"rapidly shifting destination or tool patterns",{"type":21,"tag":29,"props":328,"children":329},{},[330],{"type":27,"value":85},{"type":21,"tag":57,"props":332,"children":333},{},[334],{"type":21,"tag":61,"props":335,"children":336},{},[337],{"type":27,"value":338},"instability can obscure detection and increase incident likelihood",{"type":21,"tag":40,"props":340,"children":342},{"id":341},"exposed",[343],{"type":27,"value":344},"Exposed",{"type":21,"tag":29,"props":346,"children":347},{},[348],{"type":27,"value":349},"Behavior suggests data or requests crossing a meaningful boundary.",{"type":21,"tag":29,"props":351,"children":352},{},[353],{"type":27,"value":55},{"type":21,"tag":57,"props":355,"children":356},{},[357,362,367],{"type":21,"tag":61,"props":358,"children":359},{},[360],{"type":27,"value":361},"outbound HTTP instead of HTTPS",{"type":21,"tag":61,"props":363,"children":364},{},[365],{"type":27,"value":366},"unusual secondary calls",{"type":21,"tag":61,"props":368,"children":369},{},[370],{"type":27,"value":371},"sensitive file access followed by network activity",{"type":21,"tag":29,"props":373,"children":374},{},[375],{"type":27,"value":85},{"type":21,"tag":57,"props":377,"children":378},{},[379],{"type":21,"tag":61,"props":380,"children":381},{},[382],{"type":27,"value":383},"exposure is often the bridge from local activity to material risk",{"type":21,"tag":40,"props":385,"children":387},{"id":386},"low-confidence",[388],{"type":27,"value":389},"Low Confidence",{"type":21,"tag":29,"props":391,"children":392},{},[393],{"type":27,"value":394},"We suspect something important, but attribution or interpretation is incomplete.",{"type":21,"tag":29,"props":396,"children":397},{},[398],{"type":27,"value":55},{"type":21,"tag":57,"props":400,"children":401},{},[402,407,412,417],{"type":21,"tag":61,"props":403,"children":404},{},[405],{"type":27,"value":406},"endpoint fingerprint missing",{"type":21,"tag":61,"props":408,"children":409},{},[410],{"type":27,"value":411},"user unresolved",{"type":21,"tag":61,"props":413,"children":414},{},[415],{"type":27,"value":416},"destination purpose unclear",{"type":21,"tag":61,"props":418,"children":419},{},[420],{"type":27,"value":421},"multiple possible explanations for the same pattern",{"type":21,"tag":29,"props":423,"children":424},{},[425],{"type":27,"value":85},{"type":21,"tag":57,"props":427,"children":428},{},[429],{"type":21,"tag":61,"props":430,"children":431},{},[432],{"type":27,"value":433},"uncertainty itself must be visible so the operator knows what still needs verification",{"type":21,"tag":22,"props":435,"children":437},{"id":436},"compound-signals",[438],{"type":27,"value":15},{"type":21,"tag":29,"props":440,"children":441},{},[442],{"type":27,"value":443},"The dashboard should emphasize compound patterns more than isolated fields.",{"type":21,"tag":29,"props":445,"children":446},{},[447],{"type":27,"value":448},"High-value combinations:",{"type":21,"tag":450,"props":451,"children":452},"ol",{},[453,458,463,468,473],{"type":21,"tag":61,"props":454,"children":455},{},[456],{"type":27,"value":457},"unknown credential + unknown endpoint + active session",{"type":21,"tag":61,"props":459,"children":460},{},[461],{"type":27,"value":462},"sensitive file access + unusual outbound destination",{"type":21,"tag":61,"props":464,"children":465},{},[466],{"type":27,"value":467},"known user + new machine + expensive model",{"type":21,"tag":61,"props":469,"children":470},{},[471],{"type":27,"value":472},"new agent version + new capability mix + error spike",{"type":21,"tag":61,"props":474,"children":475},{},[476],{"type":27,"value":477},"low-confidence attribution + high-consequence asset touch",{"type":21,"tag":22,"props":479,"children":481},{"id":480},"evaluation-rule",[482],{"type":27,"value":16},{"type":21,"tag":29,"props":484,"children":485},{},[486],{"type":27,"value":487},"A signal should move above the raw table when at least one of these is true:",{"type":21,"tag":57,"props":489,"children":490},{},[491,496,501,506],{"type":21,"tag":61,"props":492,"children":493},{},[494],{"type":27,"value":495},"it changes trust",{"type":21,"tag":61,"props":497,"children":498},{},[499],{"type":27,"value":500},"it changes consequence",{"type":21,"tag":61,"props":502,"children":503},{},[504],{"type":27,"value":505},"it changes urgency",{"type":21,"tag":61,"props":507,"children":508},{},[509],{"type":27,"value":510},"it changes the next action",{"type":21,"tag":29,"props":512,"children":513},{},[514],{"type":27,"value":515},"If it does none of those, it likely belongs lower in the page.",1794599429306]