Pages
Finding Detail v1
Source: c79 finding-lifecycle — the "view all" drill · 2026-08-25
One finding's own page — the true home of the demoted flat view. The worklist shows last 5 of 200; this is the rest: the full occurrence stream with its envelope as real columns, above the finding's identity, adjudication, and audit record. Occurrences don't get standalone pages — they get a citable id, a row here, and an anchor into their session.
C-2001highacknowledgedopen 11d / 30d target · due 2026-09-04
agent: Claude Code · sofia
12 distinct unapproved tools from one agent
Detected :
2026-08-05 10:00
Last Seen :
2026-08-16 18:00
Occurrences :
×200 tool calls
Agent :
Claude Code · sofia
Reason :
Magnitude: 150+ unapproved calls in one week across 12 tools
12 distinct unapproved tools from one agent
C-2001highopen 11d / 30d target · due 2026-09-04
Claude Code · sofiaacknowledgedreason: Magnitude: 150+ unapproved calls in one week across 12 toolssession →
Adjudication :
Evidence :200 of 200 tool calls
Time | ID | Agent | Action | Detail | Session |
|---|---|---|---|---|---|
| 2026-08-16 18:00 | E-1200 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-16 16:38 | E-1199 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-16 15:16 | E-1198 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-16 13:54 | E-1197 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-16 12:32 | E-1196 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-16 11:10 | E-1195 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-16 09:48 | E-1194 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-16 08:26 | E-1193 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-16 07:04 | E-1192 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-16 05:42 | E-1191 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-16 04:20 | E-1190 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-16 02:58 | E-1189 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-16 01:36 | E-1188 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-16 00:14 | E-1187 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-15 22:52 | E-1186 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-15 21:30 | E-1185 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-15 20:08 | E-1184 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-15 18:46 | E-1183 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-15 17:24 | E-1182 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-15 16:02 | E-1181 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-15 14:41 | E-1180 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-15 13:19 | E-1179 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-15 11:57 | E-1178 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-15 10:35 | E-1177 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-15 09:13 | E-1176 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-15 07:51 | E-1175 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-15 06:29 | E-1174 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-15 05:07 | E-1173 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-15 03:45 | E-1172 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-15 02:23 | E-1171 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-15 01:01 | E-1170 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-14 23:39 | E-1169 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-14 22:17 | E-1168 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-14 20:55 | E-1167 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-14 19:33 | E-1166 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-14 18:11 | E-1165 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-14 16:49 | E-1164 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-14 15:27 | E-1163 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-14 14:05 | E-1162 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-14 12:43 | E-1161 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-14 11:22 | E-1160 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-14 10:00 | E-1159 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-14 08:38 | E-1158 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-14 07:16 | E-1157 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-14 05:54 | E-1156 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-14 04:32 | E-1155 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-14 03:10 | E-1154 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-14 01:48 | E-1153 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-14 00:26 | E-1152 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-13 23:04 | E-1151 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-13 21:42 | E-1150 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-13 20:20 | E-1149 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-13 18:58 | E-1148 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-13 17:36 | E-1147 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-13 16:14 | E-1146 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-13 14:52 | E-1145 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-13 13:30 | E-1144 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-13 12:08 | E-1143 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-13 10:46 | E-1142 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-13 09:24 | E-1141 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-13 08:03 | E-1140 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-13 06:41 | E-1139 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-13 05:19 | E-1138 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-13 03:57 | E-1137 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-13 02:35 | E-1136 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-13 01:13 | E-1135 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-12 23:51 | E-1134 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-12 22:29 | E-1133 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-12 21:07 | E-1132 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-12 19:45 | E-1131 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-12 18:23 | E-1130 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-12 17:01 | E-1129 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-12 15:39 | E-1128 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-12 14:17 | E-1127 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-12 12:55 | E-1126 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-12 11:33 | E-1125 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-12 10:11 | E-1124 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-12 08:49 | E-1123 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-12 07:27 | E-1122 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-12 06:05 | E-1121 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-12 04:44 | E-1120 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-12 03:22 | E-1119 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-12 02:00 | E-1118 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-12 00:38 | E-1117 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-11 23:16 | E-1116 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-11 21:54 | E-1115 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-11 20:32 | E-1114 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-11 19:10 | E-1113 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-11 17:48 | E-1112 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-11 16:26 | E-1111 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-11 15:04 | E-1110 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-11 13:42 | E-1109 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-11 12:20 | E-1108 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-11 10:58 | E-1107 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-11 09:36 | E-1106 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-11 08:14 | E-1105 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-11 06:52 | E-1104 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-11 05:30 | E-1103 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-11 04:08 | E-1102 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-11 02:46 | E-1101 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-11 01:25 | E-1100 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-11 00:03 | E-1099 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-10 22:41 | E-1098 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-10 21:19 | E-1097 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-10 19:57 | E-1096 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-10 18:35 | E-1095 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-10 17:13 | E-1094 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-10 15:51 | E-1093 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-10 14:29 | E-1092 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-10 13:07 | E-1091 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-10 11:45 | E-1090 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-10 10:23 | E-1089 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-10 09:01 | E-1088 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-10 07:39 | E-1087 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-10 06:17 | E-1086 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-10 04:55 | E-1085 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-10 03:33 | E-1084 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-10 02:11 | E-1083 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-10 00:49 | E-1082 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-09 23:27 | E-1081 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-09 22:06 | E-1080 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-09 20:44 | E-1079 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-09 19:22 | E-1078 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-09 18:00 | E-1077 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-09 16:38 | E-1076 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-09 15:16 | E-1075 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-09 13:54 | E-1074 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-09 12:32 | E-1073 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-09 11:10 | E-1072 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-09 09:48 | E-1071 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-09 08:26 | E-1070 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-09 07:04 | E-1069 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-09 05:42 | E-1068 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-09 04:20 | E-1067 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-09 02:58 | E-1066 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-09 01:36 | E-1065 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-09 00:14 | E-1064 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-08 22:52 | E-1063 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-08 21:30 | E-1062 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-08 20:08 | E-1061 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-08 18:47 | E-1060 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-08 17:25 | E-1059 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-08 16:03 | E-1058 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-08 14:41 | E-1057 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-08 13:19 | E-1056 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-08 11:57 | E-1055 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-08 10:35 | E-1054 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-08 09:13 | E-1053 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-08 07:51 | E-1052 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-08 06:29 | E-1051 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-08 05:07 | E-1050 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-08 03:45 | E-1049 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-08 02:23 | E-1048 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-08 01:01 | E-1047 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-07 23:39 | E-1046 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-07 22:17 | E-1045 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-07 20:55 | E-1044 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-07 19:33 | E-1043 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-07 18:11 | E-1042 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-07 16:49 | E-1041 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-07 15:28 | E-1040 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-07 14:06 | E-1039 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-07 12:44 | E-1038 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-07 11:22 | E-1037 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-07 10:00 | E-1036 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-07 08:38 | E-1035 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-07 07:16 | E-1034 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-07 05:54 | E-1033 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-07 04:32 | E-1032 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-07 03:10 | E-1031 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-07 01:48 | E-1030 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-07 00:26 | E-1029 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-06 23:04 | E-1028 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-06 21:42 | E-1027 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-06 20:20 | E-1026 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-06 18:58 | E-1025 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-06 17:36 | E-1024 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-06 16:14 | E-1023 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-06 14:52 | E-1022 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-06 13:30 | E-1021 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-06 12:09 | E-1020 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-06 10:47 | E-1019 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-06 09:25 | E-1018 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-06 08:03 | E-1017 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-06 06:41 | E-1016 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-06 05:19 | E-1015 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-06 03:57 | E-1014 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-06 02:35 | E-1013 | Claude Code | observed | tool call · redis-cli | session → |
| 2026-08-06 01:13 | E-1012 | Claude Code | observed | tool call · gcloud | session → |
| 2026-08-05 23:51 | E-1011 | Claude Code | observed | tool call · npm-publish | session → |
| 2026-08-05 22:29 | E-1010 | Claude Code | observed | tool call · docker-sock | session → |
| 2026-08-05 21:07 | E-1009 | Claude Code | observed | tool call · ssh-prod | session → |
| 2026-08-05 19:45 | E-1008 | Claude Code | observed | tool call · vault-cli | session → |
| 2026-08-05 18:23 | E-1007 | Claude Code | observed | tool call · terraform | session → |
| 2026-08-05 17:01 | E-1006 | Claude Code | observed | tool call · kubectl | session → |
| 2026-08-05 15:39 | E-1005 | Claude Code | observed | tool call · stripe-cli | session → |
| 2026-08-05 14:17 | E-1004 | Claude Code | observed | tool call · psql-prod | session → |
| 2026-08-05 12:55 | E-1003 | Claude Code | observed | tool call · gh-admin | session → |
| 2026-08-05 11:33 | E-1002 | Claude Code | observed | tool call · aws-cli | session → |
| 2026-08-05 10:00 | E-1001 | Claude Code | observed | tool call · aws-cli | session → |
Audit record :
2026-08-12 11:00reclassifysofiaMagnitude: 150+ unapproved calls in one week across 12 tools→ high
2026-08-06 09:15acknowledgekai
2026-08-05 10:00detectsystem
standalone world — acts here don't sync to the worklist mocks
Composition notes
- This page is the "view all" target — the demoted flat view's true home, per the no-silent-caps rule: the worklist caps at 5 and says so; completeness lives one click down. Product route shape: /findings/:findingId.
- The peek envelope becomes columns — Time · citable ID · Agent · Action (observed/held/blocked) · Detail · Session anchor. Occurrences get no standalone pages: a row here, a stable id for the audit packet, and a deep link to their session moment (anchoring to the specific turn is a c77 product requirement, not mocked).
- The status chip is the displayed-status ladder — risk states win; handling words (unacknowledged / acknowledged / escalated / enforced) show only while open, derived from the event log. Presentation only: tabs and SLA math read the risk partition.
- Evidence and audit stay split — occurrence stream (what the world did, filterable, truncation-honest) vs audit record (what humans did, occur-free, complete on its face). Same log, two lenses.
- Open thread rendered real here: promoting selected occurrences into curated EvidenceItems (the compliance report's EV-#### shape) for the security packet — raw stream below, citable register above.
- Siblings: worklist · state machine · findings → SLA. Try ?id=C-2004 for the held-connections case.