Alerts and real-time response

Last reviewed: October 8, 2026

Briard Alert & Response Console (BARC) watches approved metadata from connected AI, agent, cloud, guardrail, vector, observability, and security sources. It turns meaningful changes into a prioritized response queue while keeping the score, source, uncertainty, and evidence boundary visible.

The shortest operating path is:

Observation → Alert → Situation → Case → Response handoff → Verifiable package

An alert tells a person where to look. It is not proof that an attack, breach, policy violation, or legal incident occurred.

What appears in Briard-AI

Workspace owners and administrators with BARC access see AI incident alerts on Briard-AI Home:

• total active alerts;
• P1, P2, P3, and P4 counts;
• counts for each AI incident category;
• up to three alert titles with a Review link; and
• protected links that open the selected alert in BARC.

The summary contains no raw prompts, model responses, files, secrets, or full evidence records. Briard-AI creates a short-lived, tenant-scoped BARC session only after the organization agreement, role, and recent authentication are checked. BARC remains the authority for the alert and its evidence.

To understand what a closer case investigation may examine or retain, see Choose what BARC can access. Briard-AI preserves a validated alert or case destination through sign-in, but BARC alone checks and records the case's access requests and decisions.

Read the summary state

P1 Urgent, P2 High, P3 Medium and P4 Low appear with their counts. Open BARC alerts opens the full queue. Opening an alert may require a fresh phone-code check; its selected destination is retained through the authorized handoff.

If the summary cannot load, use Retry; unavailable data is not a zero count. Set up BARC means access needs attention. No open alerts applies to the current active queue and does not prove every AI tool is monitored. The Home card is a summary loaded with the page or retry; use the BARC Alerts page for the live queue and its refresh state.

Four categories

Category	What it covers
Attack & integrity	Prompt injection, model manipulation, integrity changes, guardrail failures, and suspicious source behavior
Access & data	Unexpected identities, retrieval exposure, sensitive-data access patterns, and permission changes
Agent actions	Tool calls, autonomous steps, execution paths, and actions outside an approved boundary
Misuse & operational impact	Abuse, anomalous volume, service impact, cost spikes, and harmful business outcomes

The category helps route the alert. It does not decide the final incident classification.

P1–P4 priorities

Priority	Plain-language meaning	Expected first action
P1	Immediate and potentially severe impact	Acknowledge now and begin the response process
P2	High risk or meaningful spread	Review promptly and assign an owner
P3	Concerning behavior that needs investigation	Review in the normal response queue
P4	Low-risk or early signal	Monitor, tune, or document why no action is needed

BARC considers contextual risk, asset or data importance, reported consequence, recurrence, corroboration and urgency. Confidence and consequence rules can affect the priority independently of the numeric score. New assessments use the current versioned priority model; historical assessments retain their original version. Open the explanation, contributing evidence and policy version before comparing alerts. A source-reported outcome is not an independently verified effect.

Real-time delivery

The Alerts page updates through a live event stream when the network and deployment support it. If the live stream is interrupted, BARC falls back to bounded refresh checks and shows that the view is reconnecting or temporarily stale.

Do not claim continuous coverage unless:

• expected connectors are healthy;
• recent source receipts are present;
• the alert view is current; and
• the relevant policy is enabled.

Missing receipts remain a documented visibility gap.

Work an alert

1. Open Alerts.
2. Start with P1, then P2.
3. Confirm the tenant, environment, time, category, priority, confidence, and visibility boundary.
4. Review the score explanation and contributing metadata.
5. Open the timeline and related alerts.
6. Acknowledge the alert so the team knows a person owns the first review.
7. Choose the next honest state: investigate, wait for customer action, suppress with a reason, resolve with a reason, or promote to a case.

Acknowledging means “a responder has seen this.” It does not mean the alert is true or contained.

Situations and cases

BARC groups alerts that share meaningful metadata into a situation. A situation helps the responder see possible spread without prematurely declaring one root cause.

Promote an alert or situation to a case when the work needs a durable investigation record, multiple owners, formal conclusions, or a custody-verifiable export. The case retains the originating alert references and their evidence boundaries.

The Access for this investigation card distinguishes routine metadata-only monitoring from extra access for a case. Open the linked case's Private evidence section to continue. Request deeper investigation offers Check content and show findings or Read original evidence. The case guides the required approvals and prepares approved originals automatically. Sending a request does not begin collection. See the access-choice guide for the complete journey.

Response handoffs

BARC can create metadata-only response handoffs for configured destinations such as email, a signed webhook, PagerDuty, or ServiceNow. A handoff records what BARC requested or reported. It does not prove that the destination received, executed, or independently verified an action.

Keep these states separate:

1. proposed;
2. approved;
3. sent;
4. accepted by the destination;
5. reported as executed; and
6. independently verified.

BARC does not silently block an AI system or execute a containment decision as an inline control.

Tune without hiding risk

Use suppression, snoozing, and rule controls only with a named owner, reason, scope, and expiration where appropriate. Before changing a rule:

• review recent examples;
• confirm which category and environment are affected;
• check whether a missing source caused the noise;
• preserve the change record; and
• test the result with fictional metadata.

Never reduce noise by deleting evidence or relabeling an inference as a fact.

Safe first exercise

Use fictional metadata to generate at least one alert in every category and at least one P1, P2, P3 and P4. Then:

1. confirm the dashboard summary counts match BARC;
2. open a protected alert link from Briard-AI;
3. review its score and visibility boundary;
4. acknowledge it;
5. inspect its situation timeline;
6. record a metadata-only response handoff;
7. promote one alert to a case;
8. record a human conclusion; and
9. export and independently verify the package.

The exercise must use no real prompt, response, customer file, credential, secret, or regulated data.