Get started
Tenant adaptation
Understand the tenant-adaptation rollout boundary and the manual controls available today.
Tenant adaptation is the reserved name for two per-project, opt-in capabilities: threshold proposals and tenant-adapted classifiers. It is a beta, experimental capability with a milestone-gated rollout.
Current status#
The current runtime uses manual threshold changes and static artifacts. Label persistence, proposal computation, and tenant-specific adapter serving are later rollout milestones. The current capability map does not include project.labels.write or dashboard actions for these operations.
Integrity ships static classifier artifacts. Project thresholds change only when a user with project.policy.write edits policy. Nothing learns from live traffic, and no adaptation work runs in the request path.
Mechanisms#
| Mechanism | Scope | How it changes | Status |
|---|---|---|---|
| Project threshold tuning | Gateway verdict boundaries | You edit flagged and unsafe values manually. | Live |
| INT-CoT source-model calibration | Reasoning thresholds by source model | A static map ships with the classifier artifact. | Live |
| Threshold proposals | Suggested operating points per guard | Proposed from reviewed labels and applied by a human. | Experimental (M2) |
| Tenant-adapted classifiers | Classifier decision boundaries | Scoped as an offline adapter engagement on reviewed labels. | Experimental (M3) |
Rollout gates#
The operational sections for tenant adaptation remain unpublished until their runtime contracts exist. Each milestone requires the following evidence:
| Milestone | Required runtime evidence | Current status |
|---|---|---|
| Trace labeling | Label persistence, a write API, project.labels.write authorization, and trace-review UI. | Experimental (M1) |
| Threshold proposals | An offline proposal job, proposal persistence, labeled-set impact output, and a human apply or dismiss action. | Experimental (M2) |
| Tenant-adapted classifiers | An offline adapter lifecycle with validation, serving isolation, version attribution, and rollback. | Experimental (M3) |
What to do today#
Start in Observe. Review representative traces and score distributions, correlate results with your application logs, and edit thresholds manually on the policy screen. See Thresholds and calibration for the current workflow.
Data boundary#
Changing the project content mode changes what telemetry may retain. It does not enable labels, proposals, weight updates, or adapters. The production runtime does not use traces or security events to change classifier weights, fit project thresholds, or change policy.