Feedbackgateandrulegovernance
Shadow-test candidate rules against recorded benign traffic, then require a human before anything enforces.
SentinelX is meant to learn from what it observes, but the path from observation to enforcement is deliberately slow. A candidate rule first runs in shadow mode against recorded benign traffic, where its false-positive rate is measurable and costs nothing.
It then sits in a human review queue. Only after approval does it feed back into L0's prior or L2's heuristics.
The reason is that honeypot input is attacker-controlled. If observed behaviour could author enforcement rules automatically, an attacker could deliberately perform behaviour that generates a rule which blocks your real users. That is a security boundary, not a workflow preference.
In this build the review queue exists: a converted session proposes a rule, a human approves or rejects it, and the review is final and records who made it. Shadow testing does not exist yet, so no rule shows a false-positive rate, and approved rules don't feed L0 or L2 yet.
- Signature candidates from L6
- Recorded benign traffic
- Shadow results
- Human review queue
- Approved rules into L0/L2
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
This makes the feedback loop slow by construction. That is the intended trade.