Drafting agreement only
These nine decisions were confirmed by the user for drafting on 9 October 2026. TM approval remains pending. Unresolved details remain open; publication does not change their authority.
| Reference | Confirmed decision | Remaining detail |
|---|---|---|
| RWD-001 | An authorised Operator may close a reviewed false alarm, duplicate or unverifiable alert without creating a case, with an outcome and note. Investigation, assignment or field intervention requires a case. Use existing outcome labels No threat found, Duplicate and Unable to verify. | Eligible source states, detailed validation and alert/case closure coordination. |
| RWD-002 | New internal alerts use a shared Operator queue. Acknowledgement records the Operator and time separately from case ownership. | Concurrent acknowledgement, per-user read indicators and escalation timing. |
| RWD-003 | Where an alert has a case, display that case’s responsible Operator on the alert; do not maintain a separate alert assignee. | Alert-to-case cardinality and linked-record lifecycle. |
| RWD-004 | Use a configurable fixed grouping window starting with the first qualifying detection. Later detections join without extending the window. | Duration, time basis, exact end boundary, late delivery and competing matches. |
| RWD-005 | Create a new alert for a new qualifying detection after closure; preserve the closed alert history. | Late delivery of an event that occurred before closure. |
| RWD-006 | Offer “Also close linked alert” when closing a case, requiring the Operator to confirm the alert outcome. Case closure alone does not automatically close the alert. | Cardinality, eligible states, notes, option default and failure handling. |
| ROLE-001 | Add Superadmin for platform security, monitoring, performance settings, backups, recovery and technical maintenance. Operational access requires a separately assigned role. | Superadmin provisioning, grantable roles and privileged account-management scope: DET-076. |
| ROLE-002 | Add Field Team accounts from M3. Members access assigned work and submit progress, evidence and completion details. | Remaining permission entries marked To confirm in section 2.2. |
| ROLE-003 | Operators retain case ownership, assign field work, review submitted results and close cases. Field Team completion does not close a case or establish threat resolution. | Existing case/alert state and combined-closure decisions remain open where listed. |
Read the active SRS and coverage record.