01 The Episode
Three log lines and an analyst question.
A SOC analyst is reviewing a SIEM alert cluster for account jsmith@corp.example. The raw telemetry spans eighteen minutes:
The analyst types:
That question enters the pipeline. Here is what happens at each stage.
02 Parse
Natural language becomes a typed query.
The LLM runs under a constrained decoding schema. It extracts entities, links them to canonical variable IDs in the scope card, infers the rung from linguistic markers, and assigns soft-evidence confidences to hedged observations. It does not decide whether an attack occurred.
The London login is not a certain observation, the analyst flagged it as odd, not as confirmed impossible. It enters as soft evidence at 0.72. The PowerShell execution and the large upload are structurally clear from the logs and enter as hard evidence.
CausalQuery, emitted by the LLM parser
No natural language crosses into the reasoning core. The rung is a first-class field. The analyst’s hedge (“looks odd”) is preserved as a calibrated probability, not rounded to a yes or no.
03 Formalize
The query becomes a formal estimand.
Pure code. Given rung = 1 and outcome = AccountCompromise, the estimand is mechanical: P(AccountCompromise | LoginLocationAnomaly=0.72, PrivilegeEscalation=true, LargeEgressVolume=true, UnusualEgressDest=0.85). The same query always yields the same estimand.
04 Route
Scope-card satisfiability selects the model.
The router queries the model registry. It checks whether any scope card’s variables contain all four evidence nodes and the target node, whether the regime matches corporate_endpoint_accounts, and whether it supports Rung 1 inference. The account-compromise DBN scope card satisfies all three conditions. One model, single-model path.
05 Identify
The gate: certificate or refusal.
Before any numbers are computed, the identification algorithm runs on the chosen graph. For a Rung 1 observational query on a DBN with no unblocked backdoor paths from the evidence to the target, all conditioning variables are observed, the estimand is identified by direct conditioning. No adjustment set is required. The gate passes and issues a certificate.
No certificate, no downstream reasoning. Had the identity been ambiguous, shared credentials, VPN relay, no device fingerprint, the pipeline would have returned a refusal object here and stopped. The analyst would see why, not a fabricated posterior.
06 Compose
Single-model path, no composition required.
The router found a single covering model, so the composition stage is a pass-through. No cross-model d-separation check is needed. A CompositionCertificate is still emitted for completeness of the audit record, recording that no composition was required.
07 Execute
Bayes Server infers the posterior. Exactly.
The four evidence bindings, two hard, two soft, are submitted to the compiled junction tree. Message passing propagates the evidence through the dynamic BN. The result is a full posterior distribution over every node, not just the target. The inference is exact where the treewidth allows; this model’s structure is within the exact-inference budget.
The genetic optimizer searched the action space, all combinations of the scope card’s intervention nodes, against the objective (maximize P(containment)) and the disruption constraint (avoid host isolation unless P(AccountCompromise) ≥ 0.97). Host isolation was rejected as decision-irrelevant here: the account can be disabled without it, and the disruption cost is not yet justified.
08 Audit
Everything bundled into one reproducible record.
Audit assembly composes the formal estimand, the identification certificate, the composition certificate, the model version, the evidence bindings, the posterior, the contributions, and the recommended actions into an AuditRecord. This is the object that gets logged, reviewed, and contested, not a prose summary.
09 Narrate
The LLM verbalizes the result it did not compute.
The second and final LLM stage takes the finished AuditRecord and renders it as a plain-language analyst report. It explains the posterior, attributes it to the evidence that moved it, and states the recommended actions with the rejected alternative and why. It does not revisit the reasoning.
Analyst report, narrated output
The model puts account compromise at 94% for jsmith@corp.example based on four signals observed over eighteen minutes.
The privileged PowerShell execution on the domain controller carries the most weight (+31 points). The 4.1 GB upload to Dropbox adds another +24, and the unusual destination a further +19. The London login, entered as a 72% confidence observation because it was flagged as unusual rather than confirmed anomalous, contributed an additional +8.
Policy recommends three actions: disable the account, collect a memory image from WIN-DC-01, and reset credentials. Host isolation was evaluated and rejected: at 94% compromise probability it does not yet meet the disruption threshold (97%), and disabling the account achieves containment without taking down the host.
Two assumptions underlie this: account identity is stable across the session window, and the location anomaly confidence reflects the analyst’s calibrated judgment. If either is wrong, the audit record is the place to contest it.
10 What Changed
The things a verdict without a pipeline cannot give you.
- The hedge is preserved. The analyst said “looks odd”, that entered as 0.72, not as a confirmed fact. The posterior reflects it accordingly.
- The gate can refuse. Had the identity been ambiguous, the pipeline would have returned a refusal at stage 4. The analyst would see the reason, not a fabricated 94%.
- Every number traces to evidence. The impact attributions show exactly which signals moved the posterior and by how much. A contested finding has a specific place to push back.
- The rejected action is documented. Host isolation was considered and declined, with the reason stated. The audit record says so. In a post-incident review, that matters.
- The assumption is named. “Account identity is stable within the session window” is stated, not buried. If VPN relay or shared credentials make it false, that is where the contestation starts.
- Reproducibility is structural. The same episode, the same scope card, the same evidence bindings, same result, every time. Not a property of the model’s mood.