AI safety · Paging policy · Incident response
Correlation, not suppression: keeping AI away from the off switch
Grouping related alerts and deciding not to page are different jobs. Why BlipLite lets AI do the first and never the second, and what to ask any tool that promises fewer pages.
Zee · · 5 min read
In short
Correlation groups related alerts so a problem reaches a human once; suppression decides it reaches nobody. A wrong correlation is an untidy incident, a wrong suppression is an outage nobody was told about, so in BlipLite AI may explain and escalate but only a deterministic policy you write can hold back a page.
Two different jobs
Correlation is deciding that alerts belong together: forty TargetDown events from one node are one problem. Every alert is still there and visible, and the problem still reaches a human once.
Suppression is deciding that something doesn't reach a human at all. It's the decision with the asymmetric cost. A wrong correlation is an untidy incident. A wrong suppression is an outage nobody was told about.
Why a model shouldn't hold the off switch
- Model errors are quiet. A misclassified alert doesn't throw an exception; it just doesn't page.
- It's hard to audit. "The model thought it was low priority" isn't something you can fix in a post-incident review.
- It drifts. The same alert can get a different answer next month, and nobody changed anything you can diff.
None of that matters much when AI explains an alert or raises its priority. A wrong explanation is noticed by the human reading it. An unnecessary escalation costs one page.
The rule in BlipLite
Grouping is deterministic: same rule name, service and environment. AI then summarises the group and may suggest a severity. The paging decision comes from your policy, and the model can only move severity up:
The decision, in short
effective = max(alert.severity, triage.suggested) # never lower
decision = policy(effective, now) # page | notify | digest
# if triage errors or takes over 8 seconds,
# triage is skipped and the alert keeps its own severityEvery decision is stored with its reason, so "why didn't this page?" has an answer you can read, and a rule you can change.
Questions to ask any tool that promises fewer pages
- Can the AI, on its own, stop a page from going out?
- What happens when the model is slow, down or wrong?
- Can I see, per alert, why it was or wasn't paged?
- Can I run it on real traffic without it touching my paging?
- Are the paging rules something I can read and version?
If the answers are vague, the tool is asking you to trust it with the one decision you can't afford to get wrong. Shadow mode exists so you don't have to: run it alongside your current setup and compare.