Decision model settings

The decision model is an optional, fast yes-or-no model that some Sift features ask about an event. It is off by default. You turn it on in the deployment’s configuration, not in the console; the gear icon (Administration) › Decision model shows whether one is configured, whether it is answering, and what it has been asked.

Whatever it answers, a decision model only ever adds escalations or raises a question for a person. It never filters an event. With none configured, the features that need one say they are unavailable, and every filter runs as it would without them.

The decision model is TypeSafe’s Jev, which Sift calls directly with its own key. It is not part of Kindo and does not go through your Kindo connection.

What uses it

Feature (as the usage panel names it)	What it does
Always-escalate rules	The Plain-language rules recipe in the Always escalate slot: asks the rule’s yes/no question of each event the filter would otherwise filter, and escalates it on a yes. Its leak-through check is listed separately.
Verdict check	Asks about each agent verdict; strong disagreements go to a person. See Answer the verdict check.
Fit check	Measures how well the model reads each filter’s policy.
Gold-set pool	Helps choose events for a gold set.
Check now	The admin’s test call on this page.

Plain-language rules cannot be chosen until a decision model is configured; see Filter recipes.

Turn it on

Set these in the environment of the backend services, then restart them. See Configure Sift for how to set environment variables.

Setting	Default	Meaning
`SIFT_JEV_ENABLED`	`false`	Turns the decision model on.
`SIFT_JEV_API_KEY`	unset	Your Jev API key, sent as a bearer token. Required when enabled: Sift refuses to start with `SIFT_JEV_ENABLED=true` and no key.
`SIFT_JEV_BASE_URL`	`https://api.typesafe.ai`	Where Jev answers. Must be an `http` or `https` address.
`SIFT_JEV_MODEL`	`jev-1.13.0`	The model version, pinned so readings do not change under a filter. Plain `jev` is refused by the API.
`SIFT_DECISIONS_MAX_RPS`	`15.0`	Requests per second to the model, for the whole deployment (between 0 and 100).
`SIFT_DECISIONS_MAX_STATE_CHARS`	`4000`	The most of one event sent per question (200 to 64,000).
`SIFT_DECISIONS_TIMEOUT_S`	`10.0`	Timeout for one call, in seconds (up to 120).
`SIFT_VERDICT_CHECK_DAILY_CAP`	`200`	Verdict-check questions per filter per UTC day. Verdicts past it are skipped and counted, not queued for the next day.

After the restart, open the page and select Check now.

You should see answered, with the time the call took and the model name.

To turn it off, unset SIFT_JEV_ENABLED and restart.

What leaves the deployment

For each question, Sift sends Jev:

the model name;
the event as the filter’s Decide stage reads it: the fields the stage uses, with their values, cut at SIFT_DECISIONS_MAX_STATE_CHARS;
the question: a rule’s own words, or for the fit check, verdict check and gold-set pool, the filter’s intent, asking whether a person must handle the event under it.

Nothing else about the filter, the agent’s run or your Kindo tenant is sent. See Security and data handling.

The page

State

The top panel names the provider in use and its state:

Badge	Meaning
Off	No decision model is configured. The default, not a fault. The page names the settings that turn it on and links to Turn it on.
Answering	Configured, and the last calls succeeded.
Not answering	Configured, and failing. “The decision model is not answering.”

When the model is called directly, the panel shows called directly: “Event fields go to the provider, outside Kindo.” When Sift has stopped calling it after repeated failures, it shows paused until a stated time.

Check now (shown unless the state is Off) asks one fixed question and shows answered with the time taken and the model, or no answer with the reason. It is a real call and is counted like any other.

The providers table lists each provider Sift knows: Kindo, which reads Not offered yet because Kindo does not provide a decision model; Jev (TypeSafe); and a development-only provider, which a production deployment cannot use.

Calls, last 30 days

Calls today, calls in 30 days, failed calls, and an estimated cost. Below, calls a day for each feature that asked. As numbers gives calls, failures, input and output tokens, and estimated cost per feature. The cost is the provider’s list price times the tokens Sift counted: an estimate, not a bill.

How well it reads each filter

One row per scoring filter: how well the decision model reads that filter’s policy (reads it well, reads it partly, does not read it, or not enough verdicts yet, not read yet, reading failed), on how many events, and when it was measured. Measure now, shown while the model is Answering, takes a fresh reading for one filter without waiting for its next retrain. The same reading is on each filter’s Overview.

When it stops answering

After several failures in a row, Sift stops calling the model for about a minute. The state panel shows paused until a stated time, and every feature that needs the model pauses and says why rather than queueing work against an outage. Then Sift tries again, and goes back to pausing if that call fails too.

Only failures that are the provider’s count: no connection, a server error, rate limiting that does not clear, a refused key, or an answer Sift cannot read.

Pausing never filters anything. A filter whose rules are paused sends what it would have sent without them.

Warnings

Code	Severity	When	Message starts
`decision_model_unavailable`	warning	A configured model is not answering and at least one filter asked it in the last 7 days.	The reason, then “{n} filter(s) use it: … Their decision-model features are paused; each filter runs as it would without them.”
`decision_model_direct`	info	Always, while Sift calls Jev directly.	“Sift calls the decision model {model} directly, outside Kindo, sending the fields each filter’s Decide stage reads. Its answers only ever add escalations.”

decision_model_direct describes a deliberate setting, so it is never sent to a notification webhook. decision_model_unavailable is.

The decision model: what it is and why it never filters.
Answer the verdict check
Configuration reference