Approve a threshold

A threshold approval is how a filter starts filtering: you read what Sift measured on the filter’s newest events, pick the operating point, write why, and approve. It is the second of a filter’s two approvals, and nothing else starts a filter filtering. Operating point and approval explains what is measured, how a posture picks a point, and why a person must approve; this page is the steps.

When you do this

When a filter in shadow has collected enough labels and trained a model, Sift proposes an operating point and moves the filter to proposed. The Actions tab then shows Approve an operating point with Approve the threshold (or Approve the budget), and the Overview tab’s Threshold decision panel has Review threshold. Both open the threshold screen, Threshold promotion.

The same screen decides a few other things, covered in Other decisions on this screen.

Before you start

You need the operator or admin role. The form is shown to reviewers, but the server refuses their decision.
If the figures are new to you, read How Sift measures a filter once.

Read the evidence

The screen opens with one line on what approving does, then What this filter was asked to do: the filter’s intent. Read the evidence in order:

These figures are conditioned (only when shown). The agent already runs behind a trigger, so the figures describe only the events that trigger let through.
Posture, when the screen offers it. Each posture picks its own point from the measured trade-off, with no retrain: Maximise savings, Balanced and Catch everything, plus Custom if the filter’s posture is already custom. Each option shows how many in 100 events it would filter.
Proposed operating point. An event scoring at or above the threshold reaches the agent; below it, the event is filtered. Below that, On an alarm chooses what the filter does when a drift alarm fires, approved with the point: Stop filtering (the default), Keep filtering, or Filter at a safer point. Each shows its agent runs an hour at today’s volume. Where the screen offers no choice, a line says what the filter does instead.

Under Filter at a safer point, pick the point under Safer point: 99.5% recall (the default), 99% recall, or Custom, any measured point below the threshold that catches at least as much. Each shows what it filters and its runs an hour. One approval covers both points. A filter whose new-filter flow chose the safer point opens on it.
Measured on a temporal holdout: Recall at this threshold, Precision at this threshold, Missed at this threshold and Holdout size. They are measured against the agent’s own verdicts, so where the agent over-calls, recall reads lower than the model achieves. On a filter that sampled in shadow, recall carries its 90% interval (“90% interval 93–100%”) and a line says what it was measured on: “Measured on 2,483 judged of 105,958 events.”
A savings warning, if there is one: A thin saving, or This filter would save almost nothing, which needs an acknowledgement to approve.
What you would be choosing between: a selection of measured points, per 100 events: how many Reach the agent, how many are Filtered, and Of 10 that mattered, missed. The marked row is the point you would approve.
Projected volume: Filter rate and Agent runs avoided per day. These are estimates carried forward from the holdout onto the live stream, not measurements.
If you approve, this is what gets filtered, then Where these figures came from: the model and recipe, when it was trained, the labels used, and the spec version.

Choose a different point (optional)

You can approve a point other than the one the filter’s posture picked. This is offered only for a trained model’s measured threshold, not for a budget, a fixed rule or a stage approved on its own evidence.

Select another Posture. When it is not the filter’s own, Also make this the filter’s posture. appears, already ticked: leave it ticked so the next retrain picks its point the same way, or untick it to approve this point only.
Or open Choose a different point and step with ◀ fewer filtered and more filtered ▶, or select a row in the table. The stepper shows the change in share filtered and events missed against the posture’s point, and the point is labelled Your choice.

Only points Sift measured can be chosen. You never type a threshold.

Decide

In the Decide panel, choose Approve this operating point or Reject this operating point.
Write the Rationale. It is required, up to 2,000 characters. It is recorded with the approval, along with the evidence on the screen.

If you chose a different point, say why you chose it over the posture’s.

If the panel shows an acknowledgement, tick it. Approving without it is refused. It appears when:

Condition	What you accept
This filter would save almost nothing	The risk a filter carries without the saving it exists for.
A budget whose recall has not been measured	A review-load ceiling with no measured statement of what it misses.
A retrained model, or a stage joining, that did no better, did worse, or was not compared	Changing what the filter filters anyway.
The running model at a point its training did not measure, or a waiting version whose effect was not measured	What it would miss (or fold away) there has not been measured.

Rejecting never needs it.

Select the decision’s button, read the consequence, and confirm with Approve — begin filtering below {threshold} (the threshold to two decimals, for example 0.41) or the reject button.

On a filter in shadow or proposed, rejecting confirms with Reject and keep the filter in shadow. On a filter that is already active, it confirms with Reject and change nothing else.

What you should see

On approve, the screen says “Approved at {threshold}. {filter} is active.” Sift saves the approved operating point as a new version of the filter, records your approval with it, and moves the filter to active. Events scoring below the threshold stop reaching the agent, apart from the leak-through sample, which is sent anyway. The filter’s badge becomes Filtering. Stop filtering, under Stop or hold in the filter’s header, reverses it at once with no approval (see Hold, stop, resume or retire a filter). Select Back to the filter to leave.

On reject, “Rejected. {filter} is back in shadow.” The filter keeps scoring and collecting labels and filters nothing. The rejected proposal is not offered again; the next training proposes another. Select Back to actions; beside it, “Next:” names the step the filter is on.

Other decisions on this screen

What is waiting	Approve	Reject
A budget instead of a threshold: the strangest events each hour	Approve this budget, confirmed with “Approve — escalate the {n} strangest an hour”	Reject this budget
A recipe that fixes its own decision (the operating point reads Set by the recipe)	Approve this operating point, confirmed with Approve — begin filtering	Reject this operating point
A Collapse repeats stage, on its own evidence: its compression and purity, with no recall	Approve collapse repeats, confirmed with Approve — begin filtering repeats. Repeats stop reaching the agent; every other event still does.	Reject for now. It keeps measuring in shadow.
The running model, on a version no approval stands for (Sift took the filter out of service because the version had none, or a person’s change needed a new one)	Approve the running model: it filters again on the model already serving, with no retrain, and no new version is written.	Reject the running model, confirmed with Reject and change nothing else. A retrain is the other way forward.
A retrained model, on an active filter	Replace the running model with this one	Keep the running model. The retrained model is retired.
A stage’s first model joining the stages that filter now, on an active filter	{stage} joins, filtering	Keep running without it. The model is retired.
A settings change waiting behind the running version	Swap in version {n}. The existing version runs from then on; the filter keeps filtering throughout. While its figures are still being measured, only the reject is offered (“Approval opens when its figures land.”).	Discard version {n}. The running version and its approval stand.
A grouping change in Shape delivery, on a filter that is not active (the screen is titled Grouping approval)	Swap in version {n}. Escalations may share an agent run; none is filtered.	Discard version {n}

When a fall-back by drift or the trigger ceiling withdrew an approval, the screen does not offer the running model: restore it from the Actions tab with Resume on the current model; see Hold, stop, resume or retire a filter. Grouping and Collapse are covered in Use Collapse, Always escalate and Shape delivery.

What can go wrong

You see	What it means	What to do
No operating point is awaiting approval	Nothing is proposed. The panel says why: no model has been trained yet; the model in shadow is `underpowered` (too few events that mattered among those it was measured on to measure recall); training proposed nothing, with its reason; a Collapse stage is still collecting clusters with verdicts; or, on an active filter, nothing new is waiting.	Leave the filter in shadow and let verdicts accumulate; see Work through Actions.
This filter would save almost nothing	Filtering this little still carries the risk of filtering the wrong event.	Usually reject and leave it in shadow, or filter a different stream.
The approval is refused	You are a reviewer, an acknowledgement was missing, or the proposal changed while you read it.	Ask an operator or admin, or reload the screen.
The approval asks you to tick that you accept the recall’s interval	The filter was measured on a sampled shadow, and the interval’s lower end is below the filter’s recall target: the sample cannot show the point clears it.	Tick it and approve, which is recorded with the approval, or reject and let the filter keep sampling.