Change a filter's settings

Every change you save on a filter’s Settings tab writes a new version of the filter. Before you save, Sift tells you what the save will do: some changes take effect at once, and some need a fresh threshold approval because they could make the filter filter more. This guide shows where each setting lives, how the console tells you which kind of change you are making, and how to make the changes people make most.

When you’d do this

You want to poll the source more or less often, or change the query it reads.
You want to change the leak-through rate, the trigger ceiling, what happens on an alarm, or the retrain schedule.
You want to add, retune or switch on a pipeline stage.

Before you start

You need the operator or admin role. A reviewer sees every section read-only, with Changing settings needs the operator or admin role. What is shown is what is running. A filter with no spec version yet has nothing to configure: write its spec first (see Create a filter).

Where each setting lives

Section	What you change there
General	Identity: Name. Policy: Posture, Catch-cost multiple (with Custom), Min labels to train, Holdout (Last 20% or Last 30%). Monitoring: Escalation change (%), Score-shift alarm, Feature drift alarm, Retrain schedule. Collapse alarms (with a Collapse stage): Compression shift, Runaway share. On alarm: Stop filtering, Filter at a safer point or Keep filtering. The Intent is shown and fixed.
Source	Poll interval, Event time field, Watermark parameter, Cursor parameter, Tool parameters (JSON). Tool, Watermark field and Id field are fixed.
Labels	Where training labels come from, the agent’s past verdicts, and the verdict check.
Pipeline	One block per slot: Always escalate, Collapse repeats, Decide, Shape delivery. See Use Collapse, Always escalate and Shape delivery and Compare recipes in a bake-off.
Delivery	Volume: Max escalations per hour (the trigger ceiling) and Leak-through (%). Agent load: what the stream would cost the agent, The agent can take, and the Agent budget (see The agent budget). In shadow: In shadow, send the agent, sampled shadow. The paired agent: see Connect a filter to its agent. The threshold is shown, not typed: it is set on the threshold screen.
Lifecycle, Retire	State moves. See Hold, stop, resume or retire a filter.
History	Every version, who saved it, why, and what changed.

Every field and default is listed in the Filter settings reference.

Free and gated changes

A change that can only make the filter filter fewer events, or does not change what it filters, is free. A change that could make it filter more, or read or send something other than what was approved, is gated: it needs a new threshold approval. Some fields cannot change at all, because everything the filter has recorded is tied to them. Sift’s server decides which is which, not the console.

Change	Rule
Name, posture, catch-cost multiple, min labels, holdout	Free. They apply to the next proposal, not the running threshold.
Poll interval, event time field	Free.
Drift alarm levels, Collapse alarm levels, retrain schedule	Free. An alarm fails toward escalating.
Max escalations per hour	Free, either way.
Leak-through raised	Free.
Leak-through lowered	Gated: less leak-through filters more.
On alarm to Stop filtering	Free.
On alarm to Keep filtering	Gated, but saved as a re-affirmation of the standing approval (see below).
On alarm from Keep filtering to Filter at a safer point	Free.
On alarm from Stop filtering to Filter at a safer point	Gated, but saved as a re-affirmation of the standing approval.
Safer point lowered or cleared	Free.
Safer point raised	Gated, but saved as a re-affirmation of the standing approval.
The agent can take	Free, either way. It only changes what Sift suggests.
Agent budget set, or lowered; its queue’s depth or longest wait lowered	Gated, but saved as a re-affirmation of the standing approval: it keeps more from the agent.
Agent budget cleared, or raised; its queue’s depth or longest wait raised	Free.
Agent budget’s overflow toward Hold in a queue	Free. Away from it (Group the overflow, then Record only) is gated, but saved as a re-affirmation.
Agent budget’s pace or warning share	Free.
Sampled shadow, any change	Free in every state: it changes only what shadow sends, and an active filter does not sample.
Tool parameters, watermark parameter, cursor parameter	Gated.
The paired agent	Gated.
Pipeline stages	By slot; see Use Collapse, Always escalate and Shape delivery. Switching a stage to filtering, or changing the deciding recipe, is gated.
Intent, tool, watermark field, id field	Cannot change. A new intent or source is a new filter.

A gated field shows a needs approval badge once you change it, or a hatched zone on the side of its track that needs one. The leak-through track, for example, is hatched below the saved value.

Save a change

Open the filter’s Settings tab and pick a section.
Change the fields.

Select Review changes. Sift checks the change and shows What saving does, listing each changed field.

It says	What happens
Saves a new version. Nothing else changes.	A free change. If a threshold approval stands, it carries to the new version.
It waits for approval, and the filter keeps filtering on the running version until then.	A gated change on an active filter that Sift can hold back as a waiting version (below).
This filter stops filtering events when you save, and returns to shadow. …	A gated change on an active filter.
The re-affirmation text	While an approval stands, you made a gated change Sift lets you re-affirm instead: On alarm, the safer point, or the agent budget.
Nothing differs from the running version.	Nothing to save.
This change cannot be saved.	A fixed field changed, or the server refused it; the reason is under the field.

Fill in Why. It is required when the save returns the filter to shadow or re-affirms the approval, and optional otherwise.
Select the save button. It names what it does: Save version n, Save version n and return to shadow, or Save version n and re-affirm. Keep editing goes back without saving, and Discard beside Review changes drops your edits.

The section shows Saved as version n. On a filter that is not active, a gated change (other than Shape delivery grouping, below) saves at once; it is the next threshold approval that covers it.

The Pipeline section works the same way per block: Review change, a badge (Free, Needs approval, Waits for approval, Cannot change or No change), a required Why, and the save.

A version that waits for approval

On an active filter, a gated change to a pipeline stage other than the deciding one (for example, switching Collapse repeats on, or tightening it) does not stop the filter filtering. It is saved as a waiting version behind the running one. A change to the deciding stage’s recipe or parameters, or one that also changes the source, the agent or the operating point, returns the filter to shadow instead. The exception is a filter that filters only through Collapse repeats: retuning that stage’s settings waits too, measured on the stage’s own evidence.

The running version keeps filtering at its approved point.
Sift measures what the waiting version would do, on the same events the running model was measured on. Settings › Pipeline shows Version n waits while version m keeps filtering, with measuring, ready to review or not measured.
Actions shows a Waiting version card, Review the change, which opens the threshold screen. Approving swaps the two versions at once; rejecting discards the waiting one. See Approve a threshold.
Edits in Settings › Pipeline build on the waiting version. A save in any other section discards it, because swapping it in later would undo that save. So does any move that takes the filter out of active.

A filter has at most one waiting version. If its measurement never lands, select Measure again.

A change that only switches Shape delivery to grouping, or makes it group more, waits for approval in any state, not only on an active filter: the running version runs as it does now until someone approves it on the stage’s own evidence. Such a version survives the filter’s state changes; only retiring discards it. See Use Collapse, Always escalate and Shape delivery.

Common changes

Poll more or less often

In Source, set Poll interval. It takes 30 seconds to 15 minutes; the default is 60 seconds.
Review and save. It is free.

Change the leak-through rate

In Delivery, set Leak-through (%). It runs from 1% to 5%, default 3%, and can never be 0.
Review and save. Raising it is free. Lowering it is gated: on an active filter the save returns it to shadow.

Leak-through is how Sift measures what the filter misses; see Shadow and filtering.

Change the trigger ceiling

In Delivery, set Max escalations per hour (default 200). The track marks the window’s busiest hour.
Review and save. It is free either way.

The ceiling counts escalations only while the filter is filtering. With On alarm set to Stop filtering, reaching it returns the filter to shadow.

Change what happens on an alarm

In General, under On alarm, pick Stop filtering (moves to shadow, the default), Filter at a safer point (moves to the safer point approved with the threshold) or Keep filtering (raises an alert and keeps filtering).
Review and save.

Switching to Stop filtering is free, and so is Keep filtering to Filter at a safer point. Any other switch is saved as a re-affirmation of the standing approval, with your required reason: the filter keeps filtering, and the re-affirmation is recorded against your account.

An active filter’s safer point is approved with its threshold, so on an active filter with none, Filter at a safer point is shown disabled with that reason: choose it on the threshold screen when you next approve one. Under Stop filtering with no budget, on a stream at least four times the ceiling, a line under the field says what a tripped ceiling would send.

Set an agent budget

In Delivery, under Agent load, read the figures: the stream’s size, what shadow would cost the agent, and what it can take.
Pick a preset under Agent budget: Hold in a queue, Group the overflow (shown disabled, with why, where grouping is not available) or Record only. Custom opens every setting.
Set Runs an hour. Its track marks the busiest hour of escalations, shadow’s projected runs, the capacity and the Kindo rate limit.
Review and save.

Leaving Custom for a preset asks first, because the preset sets the queue and pace its own way. A link to the group from the Overview or Actions lands on it.

Change the retrain schedule

In General, under Monitoring, set Retrain schedule: Daily, Weekly (default), Monthly or Never.
Review and save. It is free: a retrain produces a model in shadow, and promoting it is approved separately.

Measure a stage before you switch it on

In Pipeline, set the stage to Measuring (or Watching for Always escalate). This is free: a measured stage records what it would do and filters nothing.
Let it gather evidence, or select Measure now where offered. Its evidence appears under How it decides on Overview.
Set it to its active mode when the evidence supports it, and save. This is gated.

What can go wrong

The save is refused. The server checks again when you save, against whatever is current then. Another person’s save, a pairing, or an approval may have changed the version under you; the form reloads from the running version.
A source change before scoring. If you change the source before the filter starts scoring, the gold set was drawn from the old source; the saved line links to Review or rebuild the gold set.