Use cases· Last updated 2026-09-21

Security input contracts with Jev

SIEM, EDR, and SOAR already detect and can isolate. Jev judges whether the alert narrative + evidence pack is enough and whether policy allows the proposed contain class. Code aborts auto-containment unless those atoms clear. Jev does not match IOCs, isolate hosts, or write detections.

This unofficial page is the input contracts slice of the security containment-abort pack. Intent: apply the Jev (TypeSafe System One) decision model to security containment-abort input contracts. Primary search language: Security Jev input contracts. Confirm patterns on docs.typesafe.ai. This site does not sell, issue, or proxy TypeSafe keys. Use a credential you already have from the console or a documented gateway.

Independent angle (cover ≠ clone): Evidence-sufficiency + policy-allow + abort thresholds before SOAR fires isolate/disable — not a clone of support-action recipes, LLM guardrail Noul screens, or SRE incident SEV classification.

Security use-case context

An input contract is the allow-list of fields you will ever POST for security containment-abort. It is a decision contract for the alert + evidence pack: if a field is not named in instructions, it should not be in state. That is how you beat noisy “dump the case” integrations — the rival-intent failure mode — without cloning anyone’s IA.

Hub: Use cases. Compare, when the other tool is the real job: security automation.

Input Contracts inputs

Documented System One inputs: state (string, object, or array of text) and a questions map. English is the primary training language. Images, audio, and video are not accepted.

Allow for security containment-abort:

{
  "alert": { "id": "SOC-1902", "text": "Impossible travel + new OAuth grant on finance-sso; user says travel is unexpected." },
  "asset": { "tier": "prod-idp", "owner": "identity" },
  "evidence": { "ioc_hits": 0, "enrichment_ok": true, "summary": "No hash match. New grant to unknown app. Last login US-East 40m earlier." },
  "policy": { "isolate": "Auto-isolate only if evidence_ok and asset.tier is not shared-idp.", "evidence_min": "Need either IOC hit or named user contradiction plus enrichment_ok." }
}

Bind paths: alert.text, evidence.summary, policy.isolate, policy.evidence_min, asset.tier.

Refuse at the wrapper (do not send):

• PCAP, malware bytes, memory dumps, EDR screenshots
• the week’s SIEM histogram as unused tokens
• raw access tokens, session cookies, or password hashes (even “for context”)
• customer PII beyond what a named question needs

TypeSafe’s published list price for jev-1.13 is $0.042 per million input tokens (vendor claim — confirm on the models page); output tokens are free on that same page. Unused distractors still bill as input.

Decision signals and actions

The contract exists so each primitive stays atomic:

If a new SIEM field appears, either add a question that names it or drop it. Do not “just include it.” Do not treat a Noul of 0.5 as a “medium” security containment-abort score — it means yes and no are equally likely. Conjunctions stay in your code.

Guardrails and escalation

Contracts are a guardrail: missing required text or enrichment_ok == false → do not call Jev (or ask a Noul “is enough information present?”). That is cheaper than a confident wrong isolate. TypeSafe’s confidence-gated examples use a lower bar for recoverable reads than for irreversible actions. Those numbers are illustrations. For security containment-abort, treat auto_isolate_host as the high bar (isolating a host or disabling a credential). Tune on labels — see offline evaluation.

Evaluation and rollout notes

Version the contract (field list + criteria git SHA) next to the pinned model. Replay abort-reason gold from analysts, evidence_ok gold, and whether isolate was justified when either changes. Pin jev-1.13.0 (the versioned id) after you fit thresholds. jev-latest and the marketing line jev-1.13 can move. Log the response model. TypeSafe’s published list price for jev-1.13 is $0.042 per million input tokens (vendor claim — confirm on the models page); output tokens are free on that same page. Unused distractors still bill as input.

Official Python and JavaScript SDKs read TYPESAFE_API_KEY and retry documented 429/529. This site does not sell, issue, or proxy TypeSafe keys. Use a credential you already have from the console or a documented gateway.

Pack map

FAQ

What happens if I send the whole SIEM row? jev-1.13 loses accuracy as distractors grow (official jaggedness note). Drop PCAP and histograms. TypeSafe’s published list price for jev-1.13 is $0.042 per million input tokens (vendor claim — confirm on the models page); unused distractors still bill as input.

Can I send screenshots of the EDR console? No. State is text (string, object, or array of text). Transcribe first.

Where is the rest of the Security pack? Start with Security decision workflow and Security evidence collection. Cluster hub: Use cases.

Is this the LLM guardrails cookbook? No. Guardrails screen prompts and completions. This pack aborts containment when evidence or policy is thin. See LLM guardrails.

If IOC hits are already ≥ 1, should we wait for Jev? No. Deterministic contain wins. Jev is for leftover messy narrative.

What this page does not claim

• Not a SIEM, SOAR, EDR, or certified safety filter.
• No MTTD / MTTC benchmarks.
• Not official TypeSafe.
• Official TypeSafe status, or that jev.pro issues API keys.
• That a schema-constrained answer is automatically factually correct.

Disclaimer

This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai.

Primary documentation: https://docs.typesafe.ai. Hub: Use cases.