Monitoring
For Both Executive and Technical ReadersA prediction engine answers the question it was asked. A model built from explicit mechanisms can answer a second one: should you still trust it right now?
01 The Gap
The model was validated once and trusted indefinitely. The world changed.
A model is fitted, validated once, and then trusted indefinitely, until the day the world quietly changes underneath it and the answers keep arriving with the same false confidence. The expensive failures are rarely wrong arithmetic. They are a model that was right last year and is wrong now, still being believed.
Most systems never ask whether they should be believed. An explicit causal model can. Alongside every answer, it runs a second, standing question: are the mechanisms this model encodes still the mechanisms the world is running? When the answer turns to no, the system says so, before the wrong answer reaches a decision.
02 The component
The operational instantiation of the Learn primitive, continuous drift detection.
Monitoring is the final Cognitive Primitives, Action component and the operational instantiation of the Learn primitive in production. It runs a standing likelihood monitor over incoming observations, distinguishes probabilistic anomalies (rare draws from an intact mechanism) from mechanism drift (the relationship itself has changed), and issues a TrustAlert when the evidence exceeds a drift threshold.
| Field | What it holds |
|---|---|
| Type | Probabilistic anomaly (the numbers look off) or mechanism drift (a relationship itself has changed) |
| Affected mechanism | Which edge or parameter triggered the alert |
| Likelihood trend | The running log-likelihood trend that crossed the drift threshold |
The distinction between anomaly types decides what to do. A probabilistic anomaly is a reason to look closer. A mechanism drift is a reason to stop trusting the model until it is re-elicited. Conflating the two produces either false alarms or dangerous silence.
The world changes silently. Individual predictions remain plausible throughout. Only a system with an explicit domain model, one that tracks expected log-likelihood across cases, can detect that the model as a whole has drifted.
03 How it works
Log-likelihood over time. Anomaly vs. drift. Trust gate.
Standing likelihood monitor. For each incoming observation, the model computes the log-likelihood, a measure of how surprising the observation is given the model, of that observation under the current mechanisms. A time series of log-likelihoods that drifts downward signals that the world is becoming harder to predict under the current model.
Anomaly classification. A single low log-likelihood is a probabilistic anomaly, a rare draw. A sustained downward trend is mechanism drift. The monitor distinguishes the two by comparing the observed trend against a control chart with explicit drift thresholds.
Trust gate. When a drift threshold is crossed, the monitor issues a TrustAlert with a recommended action: investigate (the drift may be local), re-elicit (the mechanism has changed and needs expert review), or suspend (the model should not be used for decisions until re-validated). The Pipeline can be configured to block certified outputs when a suspend alert is active.
For decades a rate cut lifted technology equities; the elicited mechanism carries that sign. When the observed regime reverses it, the disagreement is not a rare data point, it is a signal that the mechanism no longer holds.
04 The Brains
The one component whose job is to question the others.
Monitoring is the brains watching itself, the one component whose job is to question the others.
There is no .bayes file for Monitoring, it operates on any domain-specific domain model in production. The TrustAlert is a governance artifact: it is logged, versioned, and can trigger a suspension of the pipeline’s certified output until re-elicitation is complete.
monitor = Monitor(net, drift_threshold=-2.5)
for obs in incoming_stream:
alert = monitor.update(obs)
if alert:
if alert.type == "mechanism_drift":
pipeline.suspend() # block certified outputs
elicitation.schedule_review(alert.affected_mechanism)
05 Query in plain English
Should we still be trusting this model?
Monitoring answers the standing question: should we still be trusting this model?
The audit trail is the TrustAlert log. Suspension and re-elicitation decisions are part of the audit trail.
06 Where it sits
Final component in Cognitive Primitives. The only one running continuously.
Monitoring is the final component in the Cognitive Primitives layer and the only one that operates continuously in production. All other components fire on demand; Monitoring runs as a standing process alongside every inference the pipeline makes.
Upstream: the domain model, the AuditRecord stream from Execute, and incoming observations. Downstream: the TrustAlert feeds 12 BPMN Integration (which can block the governance handoff on a suspend alert) and triggers re-elicitation back to 02 Discovery and 03 Evidence. Monitoring is the feedback loop that keeps the domain model honest over time.