Skip to main content
Use this guide when Anthale returns detect, redact, or block and the team needs to decide whether the event was an expected catch, a false positive, a workflow bug, or a sign that the policy still needs tuning. The point of investigation is not only to explain one event. It is to make the next policy decision better.

​
Investigate the event

1

Confirm the returned action and boundary

Start with the Anthale action and the boundary where it happened. A block on final output means something different from a detect on retrieved context.
2

Check which guardrail triggered

Identify whether the hit came from prompt injection, data leakage, content moderation, topic control, or link control. That narrows the remediation path quickly.
3

Use metadata to locate the source

Pull the request, feature, tenant, session, document, or tool identifiers that explain where the content came from. This is where good metadata saves investigation time.
4

Decide whether the event was expected

Classify the event as expected malicious content, expected business-policy enforcement, false positive, false negative on a neighboring boundary, or an application wiring bug.
5

Check what the application did next

Confirm that your application enforced the returned Anthale action. For redact, confirm downstream systems used sanitized content rather than the original content.
6

Record the outcome as a tuning case

Save the example if it taught the team something new. The best investigations turn into regression tests, rollout decisions, or better boundary metadata.

​
Decision feedback and message handling

After each policy enforcement decision, operators can rate the returned action with like or dislike and add an optional comment. Anthale shares the related message content with Anthale employees only when an operator explicitly submits that evaluation. If no evaluation is submitted, the message is not shared for employee review. Anthale does not use customer message data from policy enforcement to improve Anthale models. User information remains encrypted, and employee access is limited to explicit evaluation submissions that include the rating, optional comment, and related messages.

​
Fast triage table

​
Common mistakes

  • Looking only at the model prompt and ignoring retrieved context, tool output, or memory.
  • Treating detect as low priority even when the same pattern repeats.
  • Updating one policy immediately without preserving the example for later regression testing.
  • Investigating the Anthale hit without checking whether the application mis-handled redact or block.

​
Next steps

Continue with What Metadata to Send with Anthale Enforcement Requests or Test Anthale Policies Before Production.
Last modified on April 12, 2026