Auditing the AI's Dismissed Alerts

3 min read

Burrow auto-hides alerts the Triage AI judged not real from the Active and Open tabs on the Alerts page. The intent is to keep your work queue focused on what still needs an operator. The AI is not always right, though — this article covers the spot-audit toggle and the cadence we recommend for reviewing the AI's calls.

Why AI-dismissed alerts auto-hide from Active

Without the auto-filter, every shift starts with the operator wading past AI verdicts they have no intention of overriding. With the filter on (the default), the Active and Open tabs only show things that genuinely need a human decision. Faster triage, lower fatigue.

The trade-off: if the AI dismisses something it should not have, the operator might never see it. That is what the spot-audit toggle is for.

The + AI-dismissed chip

On the Alerts page, look at the row of severity-band chips at the top of the filter bar. To the right of the severity chips sits a + AI-dismissed toggle chip.

Off (default): the AI auto-filter is applied — AI-dismissed alerts are excluded from Active and Open.
On: the AI auto-filter is bypassed — AI-dismissed alerts are mixed back into Active and Open alongside everything else, marked with the AI · NO badge so you can tell them apart at a glance.

Click once to flip on, click again to flip off. The toggle is per-session — refresh the browser and it resets to off so you do not accidentally leave it on forever.

When to use it

A reasonable cadence: flip it on once per shift, work top-down through the AI-dismissed entries for whatever lookback window you care about (24 h is fine on a busy tenant; widen to 7 d on a quiet one), then flip it off and continue with the focused queue. The goal is not to re-triage every dismissal but to confirm the AI's pattern of judgement is matching your own.

If you ever find a real alert the AI dismissed, override it (see below) and raise a support ticket so the engineering team can look at the verdict. Repeated misses on a specific category are the strongest signal for tuning the underlying rule.

The Dismissed tab as the persistent home

Whether or not the audit chip is on, the Dismissed tab on the Alerts page always shows the full set — both operator-dismissed and AI-dismissed alerts together. Filter, sort, and search work normally there.

The two kinds are distinguished visually on the row:

AI-dismissed — empty status select plus the AI · NO verdict badge.
Operator-dismissed — "Dismissed" shown in the status select (no AI badge needed; the operator's identity is in the audit history).

Overriding the AI

The operator override always wins. If you disagree with an AI dismissal, open the alert and set the status to Acknowledged, Investigating, or Escalated in the drawer or via the inline status select. The alert leaves the Dismissed tab, leaves the AI-dismissed pile, and stays visible under the tab matching the disposition you chose until you close it yourself.

The history of that override is logged on the History page with your operator identity, the original AI verdict, and your new disposition.