Response and proposals
Nyxtrace records and reviews response actions. In the free core it does not execute them: it changes no firewall, no endpoint and no remote system. Execution is a separate Pro module with its own approval path, its own rollback and its own gates.
Saying that plainly is deliberate. A security tool that implies it contained something it merely logged is worse than one that contained nothing.
Response actions
Section titled “Response actions”A response action is a proposal with a target and a written way back.
| Field | Meaning |
|---|---|
| Kind | quarantine_device, block_destination, notify_only |
| Target | The device or destination |
| Reason | Why, in words |
| Rollback plan | How to undo it, in words, written before approval |
| Requested by / approved by | Who |
| Status | proposed, approved, rejected, cancelled, executed, rolled_back, failed |
This version can create a proposal and move it through approved, rejected or
cancelled only. The later statuses exist in the model so that the executor
module fits into the same record rather than inventing a parallel one.
The rollback plan is a required field, not a convention. If you cannot write down how to undo an action, you are not ready to approve it.
Proposals
Section titled “Proposals”The same review mechanism carries every change that a model or an analyst wants and a person must approve:
| Kind | Proposes |
|---|---|
device_classification |
A device type and owner, from existing metadata |
model_author |
A new detection model, as validated YAML |
triage |
A threshold or exception change, from false-positive feedback |
Every one is stored as a tenant-scoped proposal with a status, a revision, the requester and timestamps. A decision is a separate call carrying the revision it was based on and an idempotency key.
Three rules make this more than a formality:
Approving a model proposal does not activate the model. It records that a person considers it good. Activation is a separate deployment step.
Approving a triage proposal does not change a threshold. Same reason.
Approving a classification proposal applies exactly two fields — the suggested device type, and the owner if one was suggested — with the normal classification audit trail. It does not touch the display name or the tags, and a suggested null owner preserves the existing owner rather than clearing it.
A model proposal is only stored at all once its generated YAML validates against the safe model language. Invalid output does not become a pending item for a human to puzzle over.
Model feedback
Section titled “Model feedback”Marking an incident as a false positive, or rating a model result as useful or not, records tenant-scoped human feedback. It never retrains or activates anything automatically. It is input for a triage proposal that a person then reads.
Where automatic response is going
Section titled “Where automatic response is going”Automatic response is an accepted goal, not a shipped feature. The plan is explicit about its gates: an isolated test of the target firewall pair, a calibration period, a live canary against an address the operator owns, and automatic mode staying off until the policy gates pass. See the roadmap.
Even then, the rules already written down hold: a model never blocks on its own, containment goes through the deterministic layer with a score threshold and an approval, and a lapsed entitlement may never leave an existing block hanging — the expiry mechanism is independent of the licence.