Signal in the Noise Operations
"Confirmation needed": why we ask before we act, and when we don't.
When Autopilot acts on its own, when we ask you first, and why a wrong containment counts as an incident too.
Look at any Convoy tenant's case list and you'll see the phrase "Confirmation needed" over and over. They are the two most important words on the platform, because they admit something: a lot of what looks like an attack is an admin doing their job at 2 a.m.
The rule is simple. When the evidence proves harm is underway, we act. A host talking to a known command server gets isolated by Autopilot in seconds; nobody waits for a reply. When the evidence proves something unusual but can't prove intent, we ask the one person who knows, and we ask with everything attached: who, from where, what they ran, what it touched. The customer answers in a sentence. The case closes with that sentence on it.
Why not just act every time? Because disabling the CFO's account during close, or isolating the server that runs payroll, is also an incident. One we would have caused. Precision isn't only about catching the attacker. It's about not becoming one.