Skip to main content

​
Event schema

Alerts and Use Cases evaluate rules over metadata events stored in the NeuralTrust metadata store. TrustGuard and TrustGate each emit one metadata record per request over OpenTelemetry (OTLP); a collector ingests them into separate TrustGate and TrustGuard event streams.
No raw prompt or response text is in the metadata stream. Identifiers, verdicts, counters, and finding labels only. Raw bodies live in a separate store keyed by trace_id for drill-down in the UI.

​
Architecture

Correlation keys across streams: tenant_id, trace_id, session_id.

​
Entity and grouping

Entity is not a stored column. AlertEngine derives it from consumer_id — the v1 entity reference for “who” triggered the event. There is no ip column. Rules that previously grouped by IP now use session or consumer. Predefined nt-uc-111 (Unidentified Consumer Surge) groups by session, not IP.

​
Common fields (both products)

​
TrustGate-only fields

​
TrustGuard-only fields

​
Detection matching (TrustGuard)

Rules with a detection: block match over the raw detector_chain JSON array. AlertEngine normalizes each element at query time (not as a stored column).

​
Rule detection fields

​
Plugin → type mapping (nested chain)

When the flat detection_type field is empty, type is derived from source.plugin:

​
Finding guard

Elements that only record detector execution (no detection_type, action, or signal.type) do not count as findings — so clean requests where detectors ran but did not fire are excluded from detection matches.

​
Advanced rule fields not in the custom builder

The engine supports additional predicates for advanced YAML rules. These are not yet in the UI field picker:
  • Latency sub-fields: latency.policies_ms, latency.routing_ms, …
  • Cost sub-fields: cost.prompt_usd, cost.completion_usd, cost.currency
  • MCP: mcp.operation, mcp.transport, mcp.upstream_status, mcp.rpc_error_code
  • Policy chain fields (TrustGate)

​
Upstream requirements

For rules to match reliably, products must emit:

Use Cases

Custom rule builder and full UI field catalog.

TrustGate telemetry

How TrustGate emits per-request events.

TrustGuard overview

Guardrail detections that populate TrustGuard events.