# Evidence & alerting

Read what your guardrails actually did — the observation surface, the labeled adjudication surface, and the one field to page on.

Source: https://tokentriage.com/docs/guardrails/evidence-and-alerting

---
`GET /tt/api/v1/guardrails/evidence` and the dashboard distinguish execution coverage from detector findings. Empty `lineages` means no retained findings. Inspection requires explicit versioned execution receipts.

## Coverage comes first

The coverage census distinguishes inspected, partial, not-inspected and legacy-unknown rows, together with applicable execution states. Historical rows without the new receipt remain unknown; they cannot be backfilled as clean or inspected from the absence of fires.

A read failure, unavailable provider or corrupt source returns an explicit unavailable response. It must not render as an empty green report. Capabilities explain unsupported operations and the effective runtime generation.

## Findings are observations

Lineages group observed findings by detector and version. Fire counts, confidence basis and action/effect counts do not establish precision or recall. Adjudicated labels carry their own denominator and uncertainty. Missing labels cannot be replaced by traffic volume.

Read the execution state, selected action, transformation and delivery together. A proposed redaction in monitor mode changes no bytes. A committed transformation later withheld from the client is not delivered output. Invocation rows separately record clean external calls and failures that produced no findings.

## Alerting on `suspended[]`

Alert on incomplete or failed execution receipts and `suspended[]`. Reasons include detector timeouts, unavailable external calls, exhausted work limits, invalid spans, uninspectable bodies and lost stream windows. `scan_exhausted` is an explicit coverage failure. The configured [failure posture](/docs/guardrails/phases-and-streaming) determines whether traffic was allowed or unreleased bytes were withheld.

Ordinary receipts and diagnostics contain bounded metadata rather than subject text, snippets, provider error bodies or raw destination/model strings. Authorized raw-content reads have a separate access and audit boundary. An evidence panel is not a way to retrieve those bodies.