Recognises a monitoring rule with no threshold or response
An event watched with no trigger or no action.
Can AI do this?
Not settled yet The benchmark tested this, but the models' answers do not settle yet whether they master it. 0 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 66% | Not shown |
| gemini-3.5-flash-lite | Low cost | 66% | Not shown |
| gpt-6-luna | Low cost | 64% | Not shown |
| claude-haiku-5-5 | Low cost | 69% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The rule and its threshold and responder
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: MR-002 "bulk reads of customer data", threshold: null, response: null Acceptable: > 10 000 rows in an hour -> SOC ticket within 1 hour
Also known as: Monitoring rule with no threshold or response
Related knobits
Builds on
All 16 knobits of Monitor and audit access.
Source: Review checklist 05-monitoring-audit, row 6 (27002 8.16; DORA)