Design engineering case study

Harrier

An adjudication console for analysts at managed detection and response providers. One analyst carries 40 or more client tenants. An AI agent named Clerk assembles the case and files a draft verdict. The human rules on it.

The move

The analyst never works raw alerts. Clerk correlates signals into a case, runs the first pass and shows its evidence. What the analyst spends time on is the decision, not the assembly.

Autonomy is a setting per client tenant, not a threshold across the product. Each client sits somewhere between “Clerk closes nothing on its own” and “Clerk closes benign cases and shows me a sample,” and the level moves only when measured accuracy on that tenant earns it. The same signal is a Tuesday at one client and an incident at another.

At a glance

Domain
Security operations, managed detection and response
Operator
Tier-2 SOC analyst, 6+ hours a day in the tool
Platform
Desktop-first responsive web, from 1280
AI agent
Clerk: assembles, drafts, never decides
Dimension
Calibrated trust in an automated agent

Stages