Credential Disablement
Waiting carries security risk. Acting carries operational risk. A single confidence score cannot resolve that tradeoff.
The situation
An agent detects behavior suggesting an employee's credentials may be compromised and recommends disabling the identity immediately. But that identity belongs to an administrator supporting critical infrastructure.
How AnantVerify evaluates it
AnantVerify combines current identity state, threat evidence, privilege level, business dependencies and enterprise response policy.
If evidence agrees and policy explicitly authorizes automated containment, the action may proceed. If the threat evidence is strong but operational policy requires human approval for privileged identities, the verdict becomes ESCALATE. The uncertainty is not hidden — it becomes part of the workflow.
Waiting carries security risk. Acting carries operational risk. This is exactly where a single confidence score is insufficient.