Three detection layers that disagree usefully and why they combine by max, not sum

Features get you a vector per window. Turning that into a decision is where the design choices are. This system scores every window three independent ways and takes the strongest single case. Each layer covers a failure mode of the others. Layer 1: guardrails Deterministic thresholds, no baseline of any kind: // Honeytoken hit — highest-confidence signal. Immediate revoke. if ( fv . honeytoken_hits > 0 ) add ( 100 , ' honeytoken_hits ' , ' … ' ); // High miss ratio — guessing IDs that mostly do not exist. if ( fv . miss_ratio >= 0.4 && fv . req_count >= 10 ) add ( 88 , ' miss_ratio ' , ' … ' ); // Sequential walk — near-adjacent IDs in order. if ( fv . id_sequentiality >= 0.8 && fv . distinct_resource_ids >= 10 ) add ( 90 , ' id_sequentiality ' , ' … ' ); // Working set that expands and never stops — the mimicry signature. if ( fv . window_size === ' 1m ' && fv . novelty_run_length >= 20 ) add ( 86 , ' novelty_run_length ' , ' … ' ); Being baseline-free is the point: they fire on a client's first window. A statistical layer needs history to say anything, so a brand-new compromised integration, one that never had a quiet period to learn from, is invisible to it. Guardrails cover exactly that gap. The deliberate omission is cardinality. There is no "distinct IDs > N" guardrail in the scorer, for the reasons in part 3 : it false-positives on legitimate bulk reads and no threshold fixes that. (The gateway's fast path does have a cardinality rule, at 150 distinct/minute — well above any realistic backfill, and it exists to stop a flood before the first window closes.) Layer 2: robust statistics Per client, per feature, per window size: keep a bounded history and score new values with a median/MAD robust z-score . Median and MAD rather than mean and standard deviation, because mean and σ are themselves distorted by the outliers you're hunting. One 5,000-request window drags a mean enough to make the next one look normal. Three things make this work in practice, and each w