How Policies Are Evaluated

Evaluation Order

When the AI produces detections for a screenshot, the system evaluates policies in this order:

1. Child-specific policy — If the child has a policy assigned directly, it’s used
2. Family default policy — If no child-specific policy exists, the family default is used
3. No policy — If neither exists, detections are logged as activities but no alerts are created

Only one policy is evaluated per screenshot — the first match in the hierarchy above.

Rule Matching

For each detection from the AI:

1. The detection’s category is matched against the policy’s rules
2. If a rule exists for that category and is enabled, it triggers
3. The rule’s action determines what happens:
   • immediate_alert → Creates an alert and sends an email immediately
   • digest → Creates an alert included in the daily digest
   • silent_log → No alert created (detection is still in the activity log)

Confidence Thresholds

The AI assigns a confidence score (0.0–1.0) to each detection. The system uses a two-tier approach:

This two-tier system (fast triage + thorough escalation) minimises both false positives and false negatives.

Alert Deduplication

To prevent alert fatigue, the system deduplicates alerts:

• Same category + child + device within 30 minutes → only one alert
• If an existing open/acknowledged alert matches, the new detection is skipped
• A unique dedup key is generated from child ID + device ID + category

This means a child browsing the same problematic site for 20 minutes generates one alert, not 40.