Documentation

const response = await fetch(
  'https://reglint.ai/api/monitor/scan',
  {
    method: 'POST',
    headers: {
      'x-api-key': 'YOUR_API_KEY',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      agent_output: "Your agent's response here",
      agent_name: "my-agent",
      industry: "healthcare",
      mode: "fast"
    })
  }
);
const result = await response.json();
if (!result.safe_to_deliver) {
  return "Request blocked due to compliance violation.";
}
return result.redacted_output || result.original_output;

{
  "scan_id": "uuid",
  "final_decision": "BLOCK | REDACT | ALERT | PASS",
  "safe_to_deliver": false,
  "violations_count": 1,
  "violations": [
    {
      "violation_id": "SSN_EXPOSURE",
      "law": "HIPAA § 164.514",
      "description": "SSN detected in agent output",
      "violating_text": "123-45-6789",
      "action": "BLOCK",
      "severity": "critical",
      "fine_range": "up to $50,000 per violation"
    }
  ],
  "original_output": "Your SSN is 123-45-6789...",
  "redacted_output": "Your SSN is [REDACTED: SSN_EXPOSURE]...",
  "processing_time_ms": 340
}

{
  "agent_output": "...",
  "agent_name":   "MedicalAdvisorBot",
  "industry":     "healthcare",
  "mode":         "full"
}

// Fast — rules engine only, milliseconds
body: JSON.stringify({ agent_output: agentResponse, mode: "fast" })

// Full — RAG + Claude deep analysis (default)
body: JSON.stringify({ agent_output: agentResponse, mode: "full" })

// AUTO — Reglint decides per rule (recommended)
body: JSON.stringify({ agent_output: agentResponse, default_action: "AUTO" })

// BLOCK — suppress everything
body: JSON.stringify({ agent_output: agentResponse, default_action: "BLOCK" })

// REDACT — mask sensitive data only
body: JSON.stringify({ agent_output: agentResponse, default_action: "REDACT" })

// ALERT — deliver + notify compliance team
body: JSON.stringify({ agent_output: agentResponse, default_action: "ALERT" })

{
  "SSN_EXPOSURE":          "BLOCK",
  "EMAIL_EXPOSURE":        "REDACT",
  "MEDICAL_DATA_EXPOSURE": "ALERT",
  "PHONE_EXPOSURE":        "IGNORE"
}

// A single compliance rule object
const rule = {
  pattern:      "\\b(?!000|666|9\\d{2})\\d{3}-(?!00)\\d{2}-(?!0000)\\d{4}\\b",
  violation_id: "SSN_EXPOSURE",
  law:          "HIPAA § 164.514 / CCPA",
  description:  "Social Security Number detected in agent output",
  action:       "BLOCK",    // "BLOCK" | "REDACT" | "ALERT"
  severity:     "critical", // "critical" | "high" | "medium"
};

// Full WebhookPayload shape (TypeScript)
interface LambdaViolation {
  violation_id?:   string;  // e.g. "SSN_EXPOSURE"
  type?:           string;  // legacy alias for violation_id
  law?:            string;  // e.g. "HIPAA § 164.514"
  description?:    string;
  violating_text?: string;  // the exact matched substring
  action?:         string;  // BLOCK | REDACT | ALERT
  severity?:       string;  // critical | high | medium
}

interface WebhookPayload {
  scan_id:             string;          // unique scan UUID (idempotency key)
  customer_id:         string;          // your Reglint user ID
  agent_name:          string;          // human-readable agent label
  industry?:           string;          // e.g. "healthcare", "finance"
  final_decision:      string;          // "BLOCK" | "REDACT" | "ALERT" | "PASS"
  violations_count:    number;
  violations:          LambdaViolation[];
  original_output?:    string;          // raw agent text before redaction
  redacted_output?:    string;          // text with PII replaced by [REDACTED]
  agent_endpoint?:     string;          // URL of the calling agent (optional)
  processing_time_ms?: number;          // scan duration
}

// JavaScript — send a scan result to Reglint
const payload = {
  scan_id:          crypto.randomUUID(),
  customer_id:      "usr_YOUR_REGLINT_USER_ID",
  agent_name:       "MedicalAdvisorBot",
  industry:         "healthcare",
  final_decision:   "BLOCK",
  violations_count: 1,
  violations: [
    {
      violation_id:   "SSN_EXPOSURE",
      law:            "HIPAA § 164.514",
      description:    "SSN detected in agent response",
      violating_text: "123-45-6789",
      action:         "BLOCK",
      severity:       "critical",
    },
  ],
  original_output:    "Your SSN is 123-45-6789, here is your summary…",
  redacted_output:    "Your SSN is [REDACTED], here is your summary…",
  processing_time_ms: 42,
};

const res = await fetch(
  "https://reglint.ai/api/agent-monitor/webhook",
  {
    method:  "POST",
    headers: {
      "Content-Type":    "application/json",
      "x-reglint-secret": process.env.REGLINT_WEBHOOK_SECRET,
    },
    body: JSON.stringify(payload),
  }
);

const data = await res.json();
// { received: true, id: "agv_..." }
console.log(data);

# Python — send a scan result to Reglint
import os
import uuid
import requests

payload = {
    "scan_id":          str(uuid.uuid4()),
    "customer_id":      "usr_YOUR_REGLINT_USER_ID",
    "agent_name":       "MedicalAdvisorBot",
    "industry":         "healthcare",
    "final_decision":   "BLOCK",
    "violations_count": 1,
    "violations": [
        {
            "violation_id":   "SSN_EXPOSURE",
            "law":            "HIPAA § 164.514",
            "description":    "SSN detected in agent response",
            "violating_text": "123-45-6789",
            "action":         "BLOCK",
            "severity":       "critical",
        }
    ],
    "original_output":    "Your SSN is 123-45-6789, here is your summary…",
    "redacted_output":    "Your SSN is [REDACTED], here is your summary…",
    "processing_time_ms": 42,
}

response = requests.post(
    "https://reglint.ai/api/agent-monitor/webhook",
    json=payload,
    headers={
        "x-reglint-secret": os.environ["REGLINT_WEBHOOK_SECRET"],
    },
    timeout=10,
)

data = response.json()
# {'received': True, 'id': 'agv_...'}
print(data)

const REGLINT_ENDPOINT =
  'https://reglint.ai/api/monitor/scan';

async function runAgentWithReglint(userMessage, agentName, industry) {
  const agentResponse = await myAIAgent.run(userMessage);

  const result = await fetch(REGLINT_ENDPOINT, {
    method: 'POST',
    headers: {
      'x-api-key': process.env.REGLINT_API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      agent_output: agentResponse,
      agent_name: agentName,
      industry: industry,
      mode: 'full',
      default_action: 'AUTO'
    })
  }).then(r => r.json());

  switch (result.final_decision) {
    case 'BLOCK':
      return {
        delivered: false,
        message: "Unable to process this request due to compliance restrictions.",
        violations: result.violations
      };
    case 'REDACT':
      return {
        delivered: true,
        message: result.redacted_output,
        violations: result.violations
      };
    case 'ALERT':
      return {
        delivered: true,
        message: agentResponse,
        violations: result.violations
      };
    case 'PASS':
    default:
      return {
        delivered: true,
        message: agentResponse,
        violations: []
      };
  }
}

import OpenAI from 'openai';

const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
const REGLINT_ENDPOINT = 'https://reglint.ai/api/monitor/scan';

async function runCompliantAgent(userMessage: string): Promise<{
  delivered: boolean;
  message: string;
  violations: unknown[];
}> {
  // 1. Get GPT-4o response
  const completion = await openai.chat.completions.create({
    model: 'gpt-4o',
    messages: [
      { role: 'system', content: 'You are a helpful assistant.' },
      { role: 'user',   content: userMessage },
    ],
  });
  const rawOutput = completion.choices[0].message.content ?? '';

  // 2. Scan with Reglint
  const scan = await fetch(REGLINT_ENDPOINT, {
    method: 'POST',
    headers: {
      'x-api-key': process.env.REGLINT_API_KEY,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      agent_output: rawOutput,
      agent_name:   'gpt4o-assistant',
      industry:     'general',
      mode:         'full',
    }),
  }).then(r => r.json());

  // 3. Enforce decision
  switch (scan.final_decision) {
    case 'BLOCK':
      return { delivered: false, message: 'Response blocked due to compliance violation.', violations: scan.violations };
    case 'REDACT':
      return { delivered: true, message: scan.redacted_output ?? rawOutput, violations: scan.violations };
    default:
      return { delivered: true, message: rawOutput, violations: scan.violations ?? [] };
  }
}

const result = await runCompliantAgent('Summarize the customer account.');
console.log(result.delivered ? result.message : '⛔ Blocked');

import os
import requests
import anthropic

claude = anthropic.Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])
REGLINT_API_KEY  = os.environ["REGLINT_API_KEY"]
REGLINT_ENDPOINT = "https://reglint.ai/api/monitor/scan"


def run_compliant_claude(user_message: str, industry: str = "general") -> dict:
    """Run a Claude agent and scan its output with Reglint before returning."""

    # 1. Call Claude
    message = claude.messages.create(
        model="claude-opus-4-7",
        max_tokens=1024,
        messages=[{"role": "user", "content": user_message}],
    )
    raw_output = message.content[0].text

    # 2. Scan with Reglint
    scan = requests.post(
        REGLINT_ENDPOINT,
        json={
            "agent_output":   raw_output,
            "agent_name":     "claude-opus-4-agent",
            "industry":       industry,
            "mode":           "full",
            "default_action": "AUTO",
        },
        headers={"x-api-key": REGLINT_API_KEY},
        timeout=15,
    ).json()

    decision = scan.get("final_decision", "PASS")

    if decision == "BLOCK":
        return {
            "delivered": False,
            "message":   "Blocked — compliance violation detected.",
            "violations": scan.get("violations", []),
        }
    elif decision == "REDACT":
        return {
            "delivered": True,
            "message":   scan.get("redacted_output", raw_output),
            "violations": scan.get("violations", []),
        }
    else:  # ALERT or PASS
        return {
            "delivered": True,
            "message":   raw_output,
            "violations": scan.get("violations", []),
        }


if __name__ == "__main__":
    result = run_compliant_claude("Show me the patient's latest test results.", industry="healthcare")
    if result["delivered"]:
        print("Agent:", result["message"])
    else:
        print("Blocked:", result["message"])
        for v in result["violations"]:
            print(f"  • {v.get('violation_id')} — {v.get('law')}")

import os
import requests

# Ollama runs locally at http://localhost:11434 by default
OLLAMA_ENDPOINT  = "http://localhost:11434/api/generate"
REGLINT_API_KEY  = os.environ["REGLINT_API_KEY"]
REGLINT_ENDPOINT = "https://reglint.ai/api/monitor/scan"


def run_compliant_llama(prompt: str, model: str = "llama3.2") -> dict:
    """Run a local Llama model via Ollama and scan its output with Reglint."""

    # 1. Call Ollama / local Llama
    ollama_res = requests.post(
        OLLAMA_ENDPOINT,
        json={"model": model, "prompt": prompt, "stream": False},
        timeout=60,
    ).json()
    raw_output = ollama_res.get("response", "")

    # 2. Scan with Reglint — use "fast" mode for low latency in local dev
    scan = requests.post(
        REGLINT_ENDPOINT,
        json={
            "agent_output": raw_output,
            "agent_name":   f"ollama-{model}",
            "industry":     "privacy",
            "mode":         "fast",
        },
        headers={"x-api-key": REGLINT_API_KEY},
        timeout=15,
    ).json()

    decision = scan.get("final_decision", "PASS")
    latency  = scan.get("processing_time_ms")
    print(f"[Reglint] decision={decision}, violations={scan.get('violations_count', 0)}, latency={latency}ms")

    if decision == "BLOCK":
        return {"delivered": False, "message": "Response blocked.",                      "violations": scan.get("violations", [])}
    elif decision == "REDACT":
        return {"delivered": True,  "message": scan.get("redacted_output", raw_output),  "violations": scan.get("violations", [])}
    else:
        return {"delivered": True,  "message": raw_output,                               "violations": []}


if __name__ == "__main__":
    result = run_compliant_llama("Tell me about this user's medical history.")
    if result["delivered"]:
        print("Output:", result["message"])
    else:
        print("Blocked — not delivered to user.")

# The simplest possible integration — any language, any shell
curl -X POST https://reglint.ai/api/monitor/scan \
  -H "x-api-key: $REGLINT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_output":   "'"$AGENT_OUTPUT"'",
    "agent_name":     "my-agent",
    "industry":       "healthcare",
    "mode":           "fast"
  }' | jq '.final_decision'

// Without email_alerts — uses account default alert email (Settings → Notifications)
const response = await fetch('https://reglint.ai/api/monitor/scan', {
  method: 'POST',
  headers: {
    'x-api-key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    agent_output: agentResponse,
    agent_name:   'my-bot',
    industry:     'healthcare',
    mode:         'full',
  }),
});

// With email_alerts — custom routing to compliance team
const response = await fetch('https://reglint.ai/api/monitor/scan', {
  method: 'POST',
  headers: {
    'x-api-key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    agent_output: agentResponse,
    agent_name:   'healthcare-bot',
    industry:     'healthcare',
    mode:         'full',
    email_alerts: [
      {
        alert_on:     ['BLOCK', 'REDACT'],
        severity_min: 'high',
        receivers:    ['compliance@yourcompany.com'],
      },
    ],
  }),
});

// TypeScript — email_alerts schema
email_alerts?: Array<{
  enabled?:      boolean;                           // default: true — set false to skip
  alert_on?:     ('BLOCK' | 'REDACT' | 'ALERT')[]; // default: all three
  severity_min?: 'low' | 'medium' | 'high' | 'critical'; // default: 'low'
  receivers:     string[];  // required: one or more email addresses
}>

body: JSON.stringify({
  agent_output: agentResponse,
  agent_name:   'customer-service-prod',
  industry:     'general',
  email_alerts: [
    {
      // Critical incidents → CISO immediately
      alert_on:     ['BLOCK'],
      severity_min: 'critical',
      receivers:    ['ciso@company.com'],
    },
    {
      // All violations → Compliance team
      alert_on:     ['BLOCK', 'REDACT', 'ALERT'],
      severity_min: 'low',
      receivers:    ['compliance@company.com'],
    },
    {
      // High-severity → Security team
      alert_on:     ['BLOCK', 'REDACT'],
      severity_min: 'high',
      receivers:    ['security@company.com'],
    },
  ],
})

// Development — critical only, dev team
const devAlerts = [{
  alert_on:     ['BLOCK'],
  severity_min: 'critical',
  receivers:    ['dev-team@company.com'],
}];

// Staging — high severity, QA team
const stagingAlerts = [{
  alert_on:     ['BLOCK', 'REDACT'],
  severity_min: 'high',
  receivers:    ['qa-team@company.com'],
}];

// Production — all violations, multiple teams
const prodAlerts = [{
  alert_on:     ['BLOCK', 'REDACT', 'ALERT'],
  severity_min: 'low',
  receivers:    ['compliance@company.com', 'security@company.com', 'oncall@company.com'],
}];

const email_alerts = process.env.NODE_ENV === 'production' ? prodAlerts
                   : process.env.NODE_ENV === 'staging'    ? stagingAlerts
                   : devAlerts;

// Override specific rules for this scan only — no DynamoDB update needed
body: JSON.stringify({
  agent_output: agentResponse,
  agent_name:   'medical-chatbot',
  industry:     'healthcare',
  mode:         'full',
  rules_config: {
    SSN_EXPOSURE:          'REDACT',   // downgrade from BLOCK for this scan
    MEDICAL_DATA_EXPOSURE: 'ALERT',    // downgrade from BLOCK for demo purposes
    LOCATION_TRACKING:     'ALERT',    // keep at default (no change needed if same)
  }
})

// Priority order (highest wins):
// 1. per-request rules_config  ← this request's body
// 2. default_action            ← blanket override, if set
// 3. DynamoDB customer config  ← stored per-customer overrides
// 4. Reglint built-in default  ← each rule's default_action field

// Example: rule SSN_EXPOSURE has built-in default = BLOCK
// DynamoDB config says SSN_EXPOSURE = REDACT
// This request says rules_config.SSN_EXPOSURE = ALERT
// → Final action = ALERT  (per-request wins)

{
  "rules_config": {
    "ar": { "default_action": "alert_hitl" },   // all Arabic rules → hold for review
    "ar.sa": { "default_action": "block" },      // …but Saudi national-ID → block
    "AR_MEDICAL_DATA": "REDACT"                   // …and this one rule → redact
  }
}

// HR compliance agent — tone down employment discrimination alerts for training mode
body: JSON.stringify({
  agent_output:   agentResponse,
  agent_name:     'hr-training-bot',
  industry:       'hr',
  mode:           'full',
  rules_config: {
    // During training/testing, downgrade BLOCK to ALERT so responses aren't suppressed
    DISCRIMINATORY_CONTENT:           'ALERT',
    RACIAL_LANGUAGE:                  'ALERT',
    AGE_DISCRIMINATION:               'ALERT',
    PREGNANCY_DISCRIMINATION_CONTEXT: 'ALERT',
    RELIGIOUS_DISCRIMINATION_CONTEXT: 'ALERT',
    MENTAL_HEALTH_DISCRIMINATION:     'ALERT',
    VETERAN_STATUS_DISCRIMINATION:    'ALERT',
    FAMILIAL_STATUS_DISCRIMINATION:   'ALERT',
    AGE_DISCRIMINATION_LANGUAGE:      'ALERT',
  }
})

const reglintConfig = {
  api_key: "rgl_...",
  endpoint: "https://reglint.ai/api/monitor/scan",
  industry: "finance",
  mode: "full",

  // true  → AI can share PII with verified user (fraud/sanctions still caught)
  // false → all violations active (safe default for public deployments)
  trusted_users_access: true,
};

{
  "final_decision": "PASS",
  "trusted_users_access": true,
  "violations": [],
  "metadata": {
    "v3_dismissed_count": 3,
    "scan_mode": "full"
  }
}

{
  "custom_policies_enabled": true,
  "custom_policies": [
    {
      "id": "CP-001",
      "rule": "Never state prices or discounts before manager approval.",
      "action": "BLOCK",
      "applies_to": "both",
      "channels": null,
      "enabled": true
    },
    {
      "id": "CP-002",
      "rule": "Do not name any competitor in agent output.",
      "action": "ALERT",
      "applies_to": "agent",
      "channels": ["slack", "gmail"],
      "enabled": true
    }
  ]
}

[Trigger]
   │
[HTTP Request: POST /api/monitor/scan]   body: { agent_output, agent_name, mode: "full" }
   │                                       header: x-api-key: YOUR_API_KEY
[IF  {{ $json.final_decision === 'ALERT_HITL' }}]
   ├─ false ─▶ [Deliver action]           (PASS / ALERT / REDACT handled as usual)
   └─ true  ─▶ [Set: scan_id = {{ $json.scan_id }}]
                  │
              ┌─▶ [Wait  20s]
              │      │
              │  [HTTP Request: GET /api/agent-monitor/disposition-status?scan_id={{ $json.scan_id }}]
              │      │                       header: x-api-key: YOUR_API_KEY
              │  [Switch on {{ $json.hitl_status }}]
              │      ├─ pending  ─┘ (loop back to Wait; cap at e.g. 45 iterations ≈ 15 min)
              │      ├─ approved ─▶ [Deliver action]
              │      ├─ rejected ─▶ [Stop / notify]
              │      └─ edited   ─▶ [Deliver {{ $json.edited_content }} — the reviewer's edit is final]

const BASE = 'https://reglint.ai';

// 1) Scan. A held item comes back ALERT_HITL / safe_to_deliver:false / scan_id.
async function scan(agentOutput) {
  const r = await fetch(BASE + '/api/monitor/scan', {
    method: 'POST',
    headers: { 'x-api-key': process.env.REGLINT_API_KEY, 'Content-Type': 'application/json' },
    body: JSON.stringify({ agent_output: agentOutput, agent_name: 'my-agent', mode: 'full' }),
  });
  return r.json();
}

// 2) Poll disposition-status with backoff + a hard timeout. Returns the terminal status.
async function waitForDecision(scanId, { intervalMs = 15000, timeoutMs = 15 * 60 * 1000 } = {}) {
  const deadline = Date.now() + timeoutMs;
  while (Date.now() < deadline) {
    const r = await fetch(
      BASE + '/api/agent-monitor/disposition-status?scan_id=' + encodeURIComponent(scanId),
      { headers: { 'x-api-key': process.env.REGLINT_API_KEY } },
    );
    if (r.status === 429) { await sleep(intervalMs * 2); continue; }   // backoff on rate limit
    if (r.status === 404) { await sleep(intervalMs); continue; }        // row not landed yet
    if (!r.ok) throw new Error('status ' + r.status);                   // 400/401 = fix your call
    const data = await r.json();  // { scan_id, hitl_status, final_decision, edited_content? }
    if (data.hitl_status !== 'pending' && data.hitl_status !== 'none') return data;
    await sleep(intervalMs);
  }
  return 'timeout';
}

const sleep = (ms) => new Promise((res) => setTimeout(res, ms));

// 3) Act — Reglint signals, YOUR code executes.
const result = await scan(agentOutput);
if (result.final_decision !== 'ALERT_HITL') {
  deliver(result);                       // PASS / ALERT / REDACT — your normal path
} else {
  const outcome = await waitForDecision(result.scan_id);
  if (outcome.hitl_status === 'approved')      deliver({ ...result, original_output: agentOutput });
  else if (outcome.hitl_status === 'rejected') discard(result.scan_id);
  else if (outcome.hitl_status === 'edited')   deliver({ ...result, original_output: outcome.edited_content }); // reviewer's edit is final
  else /* timeout */                           escalateToOps(result.scan_id, outcome);
}

{
  "ddsource": "reglint",
  "service": "reglint-monitor",
  "ddtags": "env:prod,customer:usr_123,event:scan_completed,decision:alert,channel:gmail",
  "message": "reglint scan_completed ALERT",
  "event_type": "scan_completed",
  "event_id": "3f8c1a4e-…",
  "occurred_at": "2026-07-03T14:22:05.001Z",
  "customer_id": "usr_123",
  "scan_id": "scan_abc",
  "agent_name": "support-bot",
  "final_decision": "ALERT",
  "violations_count": 1,
  "violations": [
    { "violation_id": "SSN_EXPOSURE", "law": "GLBA", "type": "pii", "severity": "high" }
  ]
}

import crypto from 'crypto';
import express from 'express';

const app = express();
// Use the RAW body — the signature is over the exact bytes we sent.
app.post('/reglint', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.REGLINT_SIGNING_SECRET;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret)
    .update(req.body)          // Buffer of the raw request body
    .digest('hex');
  const got = req.get('X-Reglint-Signature') || '';

  const a = Buffer.from(got);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();   // reject forgeries
  }

  const event = JSON.parse(req.body.toString('utf8'));
  // …forward to your SIEM…
  res.status(200).end();            // 2xx = acknowledged
});

{
  "event_type": "scan_completed",
  "scan_id": "scan_abc",
  "agent_name": "support-bot",
  "industry": "legal",
  "channel": "gmail",                 // null for agent (API) traffic
  "actor_type": "human",              // "human" | "agent"
  "actor_id": "employee@corp.com",
  "final_decision": "ALERT",          // PASS | ALERT | REDACT | BLOCK | ALERT_HITL
  "violations_count": 1,
  "violations": [
    { "violation_id": "SSN_EXPOSURE", "law": "GLBA", "type": "pii",
      "severity": "high", "description": "…" }
  ],
  "processing_time_ms": 812
}

{
  "event_type": "hitl_decision",
  "scan_id": "scan_abc",
  "agent_name": "support-bot",
  "decision": "edited",               // approved | rejected | edited
  "reviewer_id": "usr_123",
  "edited": true,
  "delivery_mode": "auto",            // "auto" | "consent" | null (only on edited)
  "has_note": true
}

{
  "event_type": "disposition_reported",
  "scan_id": "scan_abc",
  "agent_name": "support-bot",
  "final_decision": "ALERT",
  "disposition": "sent_edited"
  // blocked_by_user | sent_redacted | sent_original_override
  // | sent_on_approval | sent_edited | edit_applied
}