Telecom · Agentic Assurance & Forensics
Reconstruct what changed across a telecom AI scenario.
HAIEC binds telecom logs, telemetry, API transactions, policy evidence, topology, source analysis, and other qualified evidence to explicit scenario states — then shows what changed, what remained established, and where the evidence stops. AL0 / AL1 / AL2 are scenario states, not HAIEC Assurance levels.
From baseline to compromise — without inferring the story
AL0 · Baseline
The declared functioning state used as the comparison basis.
AL1 · Degraded
A declared degraded state. HAIEC compares its persisted evidence with the preceding state and reports only qualified changes.
AL2 · Compromised
A declared compromised state. HAIEC does not treat the label itself as evidence of attacker intent, root cause, or a successful exploit.
State order comes from the scenario definition or caller declaration — never timestamp inference. Operators do not need to supply HAIEC's internal scenario fields: an MCP-enabled agent translates “first evidence”, “next evidence”, or the event's declared AL state into the explicit scenario binding — HAIEC does not infer AL state from logs.
What HAIEC reconstructs
Multi-source correlation
Join supported evidence using exact action, trace, request, transaction, workflow, or other qualified identifiers. Timestamp proximity alone never establishes a relationship.
Authority change
Compare Requested, Policy Authorized, Effectively Granted, Code Capable, and Observed evidence across states.
Consequence change
Show evidence-backed changes in state and material consequences without converting missing evidence into a claim.
Forensic timeline
Reconstruct an ordered evidence view for each declared state and the transitions between them.
Evidence frontier
Show exactly where the available evidence stops and what additional evidence could resolve the open question.
Telecom detection pillars
RAN & tower forensics
Handover and cell-level evidence reconstructed into a path: which cell, how many were touched, and what capability the action required — from declared relation evidence, never inferred.
Slice isolation
Cross-slice traffic is evaluated against declared isolation policy. Cross-slice flow is evidence of a path — not automatically an isolation breach.
Service-based interface analysis
SBI call records, registration events, and SCP routes evaluated against declared communication patterns — deregistration anomalies and schema mismatches surfaced as findings.
rApp / xApp security
Application lifecycle, supply-chain, excessive-capability, and A1-policy detection families for non-RT and near-RT applications — with O-RAN WG11 threat IDs where the mapping exists.
Telecom entity model
Evidence binds to typed domain entities — 17 of them, from cell sites to slice subnets to SBI transactions. Full reference: /developers/entities.
Telecom detection families
Domain-specific families alongside the general AI-risk catalog — every rule carries real framework IDs where the mapping exists (O-RAN WG11 threat IDs, 3GPP specs, NIST AI RMF). Where no official mapping exists, none is claimed.
TOWERTower access-path integrityRAPP_SCrApp supply chainRAPP_EXrApp excessive capabilityRAPP_LMrApp lifecycle mismatchRAPP_A1A1 policy integritySBIService-based interfaceSLICESlice isolation
See the AL0 → AL1 → AL2 forensic example
Explore an evidence-bound telecom scenario showing declared states, qualified divergence, authority context, consequence evidence, and explicit proof boundaries.
Open the forensic sample