6s. An enforcement notice from our model provider

Every customer's requests reach Anthropic under our one organisation, so a notice about one person's use of the assistant is a notice about the platform. This is how to answer one within the hour. It is also how to stop somebody before anybody else notices: the same screens serve both.

What the platform already does. Every model call carries metadata.user_id: dvu_ and 32 hex characters, an HMAC of the person and the account under a key derived from the Worker's federation signing key (attribution.ts in @divvent/ai, aiAccess in @divvent/api). It names nobody to anyone who does not hold that key. platform_ai_end_user maps every id back to a person and an account. The platform's own calls carry dvp_warm, dvp_bench, dvp_system or dvp_cli and are nobody's. Requests the gate declines (ai.refusal) and turns the model's own classifier declines (ai.declined) are counted per person over a rolling window. Past the threshold (3 in 24 hours unless changed on AI safety), that person's assistant is paused automatically, the owners are emailed, and the pause appears on Needs you.

When the notice arrives

1. Find the id. The notice quotes the user_id we sent: dvu_…. If it quotes only a time window or a request id, write back and ask for the user_id. The notice may also name a category (for example CBRN or cyber) and dates; write them down.
2. Resolve it. In the console, open AI safety, paste the id into Who is this id?, and press Find the person. You get the member's address, the company, when the id was first and last seen, whether their assistant is already paused, and their recent AI activity on that account as audit references (ai.gate, ai.refusal, ai.declined, ai.proposal, with times and conversation ids). The look-up is itself audited (ai.resolve). "No model call was ever attributed to it" means the id is not ours. Say so in the reply.
3. Suspend. On the same screen, give a reason that names the notice (for example "Anthropic Safeguards notice 2026-10-01, CBRN") and press Pause the assistant for <them>. It takes effect on their next request, with no deploy. Where the account itself looks complicit, or several people on it are involved, use Pause it for everybody on <company> instead. Where the whole platform is at risk, use Pause the assistant for every account at the top of the page: the kill switch. Every pause is audited (ai.suspend), and the account's owners are emailed and rung on their bell, except for the kill switch, which is an outage and is said on the status page. The paused person sees "The assistant is paused for you"; the rest of Divvent keeps working for them.
4. Review the audit. Follow Their audit log on this account from the look-up. The references say what happened and when, never what was asked. Most notices can be answered from the references alone. What was asked is where it always was: an ai.* row's subject is the request (or the sitting) it belongs to, and a request's thread is on Requests in the console. Today any operator can read a thread without support access (changeThread). Open one only when the reply needs it, and say in the incident record that you did. Whether that read should move behind break-glass is a question for Ant, in PROGRESS.md.
5. Reply. Answer from the address the notice came from, within the hour. Say that the user is identified, that their access to the assistant was suspended at <time> (from the ai.suspend row), and what was found. Include only what the notice asks for and our terms allow (Terms §6: we may share the identifier and what we know about how the assistant was used). Never send the person's name or address unless Ant has decided to.
6. Record the incident. Add a line to the private incident log with the date, the notice's reference, the id, the company, the pause's id, what was replied and by whom. If the person is to stay off, Keep it, reviewed (ai.review) on their pause so it leaves Needs you while staying in force. If it was a mistake, Lift the pause with the reason; the owners are told it is back.

The ways out, and who clears them

Owners cannot lift a pause the Divvent team or detection made; the email they get says to reply to it, and that reply reaches us.

Thresholds

AI safety → When the assistant pauses itself sets the number of declined requests from one person that pauses them, the number across a company that puts it on Needs you, and the window, each with a reason (ai.thresholds). Detection is never off: the smallest threshold is one.

Walked

The walk of this runbook on staging is recorded in PROGRESS.md, with the commit it was walked on.