AI Investigations Are a Distributed System Problem
summary
System pins scans pin to a stable commit then runs hundreds of deterministic rules to produce a reproducible hit list, builds a plan, and dispatches bounded concurrent workers that use Versa Workflows and Versa Sandboxes with Open Code to control tool access, timeouts, and context. Evidence from thousands of files is verified with a second-model judging step (OpenAI vs Claude), persisted in Postgres and XState, and then grouped into actionable issues rather than 6,000 raw hits using deterministic matches. The pipeline runs and recovers failed work.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:40Privacy compliance and AI investigations
- 1:14Compliance as code
- 2:08What an AI investigator does
- 2:57Context, execution, and verification
- 4:08Pinning the source and finding deterministic matches
- 5:01Planning the investigation
- 5:17Deterministic control and AI judgment
- 6:18Dispatching concurrent investigations
- 7:39Data deletion request example
- 8:30Controlled tools, permissions, and timeouts
- 9:22Managing the context window
- 9:57Connecting evidence across files
- 11:01Testing and debugging distributed investigations
- 11:44Persisting state and handling retries
- 12:28Verifying results with a second model
- 12:58Grouping and prioritizing findings
- 14:19Whole-codebase scanning beyond pull request review
- 15:09Closing
related talks
16mAI Agents for Incident Investigation: The Good, The Bad, and The Ugly
17mFighting AI with AI
26mBecoming AI engineers
31mAI for Web3 Security
28mAI for Everything After Code
40mApplying Artificial Intelligence to the Incident Response Function
51mAI for the People
23mBeyond Tests What to Verify in AI Generated Code