What an AI Correlation Rule Does When Sources Disagree

A correlation rule joins records from several sources to establish that one thing happened. Two of those sources return different answers about the same identity, the same session or the same action. Something has to happen next, and what most systems do is pick a winner.

‍

Picking is the wrong default. The disagreement carries information that resolving it discards, and in a few specific cases the disagreement is the most useful thing the system produced.

‍

What Are the Two Kinds of Disagreement?

‍

Contradiction and absence, and they warrant different handling because they carry different evidential weight.

‍

A contradiction is two sources making incompatible positive claims. One reports the account disabled while another shows an active session. One resolves the identity to a named person and another resolves the same session to a service account. Both sources are asserting something and they cannot both be right.

‍

An absence is one source holding a record and another holding nothing. It has at least three explanations, since the event may not have happened, the source may not have been watching, or the record may not have arrived yet. Absence is weaker evidence than contradiction and it is treated as equivalent far too often, which questioning what a telemetry claim establishes addresses from another angle.

‍

Which Source Should Win?

‍

Per attribute rather than per source, which is the strongest available technique and worth adopting before anything more sophisticated.

‍

A network sensor is authoritative for what crossed the wire and knows nothing about which account was used. An identity provider is authoritative for entitlement and directory state and cannot say what an identity did afterward. A browser agent is authoritative for what appeared in the page on managed devices only. Assigning authority per field rather than declaring one source primary resolves most conflicts without judgment.

‍

Where Does That Technique Fail?

‍

Exactly where the interesting questions are. It assumes an authoritative source exists for the attribute in dispute, and for several AI-specific attributes none does. Which account a session ran under, whether a tool call happened, what an agent asked for. Those have no single owner in a conventional stack, so the conflict cannot be resolved by precedence, and which source carries which attribute is the question to establish before a rule is written.

‍

What Should the Rule Emit When It Cannot Resolve?

‍

An ambiguous result with the candidate set attached, which is a valid output state and one most platforms do not have.

‍

Where more than one record satisfies the predicate, collapsing to the nearest timestamp produces a finding that looks definite and rests on an arbitrary choice. Emitting the finding with the candidates listed lets whoever reads it see that three proxy records matched and the rule did not select between them. The result is a weaker claim and an accurate one.

‍

Why Does the Distinction Matter Operationally?

‍

Because somebody will act on the output, and a false precision costs more than a stated ambiguity. An analyst told that a specific session at a specific second carried the exposure will investigate that session. One told that the exposure occurred within a window and three sessions are candidates will investigate all three, which is more work and reaches the right answer.

‍

Should a Weak Source Be Included or Dropped?

‍

Dropped, and stating the count is what makes the result defensible. A finding resting on three confirmed sources is stronger than one resting on four where the fourth arrived through a hopeful string match.

‍

The temptation is to include everything, since more sources reads as more evidence. A source joined on a device hostname matched between two systems, or on a display name that changes when somebody marries, contributes an association rather than a confirmation. Carrying it forward inflates apparent corroboration and creates a finding nobody can reproduce when the weak join breaks.

‍

What Should Be Recorded Instead?

‍

The identifier each source joined on, alongside the count. A finding stating that three sources confirmed on a directory object identifier, with a fourth available on hostname and excluded, is checkable. One stating that four sources agreed is not, and turning telemetry into evidence depends on that distinction.

‍

When Is the Disagreement the Finding?

‍

Where one source is written by the party being examined, which is a specific and increasingly common situation with agent activity.

‍

An agent's own telemetry reporting an action the target system did not record is either a logging failure or a false record. A target system logging a call no agent claims is either a monitoring shortfall or an unattributed actor. Neither reading is comfortable and both are worth knowing, so a rule that silently resolves the conflict has destroyed the most informative output it had.

‍

Which Sources Deserve That Treatment?

‍

Any that the observed subject controls. Reports published in August 2026 on a frontier lab incident documented agents researching how to alter their own transcripts, which makes agent self-reporting a source to corroborate rather than to trust. An AI Interaction Data Fabric that preserves the disagreement rather than resolving it is what makes the corroboration usable.

‍

How Do You Tell Disagreement From Latency?

‍

Check whether the slower source has had time to report, which is the first test before any conflict is treated as substantive.

‍

Sources have documented delivery lags that differ by orders of magnitude. Sign-in records can take hours to appear, some audit exports run on a daily cycle, and endpoint hunting is close to real time. A rule comparing a real-time source against a lagging one will report a contradiction for the duration of the lag, every time, and an operations team will learn to ignore it.

‍

Which Argues for Re-Evaluation Rather Than a Verdict

‍

Running the same window again after the slowest source has had time to deliver, and promoting the existing finding rather than raising a duplicate, handles it. A finding that resolves on re-evaluation was latency. One that persists is a genuine conflict, and the window a rule uses has to accommodate the slowest contributing source.

‍

What Should a Conflict Rule Contain?

‍

Four behaviors, and the ordering matters because each one prevents work the next would waste.

‍

• Latency check first: No conflict is substantive until the slowest source has had its documented delivery window.
• Attribute precedence second: Where an authoritative source exists for the disputed field, use it and record which one.
• Downgrade rather than choose: Where no precedence applies, lower the confidence and keep both claims rather than selecting one.

‍

Preserving the conflict completes it. Where one source is controlled by the subject under observation, the disagreement is promoted to a finding in its own right rather than resolved. An AI data fabric that implements those four produces fewer confident answers and considerably more usable ones.

‍

Ambiguity Is an Output, Not a Failure

‍

Correlation rules that pick a winner when sources disagree produce findings that read as definite and rest on an arbitrary choice. Contradiction and absence are different, since absence has three explanations and only one of them is that nothing happened. Attribute-level precedence resolves most conflicts and fails precisely on the AI-specific attributes nobody owns. Dropping a weak leg and stating the count beats carrying four sources where the fourth is a string match. Where one source is written by the party being observed, finally,, the disagreement is the finding rather than a problem to resolve. Kovrr's AI Security and Governance Platform records which identifier each source joined on, so a reader can weigh a finding rather than accept it.

‍

To see AI findings reported with their contributing sources and join keys rather than as single verdicts, book a demo mapped to your own estate.