RFC-015: Unified Observability Protocol (UOP) — 5. Alerting Rules

AIGP Specification › RFC-015: Unified Observability Protocol (UOP) › 5. Alerting Rules

← 4. Dashboard Specification · Section index · 6. Request Tracing →

5. Alerting Rules

Alerts are evaluated by governance-server against incoming signals and stored aggregates. No external alerting infrastructure required.

5.1 Alert Schema

{
  "PK": "APP#identity-service",
  "SK": "ALERT#2026-05-04T10:05:00Z#alt-001",
  "entity_type": "UOP_ALERT",
  "alert_id": "alt-001",
  "alert_type": "BUDGET_THRESHOLD",
  "severity": "WARNING",
  "app_id": "identity-service",
  "timestamp": "2026-05-04T10:05:00Z",
  "message": "Daily budget consumption at 80% for identity-service",
  "context": {
    "threshold": 0.80,
    "current": 0.82,
    "budget_type": "daily"
  },
  "acknowledged": false
}

5.2 Built-In Alert Rules

Alert Type	Trigger	Severity	Evaluation
`BUDGET_THRESHOLD_WARNING`	Daily budget 80% consumed	WARNING	Every 5m
`BUDGET_THRESHOLD_CRITICAL`	Daily budget 95% consumed	CRITICAL	Every 5m
`MONTHLY_BUDGET_WARNING`	Monthly budget 70% consumed	WARNING	Every 1h
`HEARTBEAT_FAILURE`	No heartbeat from app in 2 interval	CRITICAL	Every 60s
`AIGP_DENY_SPIKE`	DENY rate > 20% of requests in 1h window	WARNING	Every 5m
`AIGP_DENY_FLOOD`	DENY rate > 50% of requests in 15m window	CRITICAL	Every 1m
`SCHEMA_VALIDATION_FAILURE`	Any ACP_SCHEMA_FAIL signal	WARNING	On signal
`SCHEMA_VALIDATION_BURST`	5 schema failures in 10m from same provider	CRITICAL	Every 1m
`HIGH_LATENCY`	p95 latency > 10s for any model in 1h window	WARNING	Every 5m
`ARTIFACT_FAILURE`	ALP_FAIL signal received	WARNING	On signal
`ERROR_RATE_SPIKE`	Error rate > 10% in 1h window for any app	WARNING	Every 5m

5.3 Alert Lifecycle

TRIGGERED  ACTIVE  ACKNOWLEDGED  RESOLVED

TRIGGERED condition met, alert created
ACTIVE alert persists (condition still true on next evaluation)
ACKNOWLEDGED operator marked as seen via governance-server UI
RESOLVED condition no longer true, auto-resolved

5.4 Alert Delivery

Alerts are surfaced in the governance-server UI dashboard. Future extensions MAY add:

SNS topic notifications
Slack webhook integration
Email digest (daily summary)

These are delivery mechanisms only alert evaluation always runs in governance-server.

← 4. Dashboard Specification · Section index · 6. Request Tracing →