Who counted the work that disappeared?
By Karina Carlos
A fictional story about security operations and automated alert closure. All people, organizations, systems and events are invented.
Vera had already moved Jo’s name on the staffing sheet when Samir put a printout beside her keyboard.
It contained twelve case numbers. None had appeared in the security team’s morning queue.
“Are these incidents?” she asked.
“I don’t know yet.”
At Bellrow Logistics, Vera ran security operations for a network of warehouses. Six weeks earlier, the team had allowed its AI triage system to close a defined group of low-risk alerts automatically. The overnight queue had shrunk. Analysts were getting to difficult cases sooner. Jo had finally taken a full lunch break.
That morning’s dashboard showed normal service and no overdue investigations. Vera had proposed moving Jo to a long-delayed exercise with the warehouse teams for two afternoons a week. Samir would cover the desk.
He placed a finger on one of the numbers.
“A warehouse supervisor asked about this after their maintenance visit. I found it in the closure history. Then I looked for other closures from the same source.”
“And?”
“Ten have enough information for me to check the explanation. These two don’t.”
The summary described expected maintenance activity. The record available to Samir did not show which maintenance schedule had supported that conclusion. A data feed had changed the previous week. He couldn’t tell whether the system had used the updated schedule, an older one or something else.
Vera opened the first case. The conclusion was there, written in the calm language the team had come to recognize. She read it twice, then went looking for the supporting record.
“Could the activity still be routine?”
“Yes.”
“Could this just be a logging problem?”
“Yes. But I can’t verify the closure from what I have.”
Jo arrived carrying the exercise plan. Three warehouse supervisors had rearranged their shifts to attend. The last session had been cancelled because security was too busy.
“Are we cancelling again?” she asked.
Vera turned the staffing sheet toward her. “I thought we had the time back.”
“We have some time back,” Jo said. “I’ve been using it.”
Samir pushed the printout closer. “Then we need to count this work too.”
For a moment, Vera wished he had brought her a confirmed mistake. A bad closure would have been easier to explain at the operations meeting. Instead, she had two records she could not reconstruct and a staffing proposal based on work that looked finished.
She asked how he had selected the twelve cases. All came from the source named by the supervisor. They told her where to investigate. They could not tell her how often this happened across everything the system closed.
“I can review twelve,” Samir said. “I can’t quietly become the second queue.”
They called Ellis, the engineer responsible for the triage integration. Ellis could investigate the missing link to the schedule, but needed the warehouse team to establish which version had actually been in use. Repeating the model’s summary would not answer that question.
Vera asked what would happen if another closure from that source arrived while they investigated. Under the team’s existing change procedure, she could authorize routing that group to an analyst temporarily. Ellis warned that it would add work. Nobody could yet estimate how much.
“Keep the other groups as they are,” Vera said. “Route this one for review and preserve what we need to trace these two. We’ll reassess when we can see what happened.”
The staffing sheet still required a decision.
Vera took it to the operations manager with the exercise plan and Samir’s twelve numbers. She asked for a protected review block and temporary desk cover. The manager could provide cover for one afternoon, not two. They kept one training session. Jo made the call about the other herself.
Later, Ellis recovered the relevant schedule for the first case. Samir found that its closure was supported. The second still lacked enough evidence. He recorded it as unresolved.
“One routine case,” Jo said, reading the update. “That’s good.”
It was. Vera was relieved, and a little embarrassed by how much she had wanted a clearer answer in either direction.
The dashboard remained green. The missing training afternoon stayed visible on the staffing sheet. Before leaving, Vera entered the hours Samir and Ellis had spent beside the time automation had saved. The second case was still open on Samir’s screen.
What the staffing sheet could not show
Vera’s decision began with a claim about available time. Examining the closed work changed what that claim could support. The unresolved case did not establish a threat or condemn the whole system. It exposed work that needed evidence, an owner and actual capacity. Human Authority enters here through the organization’s ability to examine a consequential judgment, including one made before an analyst sees a case.
Continue with the analysis: What disappears from human review when AI clears the queue?
Examine a real process
If a similar question is live in your organization, I invite you to examine one real process with me: what leaves human attention, who can reconstruct that decision, and where the time to do so comes from. Begin with a non-confidential description, without names, client details or security-sensitive material.
Comments