From Falco alerts to a reviewed rule change Diagram

Practical inputs

Use full, uniquely named rules in their actual load order.
Add a target profile and container mode to require Falco engine validation.
Compatible captures + explicit expectations enable real replay.
AI assesses groups first, then selects evidence and fields for a proposal.

Approval means export

There is no default acceptance; rejection does not change source files.
Static preview can be exported, but has no runtime detection proof.
Inspect exception breadth: current checks do not enforce every authorization field.

Deployment stays yours

Accepted files replace the reviewed full rules; do not load duplicate originals.
Keep external dependencies in their required load order.
Roll out through your existing review and Helm/GitOps controls.