Real-Time / Operational Vigilance continuously provides visibility into the actual Operation of an AI System and identifies Signals requiring attention from individual Events and Behaviors. Importantly, Observe / Monitor, Detect, and Evaluate must not be treated as the same process. Observing what is happening, detecting a noteworthy indication, and evaluating its meaning are distinct Governance Functions.

The role of Observe / Monitor is to maintain Visibility into AI Operation. In Case-level Monitoring, Content, Context, Decision / Model Behavior, Execution / System Actions, and Outcome / User Impact are observed in relation to each individual Event. Rather than examining only the Output, each Case captures the circumstances in which a Decision was formed, what was executed, and what Outcome followed.

This Case-level Observation is particularly important for Cases classified as Grey and referred to Human Review. Grey does not mean that a Case has already been determined to be Prohibited. Precisely because the judgment remains unresolved, Visibility into subsequent Behavior and Outcomes must be maintained. Vigilance does not replace the Decision. Instead, it provides the Operational Visibility required for Governance to make that Decision.

The next function, Detect, identifies Signals requiring attention from observed events. Behavioral Indicators include Deviation, Anomaly, and Unexpected Behavior. Risk / Policy Indicators include Known Risk Signals, Policy-related Signals, and Threshold Exceedance. Operational Indicators include Failed / Abnormal Execution, Unexpected Outcomes, and User-impact Signals.

However, Detection ≠ Evaluation. Detecting an Anomaly does not by itself establish whether it is harmful, acceptable, or a Policy Violation. Detect identifies observable indications such as behavior that differs from normal conditions, matches a known Signal, or exceeds a Threshold. It does not determine their Governance meaning.

Evaluate assesses the detected Signal against established Evaluation Criteria, including its Relevance, Severity, Impact, and relationship to Policy. The result is then connected to the appropriate Response.

Real-Time / Operational Vigilance is therefore not a simple sequence of “monitor → respond.” By maintaining the functional separation Observe / Monitor ≠ Detect ≠ Evaluate, it avoids conflating observed facts, detected Signals, and their Governance meaning, while connecting them to Response through Evidence. This separation provides a foundation for Real-time Operational Safety without granting excessive decision-making authority to the Vigilance function.