| Code | Severity | Examples |
|---|---|---|
| M0 | Allowed | Routine read-only operations, scoped tool use |
| M2 | Likely misuse | Overreach, scope expansion, indirect policy evasion |
| M3 | High-risk misuse | Safeguard bypass, data exfiltration intent, privilege escalation |
| M4 | Malicious | Privacy breach, backdoor implant, alignment circumvention, destructive action |
Reference
Severity codes
Adrian’s four severity levels and the kinds of behaviour each one captures.
Adrian’s classifier outputs an M-code per event. The code maps to a severity level.
What happens when a code is raised depends on the operating mode (Audit, Human Review, or Block) and the alerting thresholds you have configured. See How it works for the operating modes.