Skip to main content

Exemption Engine

Lets you tell CrabShield about specific, known-safe behavior so it stops flagging it.

What It Does​

Every guard in CrabShield is tuned to catch threats without getting in the way of normal use — but sometimes something you do routinely and intentionally still looks unusual to a guard. The Exemption Engine is how you tell CrabShield "this specific thing is fine" for a particular skill, scheduled job, or channel, without having to turn a guard off entirely.

Think of it like a security guard at a building who's been told "the delivery van from this company comes every Tuesday at 9am, it's expected" — rather than propping the door open for everyone.

Why It Matters​

Without exemptions, the only way to stop a false positive from recurring would be to loosen a guard's settings for everyone and everything — trading away real protection to quiet one specific, legitimate case. Exemptions let you keep guards strict everywhere else while making room for the things you already know are safe.

Creating an Exemption​

Exemptions are scoped to one of:

  • A specific skill — this automation or capability is exempted, others aren't
  • A specific scheduled job — this recurring job is exempted, one-off runs aren't
  • A specific channel — messages from this connected channel are exempted, others aren't
Scenario

A nightly reporting job regularly triggers a large number of file-read calls that Anomaly Detection would otherwise flag as unusual. Rather than raising the anomaly threshold for every agent, the business creates an exemption scoped to that specific scheduled job — so its known, expected behavior stops generating alerts, while anomaly detection stays fully sensitive everywhere else.