Acceptance criteria
Show which detection or policy triggered and highlight the content that caused it, both in the employee's coaching message and in the analyst's alert, so the employee can fix the prompt and the analyst can confirm the decision without opening another tool.
Why it matters
Explaining the trigger lets the employee fix the prompt and the analyst confirm the decision, which cuts tickets on both sides.
How to verify
The coaching message and the alert both show the detection that fired and highlight the content.
OWASP adoption context
Employees and analysts meet these decisions in every listed context, so explanations should appear wherever the intervention does.
Framework mappings
Naming the trigger and the content behind it gives analysts what they need to evaluate an event and gives employees specific, in-context awareness of the policy. Explanations must not expose more sensitive content than the viewer is entitled to see.
Showing why a detection fired explains the control's output to the people it affects and documents how the decision was reached. It explains the decision, not the internal workings of the detection model.