One Alert System, Not Two

When we designed alerting, the obvious approach was two systems. A health monitoring pipeline with medical thresholds, and a fraud detection pipeline with behavioral scoring. Different data sources, different logic, different ways of failing. On a whiteboard it is the clean way to divide the work.

We did not build that. Every signal, whether it is a vitals reading, a mobility change, an unusual call pattern or an out of character transaction, goes through one sorting process and comes out as Critical, Warning or Informational.

The inputs differ by signal type. The output does not.

The reason is the reader

The person getting the alert is a family member, at home, probably in the evening, quite possibly doing three other things. They are not an analyst and have no interest in becoming one.

Two systems means two severity scales. It means learning that "high priority" from the health side and "elevated risk" from the fraud side are not the same urgency, and remembering which one justifies calling Mom right now. That is a demand on someone's attention at exactly the moment they can least spare it.

One scale means Critical always means the same thing: stop what you are doing. Whether it started as a heart rate anomaly or a flagged wire transfer is a detail for the body of the alert, not a separate thing to keep track of.

Trust follows from that consistency. An alert system families learn to second guess is worse than none, because when people mute it they do not carefully silence one category. They silence the app.

Patterns across both areas only show up in a shared feed

The stronger argument is that separate systems cannot see the thing we most want to catch.

A Warning level financial signal on its own is a maybe. A Warning level cognitive or mobility signal on its own is a maybe. Both in the same fortnight is a meaningfully different situation.

Two independent pipelines each see one half, each reasonably conclude that it is not alarming, and neither is built in a way that lets it notice the pair. You cannot recover that later by putting two feeds side by side on a screen, because each system has already run its escalation logic and already decided.

Shared sorting is not a simplification we accepted for convenience. It is the only place that particular pattern can show up at all.

What this costs

Being honest about the trade: one pipeline is harder to tune. Thresholds specific to one area have to be expressed as weights in a common scoring model instead of living in a system fitted to them, and adding a new signal source means working out how it scores next to unrelated sources. A dedicated medical pipeline would almost certainly be more precise on medical signals alone.

We think it is the right trade anyway. Precision on one axis matters less than an alert a family actually acts on, and acting requires that Critical mean one unambiguous thing, and that a pattern spanning both areas be able to surface at all.