> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Generalize from observation

> Convert observed query patterns into declarative intentions.

Inviolet's `Generalize` workflow examines the patterns in your decision feed
and suggests intentions that would cover them. Use this when you've been
running at Level 1 (Observe) for 2+ weeks and want to graduate to Level 2
(Test) without writing rules by hand.

## When to generalize

* You have 500+ tool calls in the decision feed
* You can identify 3–5 distinct workflows by reading the feed (e.g.,
  "support lookups," "fraud investigations," "pipeline reviews")
* You want to move to identity-aware shadow-mode enforcement

## The flow

1. App dashboard → **Decision feed**
2. Filter to the cluster of similar calls — by user, by tool name, by
   columns touched
3. Click **Generalize** on any single representative call
4. The Generalize modal shows:
   * **Suggested intention name** (LLM-generated from the patterns)
   * **Suggested elements** (the union of columns this cluster touched)
   * **Suggested TTL** (P95 of the cluster's request durations)
5. Edit any field, then click **Create as shadow rule**

## Auto-promote

By default, shadow rules created via Generalize get an `auto_promote_at`
timestamp 14 days in the future. If they pass the shadow-period checks
(no false-positive denials, no missing-element errors), they auto-promote
to live enforcement on that date.

You can override by clicking **Edit** on the rule → **Promotion** → set
to manual.

## Read next

* **[Define your first intention](/guides/define-your-first-intention)** — the
  manual creation path
* **[The maturity model](/concepts/maturity-model)** — the five levels:
  Observe → Test → Enforce → Isolate → Surround