CRM · notes · relevance
Left is keyword search — MATCH(content, "legal") — the OpenSearch-shaped ceiling (Umbrella legal-hold noise). Right is meaning: MV_INTERSECTS(concepts, …) so counsel and lock-in language still ranks without those exact tokens.
9 hits
Call notes — Acme general counsel
Unstructured notes / S3 · notes
GC: we cannot accept perpetual commitments. Legal concerns around switching costs if we standardize on one collaboration stack. They used the phrase 'we are worried about being stuck' more than 'lock-in'.
QBR recording — Acme collaboration owners
Webex recording transcript · webex
Transcript excerpt: 'We like Webex quality but legal is nervous about being unable to unwind. Same conversation as the slide deck they sent — vendor lock-in fears, not product complaints.' Multimodal: deck screenshots + audio + notes should share one vector space.
Umbrella Corp — legal hold on email archive
Salesforce (via MuleSoft) · crm
This deal is about e-discovery legal hold, not collaboration lock-in. Keyword 'legal' matches loudly. Semantic ranking should demote it when the query is about vendor lock-in fears on a Webex renewal.
Acme Corp — Webex Calling + Control Hub renewal
Salesforce (via MuleSoft) · crm
Legal flagged exclusive multi-year terms. Counsel described vendor lock-in fears and asked for exit clauses. Similar to last year's Acme campus Wi-Fi refresh. Notes mention procurement wants price-hold and FedRAMP evidence.
Acme counsel slide — 'switching costs'
Presentation deck (image + text) · webex
Slide OCR: Switching costs · exclusive term · data escrow. Image of a lock icon. No occurrence of the words 'legal concerns' — only 'switching costs'. Jina v5 multimodal is why this matches a text query about legal concerns.
Globex — Meraki + ThousandEyes overlay
Salesforce (via MuleSoft) · crm
Network refresh for 140 branches. Buyer is infrastructure, not legal. Price sensitivity on AP density. No counsel involvement yet.
Initech — Webex for Government
Salesforce (via MuleSoft) · crm
FedRAMP High path. Security questionnaire references data residency US Gov East + West. Counsel wants audit trails on who searched what. Similar motion to Acme but security-led rather than commercial legal.
Acme invoice pack — Q2 professional services
S3 · lifecycle
Large unstructured payload (~10 MB equivalent in lab). Line items: Webex Calling migration, number porting, analog adapter replacements. Hidden in XML: 'counsel requested termination for convenience'. Keyword search on invoice ID misses this; semantic search surfaces legal language inside the payload.
Order orchestration log — ACME-4419
Elastic · lifecycle
Elastic log: MuleSoft flow order-create retried 3x. Downstream CCW reservation delayed. Not a legal document — ops signal that the deal is stuck in provisioning, not in counsel.
14 hits
Call notes — Acme general counsel
Unstructured notes / S3 · notes
GC: we cannot accept perpetual commitments. Legal concerns around switching costs if we standardize on one collaboration stack. They used the phrase 'we are worried about being stuck' more than 'lock-in'.
QBR recording — Acme collaboration owners
Webex recording transcript · webex
Transcript excerpt: 'We like Webex quality but legal is nervous about being unable to unwind. Same conversation as the slide deck they sent — vendor lock-in fears, not product complaints.' Multimodal: deck screenshots + audio + notes should share one vector space.
Acme counsel slide — 'switching costs'
Presentation deck (image + text) · webex
Slide OCR: Switching costs · exclusive term · data escrow. Image of a lock icon. No occurrence of the words 'legal concerns' — only 'switching costs'. Jina v5 multimodal is why this matches a text query about legal concerns.
Umbrella Corp — legal hold on email archive
Salesforce (via MuleSoft) · crm
This deal is about e-discovery legal hold, not collaboration lock-in. Keyword 'legal' matches loudly. Semantic ranking should demote it when the query is about vendor lock-in fears on a Webex renewal.
Acme Corp — Webex Calling + Control Hub renewal
Salesforce (via MuleSoft) · crm
Legal flagged exclusive multi-year terms. Counsel described vendor lock-in fears and asked for exit clauses. Similar to last year's Acme campus Wi-Fi refresh. Notes mention procurement wants price-hold and FedRAMP evidence.
Acme invoice pack — Q2 professional services
S3 · lifecycle
Large unstructured payload (~10 MB equivalent in lab). Line items: Webex Calling migration, number porting, analog adapter replacements. Hidden in XML: 'counsel requested termination for convenience'. Keyword search on invoice ID misses this; semantic search surfaces legal language inside the payload.
Globex — Meraki + ThousandEyes overlay
Salesforce (via MuleSoft) · crm
Network refresh for 140 branches. Buyer is infrastructure, not legal. Price sensitivity on AP density. No counsel involvement yet.
Initech — Webex for Government
Salesforce (via MuleSoft) · crm
FedRAMP High path. Security questionnaire references data residency US Gov East + West. Counsel wants audit trails on who searched what. Similar motion to Acme but security-led rather than commercial legal.
Acme — 6 month transaction rollup
Snowflake · lifecycle
Snowflake fact table: 14 Webex Calling seat expansions, 2 Control Hub add-ons, 1 professional services SOW. Payload pointers to 8.4 MB XML invoices in S3. Account id ACME-4419.
Order orchestration log — ACME-4419
Elastic · lifecycle
Elastic log: MuleSoft flow order-create retried 3x. Downstream CCW reservation delayed. Not a legal document — ops signal that the deal is stuck in provisioning, not in counsel.
CCR + local search — US Gov East / West
Internal runbook · infra
Cross-cluster replication keeps Webex and CRM indices in both gov regions. Search locally with the same synonyms and ranking. Do not send queries across the US-Gov boundary at query time.
Policy deny — prompt injection on chat.completion
CIRCUIT LLM proxy (ECS) · circuit
ECS event.dataset=circuit.llm_proxy event.action=policy_deny. gen_ai.request.model=gpt-4o. Prompt attempted to override system instructions and exfiltrate prior conversation context. event.outcome=blocked. Similar denials cluster around jailbreak phrasing even when tokens differ.
Token budget spike — agent tool loop
CIRCUIT LLM proxy (ECS) · circuit
ECS llm proxy: sudden token budget burn on a multi-step agent. Same user.id, escalating tool calls, model route flipped to a larger private LLM. Ops wants similar incidents without grepping raw request IDs.
Sensitive data hit — PII in outbound prompt
CIRCUIT AI security (ECS) · circuit
Security control on the CIRCUIT path flagged possible PII exfiltration in an outbound prompt. threat.tactic.name roughly maps to exfiltration. event.outcome=failure. Need semantic neighbors: other leakage attempts, not every string that contains 'email'.