Context

OpenAEV inject results are often ambiguous (e.g., MAYBE_PREVENTED), so SOC teams and CISOs can’t confidently interpret outcomes or take action. This is a user-facing product issue (not just internal).

Use case

Customers run scenarios at scale; the final inject status hides whether the issue is a real security prevention, an agent problem, a misconfiguration, or a technical failure.

Current Workaround

Users manually inspect per-asset/per-agent details and cross-check EDR/SIEM logs; teams also rely on extra documentation to explain statuses.

Proposed Solution

Make inject statuses actionable by:

• Preserving granular trace-level statuses in the final inject status.
• Separating “execution status” from “prevention/expectations status”.