Method

Accountability in detection workflows

Most monitoring systems terminate at detection. The interval between a change polygon and a closed case is where the operational value lies, and it is primarily an organisational problem rather than a remote-sensing one.

6 min read

Change detection has stopped being the hard part. Open optical data at ten-metre resolution arrives every few days. Sub-metre commercial imagery is a procurement decision rather than a research programme. If your problem is can this change be seen, that problem is solved and has been for a while.

The problem that is not solved is what happens next.

The gap

A detection is a polygon with a date. To become useful it has to acquire four things it does not have: a person responsible for it, a visit, a finding, and an ending. Systems that produce detections and stop have handed the organisation a longer to-do list and called it intelligence.

The symptom is familiar to anyone who has run one. Alert volume rises. Response does not. After a few months the dashboard remains open on a second monitor and is no longer consulted, because looking at it does not produce an outcome.

Routing is the whole trick

An alert sent to a shared inbox belongs to nobody. An alert routed by jurisdiction — to the beat, the range, the division, the section whose boundary contains it — belongs to a named person, and named people close things.

This sounds administrative because it is. It is also the single design decision that determines whether a monitoring programme survives its first year. Every organisation that is accountable for ground already has a boundary map and a person per boundary. Detections should arrive inside that structure rather than beside it.

Routed by beat and range, so the alert arrives with a name on it rather than in a shared inbox.

Evidence, not a tick box

The second failure is a closure workflow that accepts a single tap. If "resolved" costs nothing to record, the field data is worthless within a quarter — not because anyone is dishonest, but because a tick box under time pressure collects taps rather than findings.

What closes a case should be evidence: geo-tagged photographs, structured remarks, position and time stamped by the device rather than typed. Then a closure is reconstructable, which means it is defensible, which means it is worth collecting.

  • Open — detected, routed, waiting for a visit.
  • Verified — someone went, and the evidence says what they found.
  • Closed — closed by review of that evidence, not by ageing out.

Why nothing ages out

Auto-closing stale alerts is the most tempting feature in this category and the most corrosive. It makes the numbers look good and destroys the only thing the record was for. A backlog that is visible is a resourcing conversation. A backlog that closes itself is a fiction.

Detection is a component of the system rather than the system itself. The output is a closed case with its supporting evidence retained.