Making it usable
AI validation that learns
A model reads the finding and the code around it the way a reviewer would, lowers the grade where the code says it should, and the scanner remembers why, so the same question is never paid for twice.
The question a scanner cannot ask
A rule sees that a value reaches HTML. It does not see that the method it passes through returns only sanitized output, or that the vulnerable half of a package is a client nothing constructs. That is the reading somebody does before fixing a finding or arguing an exception, and Validate with AI asks it of a language model: the finding, the flagged line, the code around it, the advisory, and the decisions already made on findings nearby. The answer is a rating, how sure it is and why, what an attacker would need, and what to check, kept on the finding with the model's name on it.
One finding, or five hundred
Tick findings on the list, or select everything matching the filters, and validate them in the background. Findings about the same thing go one after another, so the first answer usually settles the rest. A progress page says how many went to the model, how many were answered without it, how many were graded lower and how many tokens were spent.
A lower reading lowers the grade
When the model reads a finding as lower than its grade, the grade goes down, and the finding says it was AI and what it was before. It never raises one. It never lowers a credential, because nothing a model reads in code shows a secret is dead, and never a package on the known exploited list. A bulk run does not even send those. A person's own regrade always has the last word.
It learns, so you stop paying
Every answer also says which other findings deserve the same grade for the same reason, and that becomes a learned rule: a fixed match on the rule, the files and the flagged call, or on a package and its advisories, with a synthetic test beside it. The finding it came from must match the rule, and anything a model later refused to lower must not. From then on the rule answers instead of the model, in the next bulk run and on every scan, at no cost. One answer about a sanitizing helper settled all seven bindings that used it.
It corrects itself
A model asked again that disagrees with a rule retires it, keeps the finding it got wrong as a case the rule must never match again, and puts back every grade the rule gave. Running the synthetic tests checks every live rule and retires any that fail. A rule stays in the repository it was learned in until somebody applies it everywhere, because a wrong rule that hides findings across an estate is the worst thing this feature could do.
Decided once, for as long as the code is the same
A grade decision, a person's or a model's, records the code it was made against. A rescan of the same code keeps it, so nobody validates the same line twice. When the flagged lines change, the decision is lifted, the finding goes back to the engine's grade, and its page says who decided what and that the code changed underneath it.
Your model, your call
Claude, anything that speaks the OpenAI chat API including a model you host yourself, or an internal gateway described the way curl would call it. It is off until an administrator picks one, sending code is a separate box, and a credential's lines are never sent whatever the box says.
What it does not do
A model can be wrong, and it can be misled by something written in the code it reads, which is why it may only lower, never on a credential or a known exploited package, and never over a person. Turning it on sends findings, and with the box ticked the code around them, to the provider you pick, so the code no longer stays only on your network unless that provider is one you run. Every question is paid for, which is what the learned rules are for. A learned rule is only as good as the answer it came from: it is narrow by design, it carries its test, and it can be retired in one click.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.