In-depth analysis · About 4 min read
Orca explains how a smaller schema context improved Discovery AI queries
The October 13 case study combines deterministic matching, retrieved examples and validation; its 900-plus “models” are cloud resource schemas, not language models.
- Source published
- Published here
- Source checked
Orca Security and AWS describe Discovery AI, a natural language interface that converts security questions into Orca’s structured Sonar filters. The system has operated in production since March 2026, according to the October 13 case study. Its lesson is how to select and validate context instead of putting an entire schema in every prompt.
Listen to the news
Read this article aloud or keep listening to the news.
Preparing the reader…
Device voice
Speech is handled by your browser or device. AISubHub does not send the text to an audio API. Voice availability and playback with a locked screen vary by device.
Resuming may repeat a short phrase.
At a glance
- Sonar covers more than 900 cloud resource and application models and 18 operators; those models are schema types, not 900 foundation models.
- Against its initial baseline, Orca reports 93% fewer input tokens, 90% lower overall query cost and 75% lower end-to-end latency for comparable workloads.
The hard part is a domain-specific query contract
Sonar queries are structured JSON with exact resource names, relationships and a choice of 18 operators. Orca’s early prototype supplied more than 900 schema definitions and examples to one large model. The article says that approach established usefulness but consumed about two million input tokens and roughly 60 seconds per workload, while complex relationships still needed refinement. These cloud “models” represent resources such as instances and storage buckets. Interpreting the count as a catalog of language models would misstate both the challenge and what the system provides.
Use rules and examples before generating a filter
The nine-stage pipeline first adds organization and connected-cloud context. A deterministic matcher can directly handle recognized identifiers without LLM inference, and guardrails reject unsupported or off-topic requests. Titan embeddings retrieve 20 candidate examples; Cohere Rerank 3.5 selects five. A high-confidence known filter may be reused, otherwise the system selects only relevant schemas for generation. Claude Haiku 4.5 handles selection and generation; Nova 2 Lite handles guardrail and validator work. That allocation is specific to the described implementation, not a requirement to buy separate consumer subscriptions.
Validation and expert corrections remain in the loop
A tool-assisted generator works from selected schemas and reranked examples, then passes static and Sonar API checks. Invalid fields, operators or relationships are returned as concrete errors for correction. Retries are bounded: an unresolved failure returns an invalid-filter response rather than being accepted as success. The team evaluates changes against curated questions and reference queries, including slices for different complexity levels. Domain experts also label weak examples and correct outputs through an internal tool. This is ongoing quality work, not a claim that adding retrieval makes errors disappear.
Keep the original baseline attached to the savings
Orca reports reducing input tokens from approximately two million to 140,000 per comparable workload, a 93% reduction. Overall query cost fell 90%, while end-to-end latency fell from about 60 to 15 seconds, or 75%. These are different measures and should not be substituted for one another. The production system handles thousands of queries daily, with quality assessed through the team’s evaluation process and customer feedback. The architectural takeaway is to test relevance, schema size and model allocation together; the reported gains are not a forecast of the savings another organization will achieve.
Why it matters
For teams building domain-specific query assistants, the useful pattern is a small set of relevant examples and schema definitions backed by validation. It can preserve the existing query system as the execution contract rather than treating plausible prose as a valid query.
Limits and availability
Results are reported by the participating companies, not reproduced by AISubHub. They compare Orca’s redesigned pipeline with its earlier prototype, not all Bedrock models or all security tasks. The article provides neither a personal subscription entitlement nor a general cloud-security accuracy guarantee.
Sources and evidence
Source published: Oct 13, 2026 · Source checked: Oct 20, 2026
AI-assisted editorial articles checked against linked primary sources. Vendor claims are attributed; inclusion is not endorsement.