Four-Tier Root-Cause Framework

• Four-Tier Root-Cause Framework is a structured decomposition principle that partitions RCA into layers such as observation, structure, inference, and explanation.
• It is applied in various domains including procedural pipelines, memory-centric architectures, taxonomic exploit analysis, and causal attribution hierarchies.
• The framework enhances tractability and interpretability by separating low-variance structural inference from high-variance interpretive reasoning in complex systems.

Searching arXiv for the cited papers to ground the article in current literature. arXiv search query: (Zhao et al., 2024) CHASE root cause analysis microservice causal heterogeneous graph arXiv search query: (Wang et al., 2023) CORAL online unsupervised root cause analysis arXiv search query: (Zhang et al., 6 Jan 2026) SpecRCA hypothesize then verify microservices root cause analysis arXiv search query: (Rezaei et al., 27 Jul 2025) four-tier root cause framework smart contract exploit chains arXiv search query: (Seedat, 18 Jun 2026) four-tier operational memory root cause derivation explanation OpsCortex arXiv search query: (Laurentino et al., 2 Sep 2025) probabilities of causation quasi-Markovian root cause analysis path ranking The expression Four-Tier Root-Cause Framework denotes a family of four-level decompositions for root-cause analysis rather than a single canonical formalism. In recent arXiv literature, the four-tier form is used to partition RCA into analytically distinct layers for online triggering and causal-graph updating, multimodal hypothesis drafting and verification, operational memory, exploit-root-cause taxonomy, and probabilities-of-causation ranking. The common rationale is to separate distinct burdens—observation, structure, causal inference, and diagnosis or explanation—so that RCA remains tractable under complex dependencies, multimodal evidence, latent confounding, or evolving system state (Wang et al., 2023, Zhang et al., 6 Jan 2026, Seedat, 18 Jun 2026, Rezaei et al., 27 Jul 2025, Laurentino et al., 2 Sep 2025).

1. Conceptual scope and major variants

The literature uses four-tier organization in several non-equivalent ways. Some frameworks are procedural, arranging RCA as a sequence of stages. Others are architectural, arranging persistent operational knowledge by lifetime and purpose. Others are taxonomic, arranging the root causes themselves from high-level design down to implementation defects. A further line of work supports a four-level reading of RCA as node-, edge-, path-, and system-level causal attribution (Wang et al., 2023, Zhang et al., 6 Jan 2026, Seedat, 18 Jun 2026, Rezaei et al., 27 Jul 2025, Laurentino et al., 2 Sep 2025).

Variant	Four tiers	Primary object
CORAL	Trigger Point Detection; Structural Causal Knowledge; State-Specific Causal Reasoning; Root Cause Ranking, Convergence, and Online Update Control	Online RCA pipeline
SpecRCA	Telemetry and context acquisition; Suspiciousness scoring and hypothesis drafting; Hypothesis verification with pathwise parallelism; Synthesis, ranking, and explanation	Hypothesize-then-verify microservice RCA
OpsCortex	Hot Working Memory; Live Dependency Graph; Snapshot History; Permanent Brain	Operational-memory architecture
Smart-contract SoK	Protocol logic design; Lifecycle and governance; External dependencies; Traditional implementation bugs	Exploit-root-cause taxonomy
Quasi-Markovian RCA	Local variable-level attribution; Edge/mechanism-level attribution; Path/narrative-level attribution; Systemic/structural attribution	Causal-attribution stack

This diversity is central to the term’s meaning. A four-tier root-cause framework is therefore best understood as a structured decomposition principle whose exact semantics depend on the domain and on what is being tiered: computation, memory, explanation, or causal depth.

2. Workflow-oriented four-tier frameworks in systems RCA

In workflow-oriented uses, the four tiers form an end-to-end RCA process. CORAL, an online unsupervised RCA framework for streaming multivariate time series, is explicitly organized as Trigger Point Detection, Incremental Disentangled Causal Graph Learning, Network Propagation-based Root Cause Localization, and Convergence-based Online Loop Control. Triggering is based on MSSA combined with CUSUM, with the change time estimated as

$$\hat{\tau} = \inf_{t > T_0} \{ t \mid y(t) \ge h \}.$$

After a trigger, batches from the new state incrementally update a DAG through state-invariant and state-dependent components, and a random walk with restarts is applied to the updated causal graph. The online RCA process terminates when the causal graph and the generated root cause list converge; in an AIOps case study, CORAL finds the correct root cause nine batches earlier (Wang et al., 2023).

SpecRCA instantiates a different procedural four-tiering for microservices. Its pipeline comprises telemetry and context acquisition, suspiciousness scoring and hypothesis drafting, hypothesis verification with pathwise parallelism, and diagnosis synthesis. The drafting stage fuses metrics, traces, logs, and service topology into a ranked hypothesis set, while the verifier evaluates each candidate through self, upstream, and downstream reasoning in parallel. On the AIOps 2022 dataset, the reported preliminary results are Recall@1 61.34, Recall@3 75.72, Recall@5 81.63, MRR 62.64, and Speed 9.89 s/query, compared with 52.79 s/query for RCAgent and 83.17 s/query for mABC (Zhang et al., 6 Jan 2026).

Adjacent microservice work shows how graph-centric components populate the middle tiers of such pipelines. "CHASE: A Causal Hypergraph based Framework for Root Cause Analysis in Multimodal Microservice Systems" encodes traces, logs, and system monitoring metrics into embeddings, models them by a multimodal invocation graph, performs anomaly detection on each instance node with attentive heterogeneous message passing from adjacent metric and log nodes, and then learns from a hypergraph whose hyperedges represent the flow of causality. This suggests how multimodal representation learning and causal-flow localization can serve as Tier-2 and Tier-3 mechanisms in workflow-oriented designs (Zhao et al., 2024).

Across these systems papers, the four-tier structure is used to separate when RCA is triggered, how system structure is represented, how causal influence is propagated, and how a diagnosis is finalized.

3. Memory-centric four-tier architectures and the separation of derivation from explanation

A distinct interpretation appears in OpsCortex, where the four tiers are not stages of a pipeline but layers of operational memory. The system is organized as Tier 1: Hot Working Memory (Redis), Tier 2: Live Dependency Graph (NetworkX), Tier 3: Snapshot History (Neo4j), and Tier 4: Permanent Brain (SQLite). Tier 1 stores current metric values, per-metric sliding windows, and an alert stream, with a TTL of roughly ~2 hours. Tier 2 maintains a three-level directed graph of services, categories, and metrics, updated every ~5 s. Tier 3 serializes the full Tier 2 graph every 60 seconds. Tier 4 persists baselines, confirmed call edges with confidence counts, a registry of structural noise, and incident history (Seedat, 18 Jun 2026).

OpsCortex couples this memory hierarchy to a two-stage RCA design that explicitly separates root-cause derivation from root-cause explanation. Derivation is deterministic and is computed from a learned dependency graph and the temporal ordering of threshold crossings:

$$\text{root} = \arg\min_{s \in \mathcal{R}(f)} t_{\text{amber}(s)}.$$

The LLM is then used only to explain, confirm, and recommend, using evidence that the system has already assembled. The architecture thereby treats operational memory as the substrate of RCA and constrains generative modeling to post hoc narrative and remediation. The prototype is validated on an instrumented e-commerce benchmark with eight injectable failure scenarios, while also noting that no formal quantitative metrics or comparison against MicroRCA or LLM-only systems are reported (Seedat, 18 Jun 2026).

This formulation changes the meaning of “tier.” The tiers are no longer successive computations but persistent representational strata with different lifetimes: the present, current connectivity, temporal history, and durable knowledge. A plausible implication is that four-tier RCA can function not only as a diagnostic workflow but also as a memory discipline for preserving the context that conventional monitoring stacks discard.

4. Causal formalization, probabilities of causation, and multi-level attribution

A more formal use of four-level organization arises from the paper on quasi-Markovian models, which introduces algorithmic simplifications for computing Probability of Necessity (PN), Probability of Sufficiency (PS), and Probability of Necessity and Sufficiency (PNS) under latent confounding. In the root-cause use cases, variables are binary, with

$$\mathrm{PN} = \Pr(Y_{X=0}=0 \mid X=1, Y=1), \qquad \mathrm{PNS} = \Pr(Y_{X=1}=1, Y_{X=0}=0).$$

The paper also introduces weaker interventional proxies, w-PN and w-PS, and works under quasi-Markovian assumptions: each endogenous variable has at most one exogenous parent, endogenous variables have finite support, exogenous variables are independent, and the graph is acyclic (Laurentino et al., 2 Sep 2025).

The computational contribution is to reduce the complexity of bounding these probabilities through counterfactual graphs and reduction theorems. Instead of using a full twin network, the method removes irrelevant ancestors and fixes identifiable marginals, so that the optimization degree is tied to the number of exogenous variables in the reduced graph. In one example, after reductions only two exogenous variables remain, and Gurobi computes

$$\mathrm{PN} \in [0.175, 0.245], \qquad \mathrm{PNS} \in [0.35, 0.49]$$

in less than 10 ms (Laurentino et al., 2 Sep 2025).

The same paper supports a four-tier reading of RCA as a hierarchy of attribution: local variable-level attribution, edge/mechanism-level attribution, path/narrative-level attribution, and systemic/structural attribution. At the path level, candidate explanations are ranked by a significance score

$$S(\pi) = w \cdot \mathrm{PC}(X_r, Y) + \sum_{X_j \in P\setminus\{Y, X_r\}} \mathrm{PC}(X_j, Y),$$

where $X_r$ is the path head and $\mathrm{PC}$ is instantiated by PN, PS, PNS, w-PN, or w-PS. In the reported synthetic microservice-like experiments, PN identifies the correct root cause in all but one scenario, PS often fails, PNS is intermediate, and w-PN is significantly better than w-PS (Laurentino et al., 2 Sep 2025).

This line of work makes explicit that a four-tier root-cause framework can be a graded causal semantics: first score candidate variables, then inspect mechanisms, then rank full causal narratives, and finally analyze how structural ambiguity and latent confounding shape the diagnosis.

5. Four-tier taxonomies of root causes beyond software operations

In the smart-contract security literature, the four-tier form is used not for diagnostic workflow but for categorizing the causes of large-scale incidents. The SoK on Ethereum exploits defines the tiers as (1) protocol logic design, (2) lifecycle and governance, (3) external dependencies, and (4) traditional implementation bugs. It distinguishes the root cause from a surface-level vulnerability, and introduces exploit chains to capture attacks that require multiple linked weaknesses rather than a single bug. The paper analyzes 71 academic papers to produce a catalog of 24 active and 5 deprecated vulnerabilities, and then studies 50 severe real-world exploits between 2022 and 2025, collectively causing \$1,093,979,779 in losses (Rezaei et al., 27 Jul 2025).

The principal finding is that successful attacks are usually not reducible to Tier-4 coding errors alone. The distribution over the 50 incidents is reported as T1: 24%, T2: 24%, T3: 24%, and T4: 28%, with only ~28% of losses rooted purely in Tier-4 bugs. Tier 1 covers flawed economic design and protocol logic; Tier 2 covers deployment, upgrade, configuration, and governance failures; Tier 3 covers unsafe assumptions about oracles, bridges, other protocols, or unvalidated external inputs; Tier 4 covers classic implementation-level weaknesses such as reentrancy, rounding errors, access control flaws, and dangerous delegatecall patterns (Rezaei et al., 27 Jul 2025).

The case study on “clumsy deployments & upgrades” further shows how the taxonomy becomes operational. Nomad Bridge, Ronin Bridge, Yearn Finance, and Unizen are grouped under a Tier-2 subcategory, with combined losses of \$215.5M. The proposed defenses include invariant-checked upgrades, staged roll-outs, operational gates, and runtime monitors or circuit breakers (Rezaei et al., 27 Jul 2025).

This taxonomy materially broadens the meaning of RCA. Instead of asking only which code path failed, it asks whether the earliest enabling condition lay in protocol economics, governance process, dependency assumptions, or implementation. A plausible implication is that four-tier RCA can serve as a cross-layer audit lens rather than only an online diagnosis mechanism.

6. Common design patterns, misconceptions, and limitations

The papers do not converge on a single canonical four-tier partition. Instead, the same four-tier form is reused for different analytical objects: workflow stages in CORAL and SpecRCA, memory strata in OpsCortex, exploit-cause layers in the smart-contract SoK, and causal-attribution levels in the quasi-Markovian framework (Wang et al., 2023, Zhang et al., 6 Jan 2026, Seedat, 18 Jun 2026, Rezaei et al., 27 Jul 2025, Laurentino et al., 2 Sep 2025). A common misconception is therefore that a four-tier root-cause framework must be a chronological incident-response pipeline. In the literature, it may equally be a storage architecture or a taxonomy of causal depth.

A second recurring pattern is the deliberate restriction of high-variance reasoning components. CORAL uses MSSA, SVAR, VGAE, and RWR, but closes the loop only when graph and ranking similarity stabilize. OpsCortex computes the root cause deterministically from topology and alert timing, and asks the LLM only to explain, confirm, and recommend. SpecRCA uses a non-LLM drafting module and a small LLM verifier, reserving synthesis to a later stage. This suggests a broader design principle: the four-tier form is often used to separate low-variance structural inference from higher-variance interpretive reasoning (Wang et al., 2023, Zhang et al., 6 Jan 2026, Seedat, 18 Jun 2026).

The same literature also emphasizes nontrivial assumptions and limitations. CORAL assumes causal sufficiency, piecewise-stationarity, sparsity, and a DAG. OpsCortex states that “who crossed threshold first” is an imperfect proxy for causation and reports no formal comparative metrics. The quasi-Markovian framework depends on acyclicity, finite-valued variables, independent exogenous variables, and a correct causal graph. The smart-contract SoK shows that audits restricted to Tier-4 implementation bugs leave most real-world loss unexplained. Accordingly, the significance of the four-tier root-cause framework lies not in a fixed universal taxonomy, but in a disciplined way of separating distinct explanatory burdens so that RCA can remain interpretable under multimodality, graph structure, temporal evolution, or layered causal depth (Seedat, 18 Jun 2026, Laurentino et al., 2 Sep 2025, Rezaei et al., 27 Jul 2025).