DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Status of Claims Claims 1-20 are pending of which claims 1, 9 and 17 are in independent form. Claims 1-20 are rejected under 35 U.S.C. 101. Claims 1-20 are rejected under 35 U.S.C. 10 3. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more. The claim(s) recite(s) cluster drift based on playbook. With respect to step 1 of the patent subject matter eligibility analysis, the claims are directed to a process, machine, manufacture, or composition of matter. Independent claim 1 is directed to a system , which includes one or more processors and a non-transitory computer readable medium . Independent claim 9 is directed to a method, which is a process . Independent claim 17 directed to non-transitory computer-readable medium , which is directed to one of the four statutory subject matters. Independent All other claims depend on claims 1, 9 and 17 . As such, claims 1-20 are directed to a statutory category. Regarding claims 1, 9 and 17 : With respect to step 2A, prong one (Judicial Exception) , the claims recite an abstract idea, law of nature, or natural phenomenon. Specifically, the following limitations recite mathematical concepts and/or mental processes and/or certain methods of organizing human activity . The claim recites sequence of operations that amount to information organization, searching, evaluation, and ranking directed to an abstract idea: Collecting user data (profile and activity); Transforming data into feature representations (vectors); Applying a ML model to: Group users (clustering), Determine associated actions Selecting a playbook based on cluster characterization; Executing actions for users. These steps amount to: Collecting information; Analyzing and information using rules/algorithms (ML); Grouping/classifying information; Deciding actions based on the classification ; Executing actions based on those decisions . These steps fall into recognized abstract idea: Mental Process: grouping users based on characteristics ; determining actions based on group membership. Mathematical concept/algorithm: similarity calculation; clustering algorithm; feature vector processing . Methods of Organizing Human Activity: managing users based on behavior; applying policies/actions (Playbook). There are no steps performed that provides a technical improvement to the computing system itself. Thus, the claims recite an abstract idea (mental process/mathematical concepts/information organization). With respect to step 2 A , Prong Two ( Particular Application ) , the claims do not recite additional elements that integrate the judicial exception into a practical application. The following limitations are considered “additional elements” and explanation will be given as to why these “additional elements” do not integrate the judicial exception into a practical application. The claims add: A processor/computer system ; ML model ; Feature vectors/clustering ; Execution of playbook . There components perform their ordinary /conventional functions: The ML model is used a tool to analyze data , The clustering is a mathematical grouping technique , The playbook execution is a generic application of decisions , The computer system performs routine data processing . The claims do not: Improve ML model architecture , Improve clustering algorithm , Improve computer performance , Provide a new data structure or hardware implementation , Solve a technical problem in computing . These components merely use a computer to perform abstract data analysis and decision making . Instead, the claims merely apply the abstract idea in a routine UI environment. The limitations fail to transform the exception into a practical application. There is also no technical improvements such as: a new embedding technique; a new retrieval algorithm; an improved NN architecture; an improvement to computer processing. Instead, the claims recite conventional and generic computer functions performed in a routine manner (applying known AI tools to perform information retrieval and response generation), which does not amount to a practical application. W ith respect to Step 2B . The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. The recited components are merely generic computer/database elements performing their routine, well-understood, and conventional functions. See Alive , MPEP 2016.05(d) . The steps mentioned in the independent claims merely constitutes: generic computing components, generic ML processing, routine data handling, rule-based execution action , and merely applying the abstract idea using conventional technology. Courts have consistently helped such high-level information management operations are conventional. The claims provide no new algorithm, architecture, data structure, specialized hardware and/or technical improvements. All are routine, conventional operations business/ market place logic. Considering claims as a whole, the ordered combination of elements also reflects nothing more than the typical workflow of distributed systems, and therefore DOES NOT add “significantly more” than the abstract idea. Such generic, high‐level, and nominal involvement of a computer or computer‐based elements for carrying out the invention merely serves to tie the abstract idea to a particular technological environment, which is not enough to render the claims patent‐eligible, as noted at pg.74624 of Federal Register/Vol. 79, No. 241, citing Alice, which in turn cites Mayo. Further, See, e.g., Alice Corp. Pty. Ltd. v. CLS Bank Int'l, 134 S. Ct. 2347, 2359‐60, 110 USPQ2d 1976, 1984 (2014). See also OIP Techs. v. Amazon.com, 788 F.3d 1359, 1364, 115 USPQ2d 1090, 1093‐94 (Fed. Cir. 2015) ("Just as Diehr could not save the claims in Alice, which were directed to 'implement[ ing ] the abstract idea of intermediated settlement on a generic computer', it cannot save O/P's claims directed to implementing the abstract idea of price optimization on a generic computer.") (citations omitted). See also, Affinity Labs of Texas LLC v. DirecTV LLC, 838 F.3d 1253, 1257‐1258 (Fed. Cir. 2016) (mere recitation of a GUI does not make a claimpatent ‐eligible); Intellectual Ventures I LLC v. Capital One Bank, 792 F.3d 1363, 1370 (Fed. Cir. 2015) ("the interactive interface limitation is a generic computer element".). The additional elements are broadly applied to the abstract idea at a high level of generality ("similar to how the recitation of the computer in the claims in Alice amounted to mere instructions to apply the abstract idea of intermediated settlement on a generic computer,") as explained in MPEP § 2106.05(f)) and they operate in a well‐understood, routine, and conventional manner. MPEP § 2106.0S(d)(II) sets forth the following: The courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity. • Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec ... ; TLI Communications LLC v. AV Auto. LLC ... ; OIP Techs., Inc., v. Amazon.com, Inc ... ; buySAFE , Inc. v. Google, Inc ... ; • Performing repetitive calculations, Flook ... ; Bancorp Services v. Sun Life ... ; • Electronic recordkeeping, Alice Corp ... ; Ultramercial ... ; • Storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc ... ; • Electronically scanning or extracting data from a physical document, Content Extraction and Transmission, LLC v. Wells Fargo Bank ... ; and • A web browser's back and forward button functionality, Internet Patent • Corp. v. Active Network, Inc. ... . . . Courts have held computer-implemented processes not to be significantly more than an abstract idea (and thus ineligible) where the claim as a whole amounts to nothing more than generic computer functions merely used to implement an abstract idea, such as an idea that could be done by a human analog (i.e., by hand or by merely thinking). In addition, when taken as an ordered combination, the ordered combination adds nothing that is not already present as when the elements are taken individually. There is no indication that the combination of elements integrate the abstract idea into a practical application. Their collective functions merely provide conventional computer implementation. Therefore, when viewed as a whole, these additional claim elements do not provide meaningful limitations to transform the abstract idea into a practical application of the abstract idea or that the ordered combination amounts to significantly more than the abstract idea itself. The dependent claims have been fully considered as well, however, similar to the findings for claims above, these claims are similarly directed to the “Mental Processes” grouping of abstract ideas set forth in the 2019 PEG, without integrating it into a practical application and with, at most, a general purpose computer that serves to tie the idea to a particular technological environment, which does not add significantly more to the claims. The ordered combination of elements in the dependent claims (including the limitations inherited from the parent claim(s)) add nothing that is not already present as when the elements are taken individually. There is no indication that the combination of elements improves the functioning of a computer or improves any other technology. Their collective functions merely provide conventional computer implementation. Accordingly, the subject matter encompassed by the dependent claims fails to amount to significantly more than the abstract idea. Looking at the claim as a whole does not change this conclusion and the claim is ineligible. Regarding claim s 2 , 10 and 18 (ML Training/ Data Preparation) , The claim recites: Generating training dataset, Labeling data (action) , Generating training vectors, Training a ML model. These limitations merely teach data analysis and mathematical modeling steps. Training and vectorization are standard mathematical operations. These claims do not: improve ML architecture, improve training efficiency, introducing a new learning technique. This does not change the nature of the abstract idea. It does not add a technical improvement to an abstract idea, such as improving computer functionality, data structure, or processing architecture. There is no practical application, and no inventive step, the claims are still considered abstract. Regarding claim s 3, 8, 11, 16, and 19 (ML Training/ Data Preparation) , The claim recites: Selecting clusters, Evaluating clusters based on: Number of users (claims 3, 11 and 19) Common characteristics/similarity (claims 8 and 16) Removing clusters based on threshold conditions. These limitations are merely: Evaluating groups using threshold is rule-based decision making Similarity comparison is a mathematical operation Removing clusters is a logical filtering step These claims do not: improve clustering algorithm, improve computer functionality, introducing a new similarity matrix. This does not change the nature of the abstract idea. It does not add a technical improvement to an abstract idea, such as improving computer functionality, data structure, or processing architecture. There is no practical application, and no inventive step, the claims are still considered abstract. Regarding claim s 4, 6, 12, 14, and 20 ( Action Selection/Playbook Execution ) , The claim recites: determining characteristics of clusters , selecting action/playbook based on cluster properties, executing instructions (e.g. training, scheduling, retrieving user data), applying actions to users in the cluster. . These limitations are merely: selecting actions based on conditions is decision making logic, executing workflow in organizational activity, Applying actions to users in the cluster. These claims do not: improve workflow execution technology , introduce a new control mechanism , improve computer operation . This does not change the nature of the abstract idea. It does not add a technical improvement to an abstract idea, such as improving computer functionality, data structure, or processing architecture. There is no practical application, and no inventive step, the claims are still considered abstract. Regarding claim s 5 , and 13 ( Output Generation/File Creation ) , The claim recites: generating a textual file , including required and optional characteristics . These limitations are merely: generating files is data presentation , organizing fields is information structuring . These claims do not: improve file systems , introduce a new data format , improve storage or retrieval . This does not change the nature of the abstract idea. It does not add a technical improvement to an abstract idea, such as improving computer functionality, data structure, or processing architecture. There is no practical application, and no inventive step, the claims are still considered abstract. Regarding claim s 7 , and 1 5 ( Feature-Based Classification ) , The claim recites: receiving ML output , determining cluster membership based on features, determining a training class/type . These limitations are merely: feature based classification is data analysis , using features to assign groups is mathematical evaluation, determining class/type is categorization . These claims do not: improve feature extraction techniques , improve classification algorithm , provide a new ML architecture . This does not change the nature of the abstract idea. It does not add a technical improvement to an abstract idea, such as improving computer functionality, data structure, or processing architecture. There is no practical application, and no inventive step, the claims are still considered abstract. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claim(s) 1, 2, 4, 5, 9, 10, 12. 13, 17, 18 , and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Saxena; Abhishek et al. (US 20190327271 A1) [Saxena] in view of Kerkar ; Neha et al. (US 20240259396 A1) [ Kerkar ]. Regarding claim s 1 , 9 and 1 7 , Saxena discloses, a system for running playbooks based on cluster drift (clustering users/entities ¶ [0174], [0261], anomaly/drift detection ¶ [0039], [0133], [0196], [0228], [0241]) , the system comprising: one or more processors; and a non-transitory computer-readable storage medium storing instructions, which when executed by the one or more processors cause (see Fig. 7) the one or more processors to: retrieve, from a first data source, user profile data for a plurality of users, wherein the user profile data comprises a first plurality of features (user attributes, roles, permission ¶ [0092], user profile data ¶ [0092], [0096], [0241], [0052], attributed used for clustering ¶ [0125], [0261]) ; retrieve from a second data source, user activity data for the plurality of users, wherein the user activity data comprises a second plurality of features (user action ¶ [0165], [0241]; access/activity log ¶ [0072] -[ 0073], [0169]-[0170], [0230], [0239]; learned activity patterns ¶ [0125], [0261]) ; transform the first plurality of features and the second plurality of features into a user dataset (aggregating of actor/object attributes ¶ [0125]; similarity computation across features ¶ [0173]; activity profile constructed ¶ [0241], attribute vectors formed ¶ [0261], [0257]) ; generate a plurality of vectors for the plurality of users within the user dataset (building a vector of attributes for each object, user…attribute vectors used for clustering ¶ [0261] -[ 0262], [0021]-[0022]; similarity matrices ¶ [0235], [0260]-[0262]; TF-IDF/cosign similarity ¶ [0168]-[0173]) ; input, into a machine learning model, the plurality of vectors to obtain a plurality of actions associated with the plurality of users ( ML models learn access patterns, ML predicts: access permission, access behavior ¶ [0240], learn action types ¶ [0241], ML used to predict suspicious or unauthorized actions ¶ [0242]; examiner specifies that vectors are fed into ML models to predict actions ) ; generate a plurality of action clusters for the plurality of actions ( clustering based attributes and actions ¶ [0174]; clustering using vectors ¶ [0260]-[0262]; clustering entities with similar behavior ¶ [0165]) , wherein each action cluster of the plurality of action clusters comprises a set of users with a corresponding predicted action ( clusters formed based on actions and behavior ¶ [0165], [0174]; ML predicts behavior/actions ¶ [0240]-[0242], activity profiles define behavior per entity ¶ [0241]; profiles clustered ¶ [0158], [0220] ) . However, Saxena does not explicitly facilitate based on a corresponding action of the plurality of actions, identify, for each action cluster in the plurality of action clusters, a corresponding playbook to execute for users associated with a corresponding action cluster; and execute the corresponding playbook for each action cluster of the plurality of action clusters . Kerkar discloses, based on a corresponding action of the plurality of actions, identify, for each action cluster in the plurality of action clusters, a corresponding playbook to execute for users associated with a corresponding action cluster ( obtain remediation rules [Abstract], ¶ [0015], [0067]; determine remediation strategy ¶ [0017]; rule engine selects strategy ¶ [0027]; examiner hereby specifies that strategy is considered a playbook ) ; and execute the corresponding playbook for each action cluster of the plurality of action clusters ( execute remediation strategies ¶ [0026], trigger remediation actions ¶ [0032], perform actions via agents ¶ [0042], [0067] ). It would have been obvious to one ordinary skilled in the art at the time of the filing of the present invention to combine the teachings of the cited references because Kerkar’s system would have allowed Saxena to facilitate based on a corresponding action of the plurality of actions, identify, for each action cluster in the plurality of action clusters, a corresponding playbook to execute for users associated with a corresponding action cluster; and execute the corresponding playbook for each action cluster of the plurality of action clusters . The motivation to combine is apparent in the Saxena ' s reference, because there is a need for an improved automated response top detecting anomalous or drift conditions and improved system security and operational efficiency. Regarding claim s 2 , 10 and 1 8 , the combination of Saxena and Kerkar discloses, wherein the instructions further cause the one or more processors to: retrieve user profile training data comprising a first plurality of training features and user activity training data comprising a second plurality of training features, wherein the user profile training data and the user activity training data is associated with a training set of users; retrieve action data comprising a plurality of training actions associated with the training set of users ( Saxena: training using logs/activity data ¶ [0240] ) ; transform, into a training dataset, (1) the user profile training data, (2) the user activity training data, and (3) the action data, wherein the training dataset comprises (1) a subset of the first plurality of training features and the second plurality of training features and (2) the action data representing a corresponding label for each user identifying an observed action for each user ( Saxena: learning action types ¶ [0241], prediction of actions ¶ [0242] ) ; transform the training dataset into a plurality of training vectors, wherein each vector of the plurality of vectors represents a user within a set of training users and each vector is associated with the corresponding label ( Saxena: training vector ¶ [0019], [0021], feature vectors [0260] -[ 0262] ) ; and train the machine learning model, using the plurality of training vectors to predict the corresponding action for each user in the set of training users ( Saxena: supervised/unsupervised ML ¶ [0020], [0240] -[ 0242] ). Regarding claim s 4 , 12 and 20 , the combination of Saxena and Kerkar discloses, select a first action cluster of the plurality of action clusters; determine one or more characteristics common to a first set of users within the first action cluster ( Saxena: cluster defined by attributes ¶ [0174], [0261] ); and pass one or more indicators of the one or more characteristics to a first playbook being executed for the first action cluster ( Kerkar : remediation strategy selected based on conditions/rules ¶ [0017], [0027] ); Regarding claim s 5 and 13 , the combination of Saxena and Kerkar discloses, generating a textual file for publication ( Kerkar : policies defined in YAML/JSON files ¶ [0027]; examiner specifies that YAML/JSON are textual playbook representation ) , wherein the textual file comprises the one or more characteristics marked as required and other characteristics of users within the first action cluster marked as optional ( Kerkar : configuration files used for execution ¶ [0025]). Claim(s) 3, 6-8, 11, 14-16 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Saxena in view of Kerkar in view of Sellars; Philip et al. ( US 20240137378 A1 ) [Sellars] . Regarding claim s 3 , 11 and 19 , the combination of Saxena and Kerkar discloses, select a first action cluster of the plurality of action clusters (Saxena: clustering users/entities into group ¶ [0125], [0200], [0210]) ; determine a number of users within the first action cluster (Saxena: clustering represents groups of users ¶ [0131], evaluation of group composition (includes number of users) ¶ [0194]). However, neither Saxena nor Kerkar explicitly facilitates based on the number of users within the first action cluster not meeting a threshold, remove the first action cluster from the plurality of action clusters . Sellars based on the number of users within the first action cluster not meeting a threshold (Measure exceeds a threshold ¶ [0134], equal or above actionable threshold ¶ [0264]) , remove the first action cluster from the plurality of action clusters (the clusters are disbanded when conditions are met ¶ [0134], [0135]. Also see ¶ [0124], [0126] ). It would have been obvious to one ordinary skilled in the art at the time of the filing of the present invention to combine the teachings of the cited references because Sellar’s system would have allowed Saxena and Kerkar to facilitate based on the number of users within the first action cluster not meeting a threshold, remove the first action cluster from the plurality of action clusters . The motivation to combine is apparent in the Saxena and Kerkar ' s reference, because there is a need for a n improved dynamic, adaptive, and intelligent system that can automatically determine user importance based on email flow within the company, tailor actions and action severity towards important users, and require minimal manual tuning. Regarding claim s 6 and 14 , the combination of Saxena, Kerkar and Sellars discloses, select a second action cluster of the plurality of action clusters (Saxena: clustering users/entities into group ¶ [0125], [0200], [0210]) ; determine that a type of action associated with the second action cluster (Saxena: policies derived from cluster characteristics ¶ [0131], clusters used to determine access control policies ¶ [0194], additionally Sellars teaches: ML identified malicious emails/groups ¶ [0263]) indicates executing a second playbook for each user within the second action cluster (Sellars: causing one or more autonomous actions ¶ [0264], examiner specifies this corresponds to executing actions per cluster (playbook )) , wherein the second playbook comprises one or more instructions to schedule a training class for each user (Sellars: ingesting ML outputs ¶ [0270], performing secondary analysis ¶ [0271], multi-step execution pipeline. Action vary based on user/recipient ¶ [0155]) ; and retrieve a plurality of electronic addresses for the users within the second action cluster for scheduling the training class (Saxena: retrieving user attributes from directory systems ¶ [0131]) . Regarding claim s 7 and 15 , the combination of Saxena, Kerkar and Sellars discloses, receive, from the machine learning model, output data indicating one or more features that caused the machine learning model to add the users into the second action cluster ( Saxena: inputting vectors into ML models ¶ [0021] -[ 0022], vectors representing attributes ¶ [0168] . Clustering vectors using K- means/autoencoder ¶ [0019], clustering attribute vectors ¶ [0261], similarity scores for clustering ¶ [0174] ); and determine, based on the one or more features, a training class type ( predicting clusters and attributes using ML ¶ [0021] -[ 0022], this is classification based on features ) for the users in the second action cluster ( Sellars: action triggered based on ML output and threshold ¶ [0264]). Regarding claim s 8 and 16 , the combination of Saxena , Kerkar and Sellars discloses, select a first action cluster of the plurality of action clusters; determine that a number of common characteristics for a first set of users within the first action cluster does not meet a threshold ( grouping actors/objects into cluster ¶ [0125], clustering based on attributes/tags ¶ [0200], [0210] similarity metrics (TF-IDF, cosine similarity), similarity score quantify degree of commonality ¶ [0173], clustering based on similarity between users ¶ [0174], similarity matrix, distance based relationships, enables evaluation of similarity ¶ [0235], clustering attribute vectors ¶ [0261] ) ; and based on determining that the number of common characteristics for the set of users within the first action cluster does not meet the threshold, remove the first action cluster from the plurality of action clusters ( S ellars: the clusters are disbanded when conditions are met ¶ [0134], [0135] . Also see ¶ [0124], [0126] ). Conclusion The examiner requests, in response to this Office action, support be shown for language added to any original claims on amendment and any new claims. That is, indicate support for newly added claim language by specifically pointing to page(s) and line no(s) in the specification and/or drawing figure(s). This will assist the examiner in prosecuting the application. When responding to this office action, Applicant is advised to clearly point out the patentable novelty which he or she thinks the claims present, in view of the state of the art disclosed by the references cited or the objections made. He or she must also show how the amendments avoid such references or objections See 37 CFR 1.111(c). Any inquiry concerning this communication or earlier communications from the examiner should be directed to FILLIN "Examiner name" \* MERGEFORMAT MOHAMMAD S ROSTAMI whose telephone number is FILLIN "Phone number" \* MERGEFORMAT (571)270-1980 . The examiner can normally be reached FILLIN "Work Schedule?" \* MERGEFORMAT Mon-Fri From 9 a.m. to 5 p.m. . Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, FILLIN "SPE Name?" \* MERGEFORMAT Boris Gorney can be reached at FILLIN "SPE Phone?" \* MERGEFORMAT (571)270-5626 . The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 3/24/2026 /MOHAMMAD S ROSTAMI/ Primary Examiner, Art Unit 2154