detection & response
Agent behavior anomalies
A governed agent's decision stream shows which tools it touches, which data categories it reads, and at what volume. That stream is a baseline. An agent behaving unusually on permitted activity is a signal no allow rule can encode, and it deserves a response path.
Permitted is not the same as normal
Policy answers whether an action is allowed. It cannot answer whether the action is typical for this agent, and the incidents that slip past rules tend to live there: a credential misused within its scope, a behavior no control anticipated.
An agent reading a hundred times its usual volume is telling you something no rule encoded. Catching that requires a baseline, and the baseline has to come from real traffic rather than a design document.
The decision stream is the baseline
Every retrieval and action a governed agent attempts is evaluated and recorded, so each agent accumulates a factual profile of its own traffic, down to the rhythm of its working day.
The platform already reasons over that traffic. Each agent's business function, support, finance, engineering, and the rest, is assigned from what it actually does, which gives deviation a precise meaning: a support agent pulling engineering documents is off its observed lane even when a rule technically permits the read.
From anomaly to containment
Ambiguous retrievals can carry an escalate outcome, which sets them aside for human review. For a stronger response, an operator lowers the agent's trust tier or pins its business function, and the running agent picks up the change without a redeploy.
At a lower tier, decisions the agent was already receiving come back harder: sensitive retrievals arrive masked, and sensitive actions stop at approval or at deny. Containment is a policy state, so it reverses just as fast.
Feed the finding back into policy
An anomaly worth acting on twice is a control. Coverage gaps surface with a draft covering control already written, and a dry run over the agent's recent decisions shows what the draft would have permitted and denied, so the fix cannot quietly break legitimate work.
Detection without enforcement documents things nobody stopped. The point of the loop is that what you notice this week is what the runtime refuses next week.