AIDR

Pre-execution control decides on the actions policy anticipated. The attacks that remain ride the permitted stream: a document the agent was allowed to read carries an injected instruction, or a credential is used exactly within its scope for a purpose nobody intended.

None of that trips a rule, because each individual action was authorized. The signal is in the pattern, and a pattern is only visible with runtime instrumentation already in place.

An agent reading a hundred times its usual volume is reporting something no rule encoded. Detection works from per-agent baselines over the decision stream: volume, targets, timing, and the distance between today's behavior and this agent's normal.

The instrumentation matters more than the analytics. Detection built over the same runtime record that enforcement writes sees every decision, including the permits. Detection bolted onto exported logs is log analysis under a newer name.

Response is operational, and it is measured in what you can do rather than what you can see. Suspend the agent, revoke or narrow the credentials it holds, or move it to approval-only while you investigate.

Reconstruction depends on the record. A session rebuilt from a decision-by-decision account, each entry stating what was requested, what was decided, and why, is evidence you can act on. If the trail stops at a dashboard, you can watch the incident but you cannot contain it from there.

An incident that produces only an alert will repeat. The useful output of a detection is a policy change: a deny rule for the pattern, an approval requirement on the operation it abused, or a trust-tier downgrade for the agent that showed it.

Enforcement handles what policy anticipated. Detection finds what it did not, and each finding converted into a rule shrinks that second category.