Anomaly Detection

Every event is evaluated against a behavioural-rules engine before it reaches your dashboard — not signature-matching, not pattern-from-a-feed. Here's what each rule catches and how to respond.

The Rules

1. new_tool (LOW)

What it detects

Fires when an agent calls a tool it hasn't used recently — for example, an agent that has only ever called search_docs suddenly starts calling send_email.

What to do

• Expected after deploying a new version of your agent with new tools
• Unexpected new tools may indicate unauthorized modifications to the agent
• Review the event's tool parameters to understand what the new tool does

2. frequency_spike (MEDIUM)

What it detects

Fires when an agent's event rate spikes significantly above its recent baseline — a quiet agent that suddenly starts firing rapid bursts of events, or a steady agent whose volume jumps several-fold in a short window.

What to do

• Could be a legitimate traffic spike (batch processing, peak hours)
• Could indicate a runaway agent stuck in a loop
• Check the events for that window — are they diverse or repetitive?
• If the agent is looping, investigate the trigger and add circuit breakers

3. high_error_rate (HIGH)

What it detects

Fires when an agent's recent failure rate climbs well above its normal range — for example, an agent that usually succeeds cleanly suddenly starts failing on a meaningful share of its calls.

What to do

• Check the error code field on recent failures — are they all the same error?
• Common causes: expired API keys, permission changes, external service outages
• Check if a recent deployment introduced a bug
• If the agent is retrying a consistently failing operation, it will burn through the threshold quickly

4. restricted_data (HIGH)

What it detects

Fires immediately when an event has inputs_classification set to "restricted". This is a data governance control that you opt into.

# To trigger this rule, set the classification on the event:
event = AuditEvent(
    ...
    inputs_classification="restricted",  # triggers HIGH alert
    ...
)

What to do

• This is expected behaviour — you flagged this data as restricted
• Use it as a signal for compliance review
• Useful for healthcare, financial, or legal data that should always be reviewed
• If you're seeing too many of these, consider whether your classification is too broad

5. off_hours_activity (MEDIUM)

What it detects

Learns an agent's normal hourly activity profile and fires when an event arrives in an hour the agent rarely uses. Brand-new agents stay quiet until enough history has accumulated to form a reliable profile.

What to do

• Normal for agents whose schedule has genuinely changed — review and acknowledge
• Suspicious if the agent has a steady weekday-business-hours profile and a 3am event arrives
• Cross-check the event's human_operator_id — automated jobs should be expected, ad-hoc operator runs at unusual times deserve attention

6. chain_break_detection (CRITICAL)

What it detects

AGT maintains a tamper-evident hash chain over every event. This rule walks adjacent events for each agent and fires when the chain link between two events doesn't match — meaning events were dropped, reordered, or tampered with. See the full Chain Breaks guide for resolution workflows and common causes.

What happens

The event IS still written to the database (for forensic investigation), and a CRITICAL alert is raised.

What to do

• If the agent was restarted, the first event of the new session may legitimately break the chain (expected)
• Multiple breaks in a single session suggest tampering or lost events
• Use the Integrity Verifier in the dashboard to check the full chain for an agent

7. capability_profile_deviation (HIGH)

What it detects

Learns the set of actions an agent normally performs over a rolling baseline window, then compares the agent's most recent activity against it. If the agent performs actions absent from that baseline, a HIGH alert fires listing the unregistered actions.

What to do

• Expected after deploying a new agent version with genuinely new capabilities — review and acknowledge
• Unexpected deviation can indicate prompt-injection-driven scope creep or a compromised credential pivoting from allowed tools into unallowed ones
• Review the unregistered-action list on the alert, then cross-check the agent's recent events for the flagged actions

Severity Levels