Security operations
When an agent does something you did not expect, you have minutes — not a research project
Agent incidents span identity, model, tool, data and business systems at once. The platform packages that context into something a SOC can actually work: a timeline, a containment action, and evidence that survives scrutiny.
The operating loop
Observe
Structured telemetry
Reconstruct
Timeline + authority
Detect
Baselines + anomalies
Contain
Suspend, revoke, throttle
Prove
Tamper-evident evidence
Observe
Structured telemetry
Reconstruct
Timeline + authority
Detect
Baselines + anomalies
Contain
Suspend, revoke, throttle
Prove
Tamper-evident evidence
Observe
Observability & Telemetry
Observability must capture what agents attempted, why controls responded, and what ultimately happened. The telemetry system should serve security operations without becoming an uncontrolled warehouse of sensitive prompts and business data.
What we build
- Structured events for agent sessions, tool calls, policy decisions, approvals, downstream results, costs and errors.
- Distributed trace IDs across agent → gateway → tool → result chains.
- Health telemetry for connectors, gateways and policy distribution.
- Configurable content capture: full, redacted, hashed or metadata-only.
How it works
- Design events for high-cardinality attributes such as agent, tool and tenant while controlling cost.
- Separate operational metrics from security evidence retention.
- Provide streaming export to SIEM/data platforms.
- Protect telemetry integrity and administrative access.
OPERATING PRINCIPLE
Record enough to explain and investigate—without collecting sensitive content merely because it is available.
Agent Activity Recorder & Replay
The activity recorder is the black box for agent behavior. It reconstructs sequence, context and authority so an incident responder or auditor can understand how a result occurred across multiple tools and agents.
What we build
- Timeline of agent decisions, tool calls, approvals and results.
- Delegation tree showing parent/child agents and initiating principal.
- Policy decision snapshots with policy version.
- Optional prompt/response capture with redaction.
- Replay/simulation against current or proposed policy.
How it works
- Store immutable event identifiers and timestamps from trusted services.
- Separate evidence preservation from user-editable notes.
- Allow investigators to attach findings without altering original records.
- Support export packages with integrity metadata.
FORENSICS
The product should answer not just “what did the agent do?” but “what authority and information led to that action?”
Detect
Behavioral Anomaly Detection
Behavioral detection identifies suspicious deviations that static policy cannot anticipate. The design should combine understandable statistical baselines with optional machine-learning models and never let anomaly scoring alone execute irreversible remediation without policy.
What we build
- Baseline agents by tools, resources, data volume, destinations, time, spend and delegation patterns.
- Detect sudden privilege usage, bulk reads, novel destinations, unusual tool sequences and repeated denied actions.
- Peer-group comparison for agents with similar business purpose.
- Risk escalation when multiple weak signals occur together.
How it works
- Maintain cold-start rules for new agents with insufficient history.
- Expose contributing factors for every anomaly score.
- Allow customer suppression/tuning and feedback loops.
- Use anomaly results as inputs to policy, approval and investigation workflows.
DETECTION RULE
Use AI to prioritize uncertainty; use deterministic policy to constrain consequences.
Agent Risk Scoring
Risk scoring gives leaders a consistent way to prioritize remediation. The score should reflect inherent capability, data exposure, autonomy, identity assurance, policy coverage, behavior and control maturity—not a mysterious single AI prediction.
What we build
- Inherent factors: destructive tools, financial authority, external communication, sensitive data and production access.
- Control factors: verified identity, least privilege, approvals, sandboxing, DLP and gateway coverage.
- Behavior factors: anomalies, repeated policy violations, unexpected destinations and spend spikes.
- Governance factors: owner, purpose, review status, exceptions and age.
How it works
- Show score components and allow tenant weighting within safe bounds.
- Separate inherent risk from residual risk after controls.
- Recompute on material changes or significant runtime events.
- Use risk tiers to drive recertification and default policy templates.
EXECUTIVE VIEW
Risk score is a prioritization lens—not a claim that one number proves an agent is safe.
Respond
Incident Response
Agent incidents can span identity, model, tool, data and business systems. Agent Trust Cloud should package the relevant context into a case workflow and automate containment actions while keeping irreversible decisions under explicit policy.
What we build
- Case creation from policy violation, anomaly, DLP event, SIEM alert or manual report.
- Automated evidence gathering across agent, identity, tools, approvals and related sessions.
- Containment playbooks: suspend agent, revoke token, disable tool, isolate gateway route, reduce budget or require approval.
- Case notes, ownership, severity, timeline and remediation tasks.
How it works
- Integrate SIEM/SOAR rather than replacing enterprise incident systems.
- Support bidirectional links to ServiceNow/Jira cases.
- Preserve evidence before destructive remediation.
- Use scoped containment before broad shutdown when possible.
SOC VALUE
Give security teams the agent-specific context their existing incident platforms do not natively have.
Kill Switch, Quarantine & Containment
Customers need confidence that they can stop an agent immediately. The kill switch must be fast, scoped and resilient, with options ranging from one session to an entire agent class or tool integration.
What we build
- Terminate active agent sessions and queued protected actions.
- Revoke agent/session tokens and brokered credentials.
- Disable specific tools or destinations.
- Force approval-only mode for an agent/team.
- Global emergency policy for an incident class.
How it works
- Distribute revocation state to gateways with very low propagation delay.
- Require strong admin authentication and reason for large-scope kill actions.
- Allow preconfigured emergency groups and playbooks.
- Ensure containment preserves forensic evidence.
PROMISE
Security should always be able to answer: “Can we stop it right now?”
Prove
Forensics & Evidence Chain
For high-stakes investigations, evidence needs integrity, chronology and traceability. The platform should maintain a tamper-evident chain that shows what was observed, what policy was active, who approved actions and what downstream system returned.
What we build
- Immutable event IDs, trusted timestamps and cryptographic hashes for evidence bundles.
- Policy/configuration snapshots referenced by decisions.
- Links to source-system event IDs where available.
- Investigator notes stored separately from original evidence.
- Legal/audit export packages with manifest and integrity verification.
How it works
- Use append-only or tamper-evident storage patterns for critical evidence.
- Define retention/hold workflows by incident and regulation.
- Avoid claiming legal chain-of-custody guarantees beyond implemented controls; document scope clearly.
- Record administrative evidence access.
TRUST
Security evidence is part of the product, not an afterthought to logging.
The question that matters
“Can we stop it right now?”
Containment scopes from a single session to an entire agent class or tool integration: terminate sessions and queued actions, revoke tokens and brokered credentials, disable a tool or destination, force approval-only mode, or apply a global emergency policy for an incident class.