Observability and Detection

Anomaly detection over the action stream, and the ratio between telemetry generated and telemetry analyzed.

Minimum bar (L2). Centralized collection of agent action telemetry—tool calls, parameters, destinations, outcomes, authorization decisions, credential use, egress. Prompt logs alone do not satisfy this bar.

13.1 Controls #

ID	Control	Minimum bar (L2)	Enforced state (L3)
OBS-1	Action-stream anomaly detection	Alerting on defined conditions across the action stream—known-bad destinations, clustered authorization denials, volume thresholds, credential use outside declared scope. Rules are static and human-tuned rather than behavioral, and every rule has a named owner and a documented response.	Automated anomaly detection over the action stream, including LLM-assisted triage where volume requires it. The relevant benchmark: Hugging Face reconstructed a 17,000-event intrusion in hours using AI-driven analysis over its own telemetry, which is the standard machine-speed attacks now set.⁵
OBS-2	Behavioral baselining	A documented expected profile per agent class—typical tool mix, destinations, action volume, data volume—established before production and reviewed on change. Deviation is caught by scheduled review rather than continuous alerting.	Behavioral baselining per agent and per agent class, with alerting on deviation in action mix, destination diversity, velocity, or data volume.
OBS-3	Telemetry correlation	Agent action telemetry lands in the same platform as identity, network, and cloud control-plane logs, sharing a correlation identifier so an analyst can pivot manually. Instrumenting to the OpenTelemetry GenAI semantic conventions—agent, workflow, tool, and model spans—makes this achievable without bespoke schema work, though that namespace remains at Development stability and attribute names may still change.	Correlation between agent telemetry and conventional security telemetry—identity, network, endpoint, cloud control plane. Agent activity examined in isolation looks like automation; correlated, it looks like what it is.
OBS-4	Automated response paths	A documented and tested manual containment path with a target time-to-effect: who halts an agent, by what mechanism, and how quickly. Automation may be absent, but the procedure is exercised rather than assumed.	Automated response paths that halt or quarantine without waiting for human triage.
OBS-5	Generated-versus-analyzed ratio	Telemetry volume and analysis coverage are measured and reported even when the ratio is poor. A quantified gap is a manageable condition; an unmeasured one is the condition that produced a week of operator blindness in July 2026.	Explicit measurement and reporting of the ratio between telemetry generated and telemetry actually analyzed. Where that ratio degrades, detection has degraded, regardless of what the dashboard says.

13.2 Evidence to Request #

Mean time to detect for a simulated agent compromise.
Coverage documentation: what fraction of the agent estate emits action telemetry.
The generated-versus-analyzed ratio.

13.3 Failure Modes #

Recording mistaken for detection. Logs that nobody and nothing reads are an evidentiary asset, not a control.
Detection tuned to a volume assumption that agents immediately invalidate, producing alert fatigue and then suppression.
Coverage gaps at exactly the agents that matter: those in low-code platforms, third-party SaaS, and developer environments.

13.1 Controls #

13.2 Evidence to Request #

13.3 Failure Modes #

References cited in this section