Banks don't email you a weekly report about fraud. They freeze the card and text you. Agent infrastructure should work the same way.
Detection without response is a dashboard
Most agent platforms that claim "anomaly detection" show you a chart with a red dot. The red dot is the interesting part of an incident you already missed. A step-up lockdown inverts the flow: when the anomaly score crosses a threshold, the agent's permissions are automatically reduced — new actions are held or denied — until the owner reviews and releases it.
What counts as anomalous
Useful anomaly signals for agent behavior, all computed from the authorization log you already keep:
- Spend velocity: 3× the agent's normal hourly rate, sustained for an hour.
- New action verbs: the agent calls a tool it has never called before — especially a write tool.
- Deny rate spike: the policy layer starts denying far more than usual, which means the agent's behavior shifted, not the policy.
- Off-hours activity: an agent that only runs 9–5 starts acting at 3 AM.
- Approval-seeking burst: a sudden flood of require_approval outcomes suggests the agent is probing boundaries.
Any one of these can be benign. Two together are worth a freeze.
The lockdown should be graduated, not binary
A full kill is a blunt instrument — it stops the bleeding but also stops the work, and teams that get paged for full kills start disabling the detector. Graduated response:
- Step 1 — hold: new write actions are routed to approval; reads continue. The agent keeps working, just supervised.
- Step 2 — freeze: all new actions denied except an explicit owner allowlist. The agent is paused, not dead.
- Step 3 — kill: the kill switch, for confirmed compromise or runaway loops.
Escalate through the steps automatically as signals accumulate; de-escalate only by owner action.
Release is a decision, not a timeout
Lockdowns must not self-release. An owner reviews the anomaly log — what changed, when, which actions were held — and releases explicitly, optionally with a tightened policy attached (lower caps, narrower allowlist). This turns every incident into a policy improvement, which is the entire point of having had the incident.
Notify like it matters
The lockdown notification is the most important message your platform sends. It should name the agent, the signal that triggered it, what was frozen, and link straight to the review screen. Email is too slow for step 2 and above — push or SMS to the on-call owner is the standard to aim for.