Live Telemetry & Anomaly Detection
Detect abnormal agent behaviour at runtime — not in post-hoc audits — and surface alerts to the right operator.
This page is the complete instruction page for one pattern called "Live Telemetry & Anomaly Detection." It explains the problem this pattern solves, the idea behind the solution, when you should (and should not) use it, and what happens afterward — both the good effects and the costs.
This matters because building AI agents is not just about making them clever. It is also about making them safe and predictable. Following a well-tested pattern like this one helps avoid common mistakes, and shows you exactly which safety rules and regulations it connects to, listed under "Standards Mesh" on this page.
Context
Agents that misbehave at machine speed can cause damage faster than manual review catches. Runtime anomaly detection is the difference between an incident and a near-miss.
Problem
Reviewing logs nightly is insufficient for systems that act in seconds.
Forces
- Alert volume vs catch rate
- Detection latency vs false positives
Solution
Define expected behavioural envelopes: tool-use mix, average reasoning depth, token spend per task, refusal rate. Stream telemetry into anomaly detection. Alert on statistically significant deviations. Route alerts to a named on-call rotation.
Applicability
- High-volume production agents
- Agents with write access
- Multi-tenant platforms
Anti-Patterns
- No alerting, only dashboards
- Alert thresholds set once and forgotten
Consequences
- +Fast detection of regressions and attacks
- +Statistical baseline for "normal"
- −Tuning effort
- −Alert fatigue if thresholds wrong