Guance ABA continuously analyzes AI Agent model calls, tool executions, command parameters, production changes, and token consumption. It identifies high-risk operations, sensitive-data exfiltration, call loops, and cost anomalies on real execution traces, so enterprises can see, investigate, and audit Agent behavior.
What problem does ABA solve?
See what an Agent actually does before governing it continuously
Agent risk does not always come from malicious intent. It can also result from variable expansion, permission boundaries, or unsafe tool combinations. ABA analyzes actual model calls and tool executions—not only generated output—and reconnects intent, action, result, and risk evidence in one session context.
Complement SIEM and CSPM with coverage for Agent runtime behavior
SIEM focuses on security logs and events, while CSPM focuses on cloud configuration and exposure. ABA examines the Agent execution path to determine which tools were called, what actions occurred, and whether results crossed permission or risk boundaries.
Identify high-risk shell commands on real execution traces while preserving command parameters and match evidence.
风险场景
Identify high-risk commands such as rm -rf, chmod 777, crontab writes, and firewall changes, including cases where variable expansion or path construction mistakenly targets a production environment.
检测逻辑
Match commands and parameters on executed tool Spans instead of inspecting only static text before model execution.
告警证据
Session ID, Span ID, complete command parameters, execution time, and return status.
建议处置
Pause the session, verify scope and approval records, and roll back or restore as appropriate for the impact.
02
AI_AGENT_002
Sensitive credential file access
.env / SSH Key / kubeconfig
Identify actual Agent access to sensitive paths such as environment files, private keys, and cloud credentials.
风险场景
An Agent reads a credential file while troubleshooting a connection. The content then enters later model calls through the conversation context, allowing sensitive data to leave its original boundary without the user noticing.
检测逻辑
Detect access to sensitive paths, but trigger only when access succeeds or returned content contains credential patterns, avoiding noise from failed attempts.
告警证据
Sensitive-data type, matched file, call result, and a redacted evidence excerpt.
建议处置
Pause the affected session, rotate the credential, and review later model and tool calls in the same session.
03
AI_AGENT_003
Exfiltration after sensitive access
read → network
Correlate sensitive reads with outbound requests, messages, and attachment uploads within the same session or call chain.
风险场景
A sensitive read or network request may be legitimate in isolation. Reading credentials and then invoking a webhook or uploading an attachment in the same session is a typical data-exfiltration path.
检测逻辑
Correlate sensitive reads with external requests, message sends, and attachment uploads by trace_id or gen_ai_conversation_id, including multi-turn behavior across Traces.
告警证据
The read-side and exfiltration-side Spans, destination, sequence, and correlated risk ID.
建议处置
Terminate the session, inspect the outbound content, rotate credentials, and add approval or blocking controls to sensitive-read and exfiltration tools.
04
AI_AGENT_004
High-risk production changes
prod + mutate
Use production context to detect resource deletion, configuration changes, database writes, and permission changes.
风险场景
When an Agent holds credentials for multiple environments, it may delete resources, change deployments or configuration, or write to databases in a production namespace.
检测逻辑
Evaluate environment tags, tool names, call parameters, and command content; trigger only when a high-risk production change actually succeeds.
告警证据
Target environment, resource object, tool parameters, execution result, and related approval or release context.
建议处置
Check the approval ticket, release ticket, or explicit human authorization first. If unauthorized, pause the session, assess impact, and roll back as needed.
05
AI_AGENT_005
Agent tool-call loop
≥ 10 calls / failure rate ≥ 70%
Aggregate call count and failure rate by Trace and tool to detect loops that keep failing without stopping.
风险场景
The Agent repeatedly cycles through modification, testing, failure, and retry without a call limit, backoff strategy, or human intervention condition, continually consuming time and tokens.
检测逻辑
Aggregate by Trace and tool name; trigger when the same tool is called at least 10 times in the detection window and the failure rate is at least 70%.
告警证据
Call count, failure rate, parameter samples, error types, and duration.
建议处置
Stop the loop and add call limits, retry backoff, stopping conditions, and human takeover controls to the Agent.
06
AI_AGENT_006
Anomalous token consumption
Single call + session total
Combine per-call usage, session total, context length, and tool density to identify anomalous token consumption.
风险场景
When tool results are fed back in full, context keeps growing, or a call chain repeatedly retries, one task can consume far more tokens than the normal range.
检测逻辑
Combine fixed thresholds and multi-signal scoring across per-call usage, session total, context length, output length, and tool-call density to reduce false positives on legitimately heavy tasks.
告警证据
Model, provider, input and output tokens, session total, average usage, and number of tool calls in the same chain.
建议处置
Identify the cost source, limit context and tool-result length, and set model-, team-, or task-level budgets with automatic interruption.
Investigation path
Drill down from a risky Session to the Agent's actual actions
Detection is only the first half. ABA places risk level, session history, and individual call chains on one investigation path, so teams do not have to reconstruct the incident from massive log volumes.
查看证据Risk level, number of risk events, session status, and duration
得到结论Isolate high-risk investigation targets from large volumes of normal sessions
查看证据Model and tool call counts, latency, failure status, and risk events
得到结论Determine whether the anomaly comes from the model, a tool, retries, or a permission boundary
查看证据End-to-end llm → assistant → tool path, including inputs, outputs, and tool results
得到结论Identify what happened at each step and whether the action had real impact
数据接入路径
Agent SDK / OpenTelemetry → Session, Trace, Span → model calls, tool executions, tokens, and risk signals
适用场景
Designed for security, platform, engineering, and SRE teams running Codex, Claude Code, Qoder, WorkBuddy, or Guance AI Agents.
使用边界
ABA provides continuous detection, investigation, and auditing. Approval, blocking, or automatic termination of high-risk actions should be configured through the organization's permission and runtime policies.
Whether it is a coding Agent, operations Agent, or an in-house enterprise Agent, standard trace data lets teams analyze sessions, models, tools, cost, and risk in one view.
ABA is a security detection capability for AI Agent runtime behavior. It analyzes model calls, tool executions, command parameters, file access, network exfiltration, production changes, and token consumption to continuously detect, investigate, and audit high-risk Agent behavior.
SIEM correlates security logs, audit events, and threat indicators, while CSPM identifies cloud-asset configuration and exposure risks. ABA follows the Agent execution path to determine which tools were called, what actions occurred, and whether results crossed permission or risk boundaries.
No. ABA evaluates the Spans that actually executed while preserving model inputs and outputs, tool names, parameters, return status, and session context. This reveals variable expansion, cross-turn calls, and changes in the true scope of an action that static-text checks can miss.
ABA first provides continuous detection, investigation, notification, and auditing. Organizations can connect risky calls to approval, blocking, or runtime-denial controls through their own permission policies, then verify the outcome with subsequent production signals.
Guance supports behavior security monitoring for Codex, Claude Code, Qoder, WorkBuddy, and Guance AI Agent, and can onboard in-house enterprise Agents through standard telemetry and trace data.
