Insider Risk (AI Agent Governance)
The Actor Traditional Tools Can’t See
Section titled “The Actor Traditional Tools Can’t See”Human-focused DLP and endpoint tools watch people: a user copying a file, emailing a customer list, plugging in a USB drive. They have no visibility into the non-human actor — the AI agent that makes tool calls, invokes internal APIs, and emits model output autonomously, at machine speed and volume. Insider Risk governs exactly this surface. It treats each AI agent as an actor whose every tool call, API invocation, and model output is a governable event, and it scores that behavior continuously against a library of risk indicators built from signals AgentWatch already collects.
State for the entire feature persists in the existing settings store — no schema migration is required (§7.23).
Agent Risk Indicators (ARIs)
Section titled “Agent Risk Indicators (ARIs)”An Agent Risk Indicator is a named signal that fires when an agent exhibits a risky behavior. AgentWatch ships a built-in library spanning four categories, computed live from DLP, tool-approval, and usage signals:
| Category | Example built-in indicators |
|---|---|
| Exfiltration | Blocked exfiltration attempts; PII / PCI observed in agent traffic; sensitive design / firmware IP in traffic |
| Manipulation | Prompt-injection attempts; jailbreak attempts |
| Boundary | Unauthorized or high-risk tool use |
| Anomaly | Off-hours activity; abnormal volume / behavior shifts |
Each firing indicator contributes to a per-agent risk score and rolls up into an organization agent-risk score, giving both a drill-down and a single-number posture.
Custom ARI Authoring
Section titled “Custom ARI Authoring”Beyond the built-in library, administrators can author their own indicators: define a name, category, and threshold, and supply a keyword matcher that flags matching agent activity. Custom ARIs are evaluated alongside built-ins and contribute to scoring identically — letting an organization encode its own sensitive project names, code words, or domain-specific risk language without a code change.
Data-Access & Exfiltration Visibility
Section titled “Data-Access & Exfiltration Visibility”Insider Risk surfaces what agents read and output, and how sensitive it is — the data-access and exfiltration picture per agent. This turns the abstract risk score into concrete evidence: which sensitivity classes an agent has touched, and where blocked-exfiltration indicators originated.
AI Incident Case Management
Section titled “AI Incident Case Management”When an indicator or pattern warrants investigation, an analyst can manage it as a case:
| Capability | Description |
|---|---|
| Open / investigate / close | Full case lifecycle |
| Assignee | Route a case to an owner |
| Evidence timeline | A chronological record of the signals and enforcement decisions attached to the case |
Adaptive Enforcement
Section titled “Adaptive Enforcement”Insider Risk is not only observational — it can act. Administrators define an enforcement policy with warn / step-up / block thresholds. The surface shows live standings (which agents currently sit in which band) and a decisions audit log of every enforcement action taken.
Critically, enforcement is inline in the gateway: when an agent’s risk crosses the configured threshold, AgentWatch auto-blocks or steps-up that agent before the request reaches the provider — the risky call never leaves your boundary. Enforcement is fail-open (an enforcement-path error does not break legitimate traffic) and returns a distinct refusal message so the caller (and your logs) can tell an Insider-Risk block apart from a DLP block or a provider error.
An actor watchlist lets analysts pin specific agents for heightened scrutiny.
Endpoints
Section titled “Endpoints”All Insider Risk state and actions live under the observability namespace:
/admin/api/observability/insider-risk(sub-resources for indicators, custom ARIs, agent scores, cases, enforcement policy/standings/decisions, and the watchlist), org-scoped and admin-session authenticated like the rest of the Observe Platform.
Step-by-Step: Stand Up Insider Risk Governance
Section titled “Step-by-Step: Stand Up Insider Risk Governance”- Open Observe Platform → Insider Risk.
- Review the built-in ARI library and the current per-agent and org risk scores.
- (Optional) Author custom ARIs for your organization’s sensitive terms — set name, category, threshold, and keyword matcher.
- Configure the adaptive-enforcement policy: set warn / step-up / block thresholds.
- Confirm live standings reflect current agent risk bands.
- Drive (or demo) risky traffic; watch indicators fire, scores move, and — for agents past the block threshold — inline gateway enforcement return the distinct refusal message.
- Triage anything material as a case: assign an owner, review the evidence timeline, and close it out. Pin persistent offenders to the watchlist.
Fail-open by design. If any part of the Insider Risk evaluation or enforcement path errors, traffic is allowed through rather than blocked — governance never becomes an availability risk.