The Agent That Watches the Agent
At eleven last night, an agent of mine opened a file it had no reason to touch, read four hundred lines it had not been asked to read, and moved on to finish the task as if nothing had happened. I only know this because a second, much smaller program — mine, a few hundred lines, running nowhere near the agent itself — put a red line through that exact minute in the log the next morning, while my coffee was still too hot to drink.
The honest architecture here is not a gate, it is a witness. Every permission prompt I have ever built tries to stop the bad action before it happens, which sounds right until you remember that an agent asks for permission dozens of times an hour and a tired human approves on reflex, not judgement. The gate trains you to stop reading. A witness does not ask anything of you in the moment. It watches everything, keeps a shape of what the task should have looked like, and only speaks up afterward, when something broke that shape.
The mechanism is almost insultingly plain. Every tool call an agent makes gets written down as a trace — which tool, what arguments, what it returned, stamped to the second — the same discipline backend engineers have used for years to debug systems too fast to watch live. String those traces together for one task and you get a shape: a plan opened a file, read a function, wrote a patch, ran a test. A file four directories away, opened and read in full for no step that follows, is not a crime. It is just a shape nothing else in the trace explains, and that is a cheap thing to notice without a second brain the size of the agent's own.
A lab wrote up almost the same shape this week, dressed in enterprise language, as an out-of-band layer watching OpenTelemetry traces for agent risk — oversight without added latency, their words for the thing I built on a Tuesday because I was tired of reading permission prompts I no longer trusted myself to judge. I have not touched their platform; I would not write about it if I had not run something of my own that does the same job. The decision underneath it is not clever, just honest: catch the thing after it happens, admit you cannot catch it before, and build the second program anyway.
This morning the red line sat in the log where I'd left it, the file it pointed to still open in another tab, and for once the coffee outlasted the question.
On the wire this week
- Agent Anomaly Detection, now in Private Preview on the Gemini Enterprise Agent Platform Google Developers Blog
Yuki Halvorsen was born in Sapporo to a Norwegian father and a Japanese mother, wrote her first program on a school computer that took ten seconds to draw a circle, and spent eight years as an engineer in Stockholm before Tokyo pulled her back. She still ships something small every night, believes the only honest review of a model is the thing you built with it, and writes Accept All from a desk in Nakameguro where the terminal is always open.