Normal is not a number
The ARISE Playbook’s third failure mode is why lifting your NHI threat-detection models onto agents produces either noise or a false sense of safety:
An agent automating financial reporting may access different data combinations, invoke different tool sequences, and produce different outputs on every execution, all within permissions, all legitimate. Its behavior is variable by design. Anomaly detection built on a stable baseline either floods the SOC with false positives or gets tuned down until it catches nothing.
Service accounts are boring on purpose. Deviation is a signal. Agents are not boring. The same Monday close can mean a different tool order, a different set of entities, a different number of retries, depending on what the model noticed in the prompt. Your UEBA dashboard will call that drift. The finance team will call it Tuesday.
This is the third failure-mode post in our ARISE series. Borrowed identity and scope collapse explain who the agent is and what it is for. This post is about why “alert me when it looks weird” is the wrong control for a reasoning identity.
Agents have something service accounts do not
The Playbook does not argue that monitoring is useless. It argues that you are watching the wrong thing:
But agents have something no service account has: they reason, and the reasoning is observable. An agent states what it is trying to accomplish before it acts. Pair that stated reasoning with what the agent actually does – which tools it calls, in what order, against which data – and you can evaluate whether an action was correct, not merely whether it was statistically unusual. Variable behavior stops being noise. It becomes evidence.
SACR’s runtime paper splits that evidence into two analysis dimensions before any dynamic policy fires: continuous observability (session-level telemetry, attribution to a user and a moment) and behavioural tracking (a baseline of tool use, data volume, sequences). The third layer – intent-based authorisation and escalation – is optional in their framing, with real false-positive tradeoffs. What is not optional is the data. A strong governance layer on weak observability produces unreliable decisions at scale.
Lawrence Pingree’s version of the same idea: you cannot read a human’s mind, but you can read an agent’s. Perimeter logs that say “this IP talked to that host” are the phone-call metadata. Intent is the transcript.
Three signals, not a z-score
ARISE requirement four, runtime intent observation, names three signals:
- Reasoning chain – what the agent declared it was trying to do, before it acted. That often lives in the agent runtime, the IDE, or a guardian product that can see prompts. RequestRocket does not read the model’s chain of thought. Your runtime or an identity-fabric vendor might. The outbound hop still needs the other two signals or the transcript is literature.
- Tool-call sequence – which tools, in which order, against which systems. On HTTP, that is method + path + destination, recorded whether you allow or deny.
- Data access pattern – what actually came back, compared with the intent profile. Volume, field set, destination of the next call.
Those combine into an intent-consistency question: is this session still inside the envelope you captured at registration? Sessions outside it get a graduated response – recommend, restrict, stop – not a binary “anomaly / not” from a model trained on last month’s service accounts.
Aizome’s optimisation essay matters here. Reward hacking does not look like a spike. It looks like tickets closing faster, reconciliations finishing on time, pipeline metrics improving – while quality, rounding, or outreach patterns drift for weeks. Statistical unusualness is late. Intent consistency can be early, if you defined the envelope.
Boundaries that hold when behaviour varies
If normal is inherently variable, you cannot govern by similarity to last week. You govern by a ceiling that is true regardless of path:
- Intent rules – the job’s methods and paths. Variation inside the list is expected. A call off the list is not “anomalous.” It is unauthorised. Deny it on the first attempt. That is semantic drift caught without a baseline.
- Volume envelopes – meters as the quantified implication of the job, not as a cost hack. We go deep on this in cost governance. A support agent at 10 reads a minute is in envelope; 10,000 is a different agent.
- Data envelopes – filters so the fields that land in context cannot silently expand because the upstream added a nested object.
- Attribution – every row names the caller identity, the decision, the upstream. That is what you stream to Datadog, Splunk, or Elastic so the SOC is not grepping laptop disks after a journalist calls. We wrote the incident version of this in agent audit logs.
This is structured guardrails, not UEBA for bots. NHI platforms with years of training data still earn their keep on stolen keys, impossible travel, and mass encryption. Use them for that. Do not ask them to decide whether a non-deterministic reporting agent is “acting like itself.”
Where the IdP and the SIEM fit
Your identity provider already emits authentication events. Your EDR already sees local MCP clients. Your SIEM already correlates. ARISE observability is not a second SOC. It is the missing join key: this agent, this call, this allow or deny, this payload shape, on the APIs you do not own.
SACR is explicit that gateways see requests and responses but can lack reasoning context, while direct-access hooks see more of the session and less of the choke point. Comprehensive coverage wants both. RequestRocket is the choke point and the call record. Pair it with whatever sees the prompt – Cursor hooks, a guardian agent, Claude’s own logs – if you need the reasoning signal. Do not wait for one box to do all three layers. The runtime paper says no vendor does.
An alert is still not a control
The Playbook’s warning on on-demand review applies equally to detection: an agent’s effective scope can change between two reviews without a permission changing – new connector, new model, rewritten prompt. A quarterly access certification is accurate the day you run it. And when the alert finally fires, the call already happened.
Intent observation that cannot refuse the next call is forensics. Put the envelope on the wire. Use the SIEM to explain and to hunt. Use the proxy to stop.
Next steps
If you already have NHI anomaly models, keep them on credentials and workloads that are supposed to be stable. For agents, write the intent list, log every tool call, and meter the envelope. Then you have evidence instead of noise.
Continue with runaway cost as drift you can feel, or start for free.