Vortalis continuously monitors agent behaviour and flags anomalies using multiple detection engines:
- Behavioural baselines: the system learns normal patterns for each agent and flags deviations (unusual access times, new data types, volume spikes)
- Rate anomalies: sudden increases in request frequency
- Scope anomalies: agents accessing resources outside their normal scope
- Temporal anomalies: activity at unusual times
- Data access patterns: unusual patterns in the type or volume of data being accessed
Severity levels:
- Low: informational, logged for review
- Medium: flagged for attention, may trigger alerts
- High: requires immediate review, may auto-throttle the agent
- Critical: auto-suspends the agent pending investigation