Per-call authorization stops an agent from doing what it is not allowed to do. The harder case is an agent doing a series of things it is allowed to do, in an order that adds up to an attack. Here are three patterns Sentinel NHI watches for, and why each needs context beyond a single call.
1. Untrusted input, then a private read, then egress
A research agent reads a customer email. It then looks up customer records, which it is allowed to do. Then it posts a report to an external URL, which it is also allowed to do. Each step passes authorization.
Together they are the classic exfiltration chain for agents: something untrusted told the agent to collect private data and send it out. Sentinel records what each session ingested (tool results relayed through its MCP proxy, and context the agent reports, marked trusted or untrusted) and links it to every later decision. When a session shows untrusted input, then a private read, then egress, Sentinel raises a critical detection with the full chain as evidence, even though every step was allowed.
Provenance turns "was this call allowed?" into "why did the agent make it?"
2. Honey tokens: values nobody legitimate should use
Some signals are unambiguous. Sentinel can plant decoys: an API key in a repository's example file, a payroll account number on a wiki page, a decoy tool in a server's catalog, a link, a set of agent credentials. No legitimate workflow uses them.
If an agent's call contains a planted value, the call is denied, the agent is contained pending review, and a critical alert is raised. Canary keys never authenticate. Because the signal is so clear, it can act automatically without risking false alarms on normal work.
3. The agent that keeps trying
One denial is normal; agents explore. Six denials in a few minutes from a high-risk agent is different: either it is broken, or it is probing. Sentinel aggregates repeated denials per identity and window into one alert with the full list of attempts, targets and reasons, rather than a flood of individual events. For high-risk agents it proposes pausing the agent; an approver confirms with one click.
Beyond these three
Sentinel also learns each agent's normal workflow and watches for bursts that move through kill-chain stages, credential harvesting, enumeration followed by access outside the agent's workspace, changes to audit and logging infrastructure, and new agents, jobs or compute that were never declared. Detections carry MITRE ATT&CK technique tags.
Measured, including what we miss
We evaluate these rules against a library of synthetic attack and benign scenarios and report detection and false-positive rates with exact confidence bounds. Some attack variants are designed to evade the rules, so the published rates show where the gaps are. New rules can run in shadow mode first: they log what they would have blocked, so you can read the report before enforcing anything.
See how monitoring fits the platform, or watch an attack being caught live.