What Agent Guard Detects
Agent Guard focuses on threats that are unique to autonomous, multi-step AI execution.- Plan Deviation: The agent takes actions that are inconsistent with its defined task or the user’s stated intent — for example, an agent tasked with summarizing a document that instead begins sending emails or querying unrelated APIs. Deviations may be the result of a prompt injection attack, a jailbreak embedded in retrieved content, or an emergent reasoning failure.
- Memory Poisoning: An attacker contaminates the agent’s persistent memory store — conversation history, long-term vector memory, or a scratchpad — with malicious content designed to influence the agent’s behavior on future runs. This is a subtle, long-horizon attack that standard input inspection cannot catch because the malicious content enters through a write rather than a user prompt.
- Infinite Loop Detection: The agent enters a resource-consuming execution loop without making meaningful progress toward completing its task. Loops may be caused by adversarial tool responses, ambiguous instructions, or model reasoning failures, and left unchecked they exhaust API budgets and block legitimate work.
How Agent Guard Works
Agent Guard monitors the agent’s full action stream in real time, not just its first input and final output.1
Action Stream Interception
Agent Guard hooks into your agent framework at the execution layer. Every tool call, memory read, memory write, sub-task dispatch, and inter-agent message is routed through Agent Guard before it takes effect.
2
Plan Conformance Check
Each action is compared against the plan scope definition you configured for this agent. Actions that match permitted tool categories and task parameters are approved. Actions that fall outside the defined scope trigger a plan deviation alert.
3
Memory Inspection
Before any content is written to the agent’s persistent memory, Agent Guard scans it for adversarial patterns — embedded instructions, jailbreak payloads, and other content that could manipulate future agent behavior.
4
Loop Detection
Agent Guard tracks the sequence and frequency of tool calls and sub-task executions. If it detects a repeating pattern that is not converging toward task completion, it flags the run and — in Enforcement Mode — terminates the loop and returns a safe fallback.
5
Policy Decision and Logging
For each detected anomaly, Agent Guard issues a policy decision: allow, flag, or block (terminate the agent run). All decisions are recorded in the audit log with the full action trace, enabling post-incident forensics.
Configuring Agent Guard
Enable and configure Agent Guard from the BeyondGuard Control Plane.1
Open Your Project
Navigate to the Control Plane and select the project that manages your agent deployment.
2
Open the Guards Tab
Inside your project, select the Guards tab from the left navigation panel.
3
Enable Agent Guard
Locate Agent Guard in the guard list and toggle it to Enabled.
4
Define Plan Scopes
Click Configure Plan Scopes to open the plan scope editor. Define the tool categories, external services, and action types your agent is permitted to use. See the next section for guidance on writing effective plan scope definitions.
5
Configure Memory Inspection
Under Memory Settings, specify which memory stores Agent Guard should monitor. You can connect vector memory endpoints, conversation history stores, and scratchpad locations. Set the inspection sensitivity for each store independently.
6
Set Loop Detection Thresholds
Under Loop Detection, configure the maximum number of consecutive repetitive actions before Agent Guard intervenes, and the time window over which repetition is evaluated.
7
Choose an Operating Mode
Select Observation Mode to log detections without interrupting agent runs, or Enforcement Mode to actively block deviations and terminate runaway loops.
8
Save and Deploy
Click Save Configuration. Agent Guard begins monitoring all new agent runs immediately.
Plan Scope Definitions
A plan scope definition tells Agent Guard what your agent is supposed to do, so it can recognize when the agent starts doing something it shouldn’t. You define plan scopes in the Control Plane’s scope editor using a combination of permitted tool categories, permitted external domains, maximum step counts, and task intent descriptions.Tool Categories
Specify which categories of tools your agent may call — for example,
read_file, web_search, or send_email. Agent Guard flags any tool call that falls outside these categories.External Domains
Enumerate the external domains or API endpoints your agent is allowed to contact. Calls to unlisted domains are flagged as potential data exfiltration attempts.
Step Budget
Set a maximum number of steps or tool calls for a given task. Runs that exceed the budget are flagged for loop detection review.
Intent Description
Provide a natural-language description of the agent’s intended task. Agent Guard uses this as a semantic reference when evaluating whether actions are consistent with the agent’s purpose.
Agent Guard requires knowledge of the agent’s intended plan to detect deviations accurately. Provide complete plan scope definitions — including tool categories, permitted domains, step budgets, and an intent description — during configuration. Agents deployed without plan scope definitions will still benefit from memory inspection and loop detection, but plan deviation detection accuracy will be significantly reduced.