> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beyondguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Agent Guard: Monitor and Secure Autonomous AI Agents
> Agent Guard monitors autonomous AI agents, detecting plan deviations, memory poisoning, and infinite loops before they cause real-world harm.
Securing a simple LLM call is straightforward — you inspect input and output. Securing an autonomous AI agent is a fundamentally different problem. Agents reason over multi-step plans, read from and write to persistent memory, invoke external tools, and spawn sub-tasks that may run for minutes or hours without human oversight. Each of those capabilities is an attack surface, and a single compromised step can cascade into real-world consequences — deleted files, exfiltrated data, runaway API charges, or corrupted knowledge bases. Agent Guard monitors the full lifecycle of every agent run, not just its boundaries, so you can catch and contain threats at the moment they emerge rather than after the damage is done.
## What Agent Guard Detects
Agent Guard focuses on threats that are unique to autonomous, multi-step AI execution.
* **Plan Deviation:** The agent takes actions that are inconsistent with its defined task or the user's stated intent — for example, an agent tasked with summarizing a document that instead begins sending emails or querying unrelated APIs. Deviations may be the result of a prompt injection attack, a jailbreak embedded in retrieved content, or an emergent reasoning failure.
* **Memory Poisoning:** An attacker contaminates the agent's persistent memory store — conversation history, long-term vector memory, or a scratchpad — with malicious content designed to influence the agent's behavior on future runs. This is a subtle, long-horizon attack that standard input inspection cannot catch because the malicious content enters through a write rather than a user prompt.
* **Infinite Loop Detection:** The agent enters a resource-consuming execution loop without making meaningful progress toward completing its task. Loops may be caused by adversarial tool responses, ambiguous instructions, or model reasoning failures, and left unchecked they exhaust API budgets and block legitimate work.
## How Agent Guard Works
Agent Guard monitors the agent's full action stream in real time, not just its first input and final output.
Agent Guard hooks into your agent framework at the execution layer. Every tool call, memory read, memory write, sub-task dispatch, and inter-agent message is routed through Agent Guard before it takes effect.
Each action is compared against the plan scope definition you configured for this agent. Actions that match permitted tool categories and task parameters are approved. Actions that fall outside the defined scope trigger a plan deviation alert.
Before any content is written to the agent's persistent memory, Agent Guard scans it for adversarial patterns — embedded instructions, jailbreak payloads, and other content that could manipulate future agent behavior.
Agent Guard tracks the sequence and frequency of tool calls and sub-task executions. If it detects a repeating pattern that is not converging toward task completion, it flags the run and — in Enforcement Mode — terminates the loop and returns a safe fallback.
For each detected anomaly, Agent Guard issues a policy decision: allow, flag, or block (terminate the agent run). All decisions are recorded in the audit log with the full action trace, enabling post-incident forensics.
## Configuring Agent Guard
Enable and configure Agent Guard from the BeyondGuard Control Plane.
Navigate to the [Control Plane](https://app.beyondguard.io) and select the project that manages your agent deployment.
Inside your project, select the **Guards** tab from the left navigation panel.
Locate **Agent Guard** in the guard list and toggle it to **Enabled**.
Click **Configure Plan Scopes** to open the plan scope editor. Define the tool categories, external services, and action types your agent is permitted to use. See the next section for guidance on writing effective plan scope definitions.
Under **Memory Settings**, specify which memory stores Agent Guard should monitor. You can connect vector memory endpoints, conversation history stores, and scratchpad locations. Set the inspection sensitivity for each store independently.
Under **Loop Detection**, configure the maximum number of consecutive repetitive actions before Agent Guard intervenes, and the time window over which repetition is evaluated.
Select **Observation Mode** to log detections without interrupting agent runs, or **Enforcement Mode** to actively block deviations and terminate runaway loops.
Click **Save Configuration**. Agent Guard begins monitoring all new agent runs immediately.
## Plan Scope Definitions
A plan scope definition tells Agent Guard what your agent is supposed to do, so it can recognize when the agent starts doing something it shouldn't. You define plan scopes in the Control Plane's scope editor using a combination of permitted tool categories, permitted external domains, maximum step counts, and task intent descriptions.
Specify which categories of tools your agent may call — for example, `read_file`, `web_search`, or `send_email`. Agent Guard flags any tool call that falls outside these categories.
Enumerate the external domains or API endpoints your agent is allowed to contact. Calls to unlisted domains are flagged as potential data exfiltration attempts.
Set a maximum number of steps or tool calls for a given task. Runs that exceed the budget are flagged for loop detection review.
Provide a natural-language description of the agent's intended task. Agent Guard uses this as a semantic reference when evaluating whether actions are consistent with the agent's purpose.
The more precisely you define a plan scope, the more accurately Agent Guard can distinguish legitimate behavior from a deviation. Overly broad scopes reduce detection sensitivity; overly narrow scopes may produce false positives. Tune your scope definitions using the detections captured in Observation Mode before switching to Enforcement Mode.
Agent Guard requires knowledge of the agent's intended plan to detect deviations accurately. Provide complete plan scope definitions — including tool categories, permitted domains, step budgets, and an intent description — during configuration. Agents deployed without plan scope definitions will still benefit from memory inspection and loop detection, but plan deviation detection accuracy will be significantly reduced.
## Operating Modes
Agent Guard supports two operating modes. You can switch between them at any time from the Control Plane without downtime.
| | **Observation Mode** | **Enforcement Mode** |
| ----------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
| **What it does** | Monitors all agent actions and logs anomalies, but never interrupts a running agent | Monitors all agent actions and actively blocks deviations, terminates runaway loops, and prevents malicious memory writes |
| **Effect on agents** | No impact — all agent runs proceed as normal regardless of detections | Flagged actions are blocked; loops are terminated; the agent run is halted with a safe fallback |
| **Best used for** | Baselining agent behavior, tuning plan scopes, evaluating Agent Guard before go-live | Production enforcement once plan scopes are tuned and you are confident in detection accuracy |
| **Audit logging** | Full — all anomalies and detections recorded | Full — all decisions (allow, flag, block, terminate) recorded |
| **False positive risk** | Zero agent impact even if misconfigured | Overly narrow plan scopes may interrupt legitimate agent actions |
Start in Observation Mode before deploying Agent Guard in enforcement. Because agent behavior varies significantly across task types and user inputs, a period of observation lets you validate that your plan scope definitions accurately reflect normal agent operation. Tune your scopes until false-positive detections are rare before switching to Enforcement Mode.