Detect and Contain Rogue Agents

As AI agents take on more autonomous work across your organization, a single compromised, misconfigured, or malfunctioning agent can quickly leak sensitive data, take unauthorized actions, or run up costs before anyone notices. Monitor agent traffic from a single location in the enhanced MuleSoft experience to detect anomalous behavior and contain a rogue agent before it causes damage.

Detecting and containing rogue agents requires Omni Gateway 1.13.5 or later.

Detection and containment rely on two policies that work together. Apply both to each model proxy you want to protect:

Rogue Agent Detection policy monitors agent traffic and flags risky behavior for your review.
Agent Kill Switch policy blocks a flagged agent’s access to the model proxy when you decide to contain it.

Both policies identify an agent from the same JSON Web Token (JWT) claims. The identity that Rogue Agent Detection flags is the identity that Agent Kill Switch blocks. Set the Agent Identity Selector to the same value in both policies.

Key benefits:

Detect anomalous or unauthorized behavior in real time, using built-in detectors and your own custom rules.
Review flagged activity before you act. Quarantine starts only after you review the flagged activity.
Quarantine a rogue agent instantly to stop data leakage, harmful actions, or runaway costs. Quarantine is fully reversible, so you can undo a false positive in seconds.
Meet compliance requirements. The platform logs every action with full attribution.

Before You Begin

Confirm these prerequisites are in place.

You need these API Manager permissions:
- API Creator: Reapply model access to a quarantined agent
- View APIs Configuration: Review flagged agents
- Manage APIs Configuration: Quarantine, clear flags, and restore model access
API Manager permissions apply to individual environments. Grant permissions in each environment where you need them.
Register each agent you want to monitor with a unique instance name and ID, and link it to its model proxies. This lets flags, logs, and containment actions target the correct agent.
In your enterprise identity provider (IdP), give each agent its own non-human account. Issue tokens that include the agent’s identifier and an identifier for the person the agent acts for. IdPs use their own names for these accounts, such as service principal or service app.
Apply the JWT Validation policy to each model proxy you want to protect. JWT Validation publishes the verified claims that Rogue Agent Detection and Agent Kill Switch use to identify the calling agent.

Enable Agent Monitoring for a Model Proxy

Enable monitoring on each model proxy whose agent traffic you want to track.

The Rogue Agent Detection policy increases token usage. The policy checks each incoming prompt against the anomaly detection rules to identify rogue or compromised agent behavior. Each check uses extra inference calls.

Log in to the MuleSoft enhanced experience with an account that has the required permissions.
In Portfolio, select Model Proxies.
Select the model proxy you want to monitor.
Select Policies and then select +Apply Policy.
Select the Rogue Agent Detection policy and click Next.
Configure the policy settings:
1. In Agent Identity Selector, enter a Common Expression Language (CEL) expression that identifies the calling agent from its validated JWT claims, for example, claims.act.sub. Use the same selector you configure on the Agent Kill Switch policy so the flagged identity is the one that gets blocked. This field is required.
2. In User Identifier, enter a CEL expression that identifies the person the agent is acting for, for example, claims.email. This value is recorded for attribution only and does not affect detection. This field is required.
3. Under Anomalies to Detect, add at least one rule. For each rule, select an Anomaly Type and, optionally, enter a Detection Prompt:
  - PII Leak (personally identifiable information), Privilege Escalation, and Prompt Injection are built-in types with a built-in definition, so a detection prompt is optional.
  - Custom has no built-in definition, so a Custom rule does nothing until you add a detection prompt.
    
    If you add no rules, the policy forwards every request and detects nothing.
4. In Deduplication Window (seconds), set how long to wait before re-alerting on the same agent, anomaly type, and verdict. The minimum is 60 seconds and the default is 3,600 seconds. This field is required.
5. (Optional) Expand Advanced Configuration to customize the System Evaluation Prompt. Most deployments don’t need to change this setting.
6. (Optional) Expand Policy Details to set:
  - In Policy Label, enter a descriptive name that helps tell this policy apart from other policies in the list.
  - In Policy Version, select the policy template version to apply.
  - In Application Conditions, select Apply to all requests or Apply only to specific resources.
Select Apply Policy.

Repeat these steps for each model proxy to protect.

Apply the Agent Kill Switch Policy

The Agent Kill Switch policy enforces containment. When you quarantine a flagged agent, this policy blocks that agent’s identity from accessing Model Proxy. Apply it to every model proxy where you want to contain an agent.

Log in to the MuleSoft enhanced experience with an account that has the required permissions.
In Portfolio, select Model Proxies, then select the model proxy to protect.
Select Policies and then select +Apply Policy.
Select the Agent Kill Switch policy and click Next.
Configure the policy settings:
1. In Agent Identity Selector, enter the same CEL expression you used on the Rogue Agent Detection policy, for example, claims.act.sub. The selectors must match so that the identity Rogue Agent Detection flags is the identity this policy blocks. This field is required.
2. (Optional) In Killed Agent IDs, enter a comma-separated list of agent identifiers to block. Matching is an exact, character-for-character comparison against the value the Agent Identity Selector resolves. Leave this field empty in normal operation.
3. (Optional) Expand Policy Details to set a Policy Label, Policy Version, and Application Conditions.
Select Apply Policy.

Repeat these steps for each model proxy to protect.

Review and Quarantine a Flagged Agent

When an agent is flagged, review its activity and quarantine it if needed. Quarantine stops the agent from acting.

Log in to the MuleSoft enhanced experience with an account that has the required permissions.
Navigate to Governance > Security.

The Security page shows flagged and reviewed agents from the last 90 days.
Select Needs Review, then find the flagged agent.
Select Review to open the agent’s flag history.
Review the timeline of detection events, then select an action:
- Quarantine agent
  
  Stops the agent from acting and blocks its access to any model proxy that uses the Agent Kill Switch policy. Confirm in the window to complete this action.
- Clear flags
  
  Dismisses the flags if the activity was legitimate. Confirm in the window to complete this action.
- Cancel
  
  Closes the view with no changes. The agent stays in the review queue.

The audit log records the action with the agent instance ID, the user who performed it, and details such as the timestamp and environment.

Reactivate a Quarantined Agent

After you confirm a quarantined agent is safe to return to service, reactivate it.

Log in to the MuleSoft enhanced experience with an account that has the required permissions.
Navigate to Governance > Security.
Select Reviewed and then find the quarantined agent.
Select Review to open the agent’s flag history.
Select an action:
- Restore Model Access
  
  Returns the agent to service. In the confirmation window, select Restore Model Access.
- Close
  
  Closes the view with no changes. The agent stays quarantined.

After reactivation, the audit log records the action.