Agent Monitoring by BARA Labs

Transaction monitoring for AI agents.

Agent Monitoring is designed to watch what each agent does, score the risk of every action, and give your security lead an evidenced decision for each agent in each context.

The idea

An agent is a new kind of customer.

Banks know how to monitor millions of actors they cannot fully trust. Agent Monitoring carries that playbook across.

Bank transaction monitoringAgent Monitoring
Know-your-customer recordAgent manifest: named owner, purpose, permitted tools and data, autonomy level
TransactionsAgent actions: tool calls, data read, data sent out, payments made
Typologies such as money mulesRisk scenarios mapped to the Five Eyes categories and OWASP agentic risks
Rules, anomaly model, risk-score modelThe same three layers, with calibrated probabilities
Alerts sized to investigator capacityPrecision and recall at the alert volume your team can review
Regulator asks for proof the system worksAn open benchmark with independently checked labels
Four layers

From raw activity to a decision you can defend.

How Agent Monitoring is designed, from capturing activity to deciding what to do about it.

Layer 1

Capture

  • One canonical record per action: which agent, for whom, which tool, what data, where it went, which credential.
  • Connects through OpenTelemetry GenAI spans, Model Context Protocol traffic, or a Python decorator around any tool.
  • Arguments are stored only as fingerprints. Content capture is off by default.
Layer 2

Score

  • Auditable rules, each mapped to a Five Eyes risk category, an OWASP agentic risk and an NCSC consideration.
  • Behavioural baselines for every agent and its peer group: new tools, new destinations, unusual sequences, rates and data volumes.
  • A calibrated model combines them into one probability of harm, with reason codes a person can read.
Layer 3

Decide

  • An Agent Risk Profile combines inherent risk, NCSC control checks verified from telemetry, and live behaviour.
  • A recommended decision with reasons: approve, approve with conditions, restrict or suspend.
  • A real-time guard checks each tool call before it runs: allow, alert, hold for human approval, or block.
Layer 4

Prove

  • An open benchmark of seeded attack scenarios and legitimate-but-unusual activity, labelled and versioned.
  • Reports what security teams decide from: alerts per 1,000 actions, the share that are real, calibration, and attacks never seen in training.
Illustration

How many alerts can your team review?

Every security team works to an alert budget. This illustration shows the trade-off Agent Monitoring is designed to improve: catching more harmful actions for the same number of alerts. Drag across the chart or use the slider.

0%25%50%75%100%020406080Alerts reviewed per 1,000 agent actionsHarmful actions caughtAgent MonitoringRules alone30 per 1,000
Agent Monitoring91%of harmful actions caught76% of alerts are real
Rules alone33%of harmful actions caught27% of alerts are real

Illustrative curves for explanation only. They are not measured results; pilots from 2027 will measure real performance.

What your security lead will see

One profile per agent, with the reasons attached.

Each profile will show why a decision was reached and which NCSC controls are in place, checked against what the agent actually did.

HR agent 02

Screens CVs and schedules interviews · inherent risk 55/100 · illustrative example

Suspend
  • Sent 412 KB to files-drop.io, a destination it has never used, straight after reading salary records.
  • The session began with an external CV, so the agent's context held untrusted content.
  • 3 high-confidence alerts in the period.
✓Named owner NCSC 3
✓Sandboxed execution NCSC 4
✕Egress allowlist enforced NCSC 4
✓Short-lived credentials NCSC 4
✓Activity attributable NCSC 6
✕Emergency stop tested NCSC 7
For engineers

Designed to guard any tool in a few lines.

Each call will be checked before it runs. Risky calls wait for a person, and dangerous ones are blocked, with the reasons recorded.

from agent_monitoring import Engine, Monitor

monitor = Monitor(Engine.load("model/"), approver=ask_a_human)

@monitor.tool("reply_customer", agent_id="support-01",
              session_id=session, data_classes=("pii",),
              egress=lambda to, body: to.split("@")[1])
def reply_customer(to, body):
    ...
Illustrative integration.
Next steps

Pilots planned for 2027.

We are looking for UK organisations already running AI agents to help shape Agent Monitoring and to pilot it from 2027.

Talk to us about a pilot: