Glossary · Analytics

Agent analytics.

The continuous analysis of AI agent actions, governance decisions, authority, delegation, cost, performance, and outcomes.

Agent Analytics is the continuous analysis of AI agent actions, governance decisions, authority, delegation, cost, performance, and outcomes. Broader than telemetry, narrower than a data lake, and specifically shaped for the behaviour of autonomous AI agents.

What it is

Agent analytics is what turns a stream of governed agent actions into a picture of how the fleet is actually behaving. It composes four signal sources into one attributed surface:

  • SDK and hook signals for semantic intent at the tool-call boundary.
  • Governance decisions from the runtime evaluator: verdict, matched rule, reason codes.
  • OpenTelemetry traces and metrics for latency, error rate, cost.
  • Runtime and OS signals from eBPF, Tetragon, Falco, auditd — independent observation from below the application.

Every analytic row carries attribution: the agent that took the action, the principal that delegated it, the policy that governed it, and the signed evidence that recorded it.

Why it matters

Application observability answers what did the system do? Agent analytics answers a different question: how is the agent behaving as an autonomous actor, and is that behaviour consistent with authority, policy, and intent? The two are not substitutes.

The load-bearing property is correlation. When a chart shows a verdict shift, an operator should be able to drill into the specific invocations that produced it and read the signed evidence for each one. Descriptive telemetry cannot do that; governed analytics can.

The one-line distinction. Observability tells you what the system did. Agent analytics tells you what the agent did, under what authority, at what cost — with signed evidence attached to every row.

What it enables

Seven analytic surfaces show up in production:

  • Verdict distributions across allow / deny / redact / throttle / flag-for-review.
  • Policy hit-frequency — which rules are firing, which are dead weight.
  • Delegation-graph drift — new edges overnight, chain depth growing without cause.
  • Behavioural anomalies — agents calling tools they have never called before.
  • Cost + burn rate per agent, tenant, cost centre, provider, model.
  • Latency + performance per-agent p50 / p95 / p99, regression detection.
  • Revocation + containment — how fast the cascade closed, how many actions were denied post-revoke.

Because the four signal sources feed one attributed surface, security, platform, governance, FinOps, and audit all read the same underlying rows through the view that fits their persona.

Related