Platform · Agent Analytics

See every decision,
every dollar,
every delegation.

All governance-grade.

Real-time analytics of every governed AI agent action — with attribution and signed evidence attached. Understand how your agents are actually behaving, what they cost, and whether the governance you shipped is doing what you shipped it to do.

One surface for security, platform, governance, FinOps, and audit.

Why Agent Analytics

The questions observability wasn’t built to answer.

You have watched an AI agent run in production and wondered which of your instincts are actually true. Is it drifting toward tools you did not authorise? Is one team’s agent burning ten times another’s for the same work? Is a policy you shipped last quarter catching anything, or is it dead weight?

Application observability was not built to answer these questions. Neither was model-eval tooling. Agents are autonomous actors with delegated authority. Their behaviour has to be analysed against the policy, cost, and evidence context they operate in.

The four disciplines, distinguished

Four verbs. One surface.

Analytics that only produces charts is a nicer dashboard. Analytics that produces action is the point. Veldt owns runtime governance and evidence natively — Agent Analytics is what those two disciplines make possible when composed with operational telemetry.

Observability

What is the agent doing?

Traces, spans, latencies, error stacks. Descriptive. Emitted after the action ran.

Analytics

What patterns are emerging?

Verdict distributions, delegation drift, behavioural anomalies, cost trends. Governance-grade.

Runtime governance

Should this action be allowed?

Every proposed action gets a verdict at the perimeter, in sub-50ms. Enforcement, not reporting.

Evidence

Can we prove what happened and why?

Signed, hash-chained, tamper-evident record of every verdict and its reasoning. Auditor-ready.

What you can analyse today

Seven analytic surfaces, attribution attached to every row.

Verdict distributions

Shift is the first signal

Allowed, denied, redacted, throttled, flagged. A shift in the distribution is often the first sign that something changed — policy, agent, or upstream data.

Policy hit-frequency

Live rules vs dead weight

Which rules are firing, which are dormant. Dead-rule reports for policy hygiene. Prune stale rules with confidence.

Delegation drift

Authority graph anomalies

New delegation edges appearing overnight. Chain depth growing without cause. Insider-threat and misconfiguration signals.

Behavioural anomalies

Tools they’ve never called

Agents calling tools they have never called before. Rate spikes outside their normal band. Cross-tenant boundary attempts.

Cost + burn rate

Governance-grade FinOps

Spend per agent, per tenant, per cost centre, per model. Burn-rate trends. Breach forecasts. Cost tied directly to the signed audit-trail row that produced it.

Latency + performance

Per-agent p50 / p95 / p99

Regressions after a deploy. Slow tools that drag the fleet. Latency budgets that need to be tightened.

Revocation + containment

How fast the cascade closed

How quickly cascades complete. How many actions were denied post-revoke as proof the containment held.

Cost governance, not just cost visibility

Traditional FinOps tells you what an agent spent.
Agent Analytics makes cost part of what the agent is allowed to do next.

Traditional FinOps tools tell you what an agent spent after the fact. Useful for review meetings, useless for stopping the current run. Agent Analytics does more, because governance decisions and spend events flow through the same evidence layer. Budget state becomes policy context.

Deny

Wire-transfer actions when the tenant’s budget consumption exceeds 90%.

Throttle

Any agent whose burn rate over the last hour exceeds three times its trailing daily average.

Escalate

Human review required when a cost centre hits its monthly cap.

Out of the box
  • Cost by provider, cost centre, business unit, environment, model
  • Cost over time (hourly / daily / weekly)
  • Top-cost agents
  • Cost of failure (money spent on non-success outcomes)
  • Cache efficiency
  • Cost per invocation, tied to signed evidence
  • One-shot attribution summary
The signals it consumes

Four signal types, one analytic surface.

SDK + hook signals

Semantic intent

Carry the agent’s intent at the tool-call boundary. Verdicts can be gated there before the action leaves the SDK.

Governance decisions

Verdict + reasons

Outputs from the runtime evaluator: verdict, matched rule, evaluator, reason codes. The load-bearing analytic input.

OpenTelemetry

Latency, error, cost

Standard traces and metrics for latency, error rate, cost, downstream service calls. Composed with the governance layer.

Runtime + OS

eBPF, Tetragon, Falco, auditd

Independent observation from below the application. Catches what the SDK cannot see.

Who it is for

One surface, many audiences.

Same underlying attribution, different views of it. What each team gets from the analytic layer:

Security teams

Anomalies, boundaries, containment

Anomaly detection, cross-tenant boundary attempts, insider-threat signals from delegation drift, containment reports.

AI platform teams

Cost, latency, cache, capacity

Cost per agent, latency by tool, cache efficiency, fleet capacity planning, regression detection.

Governance + compliance

Verdicts, rules, coverage

Verdict distributions, policy hit-frequency, evidence coverage, per-regime rollups (SOC 2, EU AI Act, HIPAA).

FinOps

Attribution + breach forecasts

Cost attribution, budget-breach forecasts, top-cost lists, cost-of-failure to justify quality investments.

Audit + IR

Signed reconstruction

Reconstruct exactly what happened during any window, tied to signed evidence. Every claim independently verifiable.

Why it belongs on the governance layer

Analytics that produces action, not just charts.

Signals surfaced by Agent Analytics feed back into the policy layer as attributes, into the operator UI as review queues, and into automated response paths (throttle, revoke, contain). The loop from signal to action is what makes the discipline governance-grade rather than reporting-grade.

That loop only closes if the same system holds the enforcement layer, the evidence chain, and the analytics surface.

Analytics stacks bolted on top of a separate governance system produce nice reports and slow decisions. When enforcement, evidence, and analytics share one substrate, cost becomes policy context, delegation drift becomes an alert, and containment becomes a first-class analytic. Veldt runs all three on one runtime.

Run this against your traffic.

Thirty minutes: cost governance, verdict analytics, delegation-graph drift on live agent traffic.

Book a demo → Get started →