v0.9.0 — Playbook 11: Monitoring That Truly Detects Agent Incidents

PB11 ships the detection layer. EDR was built for malware, anomalous process trees, and lateral movement. AI agents act through authorized channels, sanctioned APIs, and valid OAuth grants. To the SIEM, an AI agent incident looks like a service account doing its job. The most common failure mode in AI-augmented environments is authorized misuse that traditional tools cannot flag.