--- schema_version: "1" id: 3097c6f31a7ee2d0176fe5c175fd38c11c5c8a3de062566c2c6cbb700d92bc44 title: Detect and Contain Rogue Agents collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/general/exp-detect-and-contain-rogue-agents.md canonical_url: https://docs.mulesoft.com/general/exp-detect-and-contain-rogue-agents source_site: docs.mulesoft.com content_type: documentation content_hash: e8ebab707f163fd54e5035b3cb1ee765a2d50910fcf4300e73e7709a5f56fa65 description: MuleSoft Documentation Site latest: true --- --- product: Getting Started keywords: quarantine agent, contain rogue agent, kill switch, agent behavioral drift, tool-call abuse detection, token spend anomaly, flag history, reactivate quarantined agent, unauthorized agent actions, agent security monitoring, model proxy policies, mulesoft --- # Detect and Contain Rogue Agents > For the full documentation index, see: https://docs.mulesoft.com/llms.txt As AI agents take on more autonomous work across your organization, a single compromised, misconfigured, or malfunctioning agent can quickly leak sensitive data, take unauthorized actions, or run up costs before anyone notices. Monitor agent traffic from a single location in the enhanced MuleSoft experience to detect anomalous behavior and contain a rogue agent before it causes damage. > [!NOTE] Detecting and containing rogue agents requires Omni Gateway 1.13.5 or later. Detection and containment rely on two policies that work together. Apply both to each model proxy you want to protect: - **Rogue Agent Detection** policy monitors agent traffic and flags risky behavior for your review. - **Agent Kill Switch** policy blocks a flagged agent’s access to the model proxy when you decide to contain it. Both policies identify an agent from the same JSON Web Token (JWT) claims. The identity that Rogue Agent Detection flags is the identity that Agent Kill Switch blocks. Set the **Agent Identity Selector** to the same value in both policies. Key benefits: - Detect anomalous or unauthorized behavior in real time, using built-in detectors and your own custom rules. - Review flagged activity before you act. Quarantine starts only after you review the flagged activity. - Quarantine a rogue agent instantly to stop data leakage, harmful actions, or runaway costs. Quarantine is fully reversible, so you can undo a false positive in seconds. - Meet compliance requirements. The platform logs every action with full attribution. ## Before You Begin Confirm these prerequisites are in place. - You need these API Manager permissions: - API Creator: Create instances - View APIs Configuration: View instances - Edit APIs Configuration: Edit and manage instances - View API Alerts: View API alerts in a specific environment - Manage API Alerts: Manage API alerts in a specific environment - Register each agent you want to monitor with a unique instance name and ID, and link it to its model proxies. This lets flags, logs, and containment actions target the correct agent. - Set up your agents as service identities in your enterprise identity provider (IdP). Configure the IdP to include each agent’s identifier and the identity of the person the agent is acting for in the tokens it issues. - Apply the [JWT Validation](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation) policy to each model proxy you want to protect. JWT Validation publishes the verified claims that Rogue Agent Detection and Agent Kill Switch use to identify the calling agent. ## Enable Agent Monitoring for a Model Proxy Enable monitoring on each model proxy whose agent traffic you want to track. > [!NOTE] The Rogue Agent Detection policy increases token usage. The policy checks each incoming > prompt against the anomaly detection rules to identify rogue or compromised agent behavior. Each > check uses extra inference calls. 1. Log in to the MuleSoft enhanced experience with an account that has the required permissions. 2. In **Portfolio**, select **Model Proxies**. 3. Select the model proxy you want to monitor. 4. Select **Policies** and then select **+Apply Policy**. 5. Select the **Rogue Agent Detection** policy and click **Next**. 6. Configure the policy settings: 1. In **Agent Identity Selector**, enter a Common Expression Language (CEL) expression that identifies the calling agent from its validated JWT claims, for example, `claims.act.sub`. Use the same selector you configure on the Agent Kill Switch policy so the flagged identity is the one that gets blocked. This field is required. 2. In **User Identifier**, enter a CEL expression that identifies the person the agent is acting for, for example, `claims.email`. This value is recorded for attribution only and does not affect detection. This field is required. 3. Under **Anomalies to Detect**, add at least one rule. For each rule, select an **Anomaly Type** and, optionally, enter a **Detection Prompt**: - **PII Leak** (personally identifiable information), **Privilege Escalation**, and **Prompt Injection** are built-in types with a built-in definition, so a detection prompt is optional. - **Custom** has no built-in definition, so a Custom rule does nothing until you add a detection prompt. > [!NOTE] If you add no rules, the policy forwards every request and detects nothing. 4. In **Deduplication Window (seconds)**, set how long to wait before re-alerting on the same agent, anomaly type, and verdict. The minimum is 60 seconds and the default is 3,600 seconds. This field is required. 5. (Optional) Expand **Advanced Configuration** to customize the **System Evaluation Prompt**. Most deployments don’t need to change this setting. 6. (Optional) Expand **Policy Details** to set: - In **Policy Label**, enter a descriptive name that helps tell this policy apart from other policies in the list. - In **Policy Version**, select the policy template version to apply. - In **Application Conditions**, select **Apply to all requests** or **Apply only to specific resources**. 7. Select **Apply Policy**. Repeat these steps for each model proxy to protect. ## Apply the Agent Kill Switch Policy The Agent Kill Switch policy enforces containment. When you quarantine a flagged agent, this policy blocks that agent’s identity from accessing Model Proxy. Apply it to every model proxy where you want to contain an agent. 1. Log in to the MuleSoft enhanced experience with an account that has the required permissions. 2. In **Portfolio**, select **Model Proxies**, then select the model proxy to protect. 3. Select **Policies** and then select **+Apply Policy**. 4. Select the **Agent Kill Switch** policy and click **Next**. 5. Configure the policy settings: 1. In **Agent Identity Selector**, enter the same CEL expression you used on the Rogue Agent Detection policy, for example, `claims.act.sub`. The selectors must match so that the identity Rogue Agent Detection flags is the identity this policy blocks. This field is required. 2. (Optional) In **Killed Agent IDs**, enter a comma-separated list of agent identifiers to block. Matching is an exact, character-for-character comparison against the value the Agent Identity Selector resolves. Leave this field empty in normal operation. 3. (Optional) Expand **Policy Details** to set a **Policy Label**, **Policy Version**, and **Application Conditions**. 6. Select **Apply Policy**. Repeat these steps for each model proxy to protect. ## Review and Quarantine a Flagged Agent When an agent is flagged, review its activity and quarantine it if needed. Quarantine stops the agent from acting. 1. Log in to the MuleSoft enhanced experience with an account that has the required permissions. 2. Navigate to **Governance** > **Security**. The **Security** page shows flagged and reviewed agents from the last 90 days. 3. Select **Needs Review**, then find the flagged agent. 4. Select **Review** to open the agent’s flag history. 5. Review the timeline of detection events, then select an action: - **Quarantine agent** Stops the agent from acting and blocks its access to any model proxy that uses the Agent Kill Switch policy. Confirm in the window to complete this action. - **Clear flags** Dismisses the flags if the activity was legitimate. Confirm in the window to complete this action. - **Cancel** Closes the view with no changes. The agent stays in the review queue. The audit log records the action with the agent instance ID, the user who performed it, and details such as the timestamp and environment. ## Reactivate a Quarantined Agent After you confirm a quarantined agent is safe to return to service, reactivate it. 1. Log in to the MuleSoft enhanced experience with an account that has the required permissions. 2. Navigate to **Governance** > **Security**. 3. Select **Reviewed** and then find the quarantined agent. 4. Select **Review** to open the agent’s flag history. 5. Select an action: - **Restore Model Access** Returns the agent to service. In the confirmation window, select **Restore Model Access**. - **Close** Closes the view with no changes. The agent stays quarantined. After reactivation, the audit log records the action. ## See Also - [Securing Services in Your Portfolio](https://docs.mulesoft.com/general/exp-securing-services) - [Configuring Notifications for Alerts](https://docs.mulesoft.com/general/exp-alerts-configure-notifications) - [Creating and Managing Instances of Services](https://docs.mulesoft.com/general/exp-instances-add) - [Get Started with the Enhanced Experience](https://docs.mulesoft.com/general/exp-home-start) - [Monitoring Services in Your Portfolio](https://docs.mulesoft.com/general/exp-services-monitoring) - [Managing Costs and Token Usage](https://docs.mulesoft.com/general/exp-governance-view-cost-and-token-usage) - [Controlling LLM Costs in Agent Fabric](https://docs.mulesoft.com/general/af-use-case-cost-management) - [JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation)