1. Introduction: Why Anomaly Detection Is Existential for Agentic Companies
The promise of agentic companies — organizations where AI agents autonomously execute business processes under governance constraints — rests on a critical assumption: that deviations from expected behavior will be detected and corrected before they cause irreversible damage. This assumption is not automatically satisfied. An autonomous agent authorized to execute procurement decisions can, if its policy drifts or its reward signal is corrupted, approve purchases that systematically benefit a specific vendor. An agent managing customer communications can, if its language model hallucinated, send messages that violate regulatory requirements. An agent optimizing resource allocation can, if its objective function has an edge case, concentrate all resources in a single zone, starving others.
These are not hypothetical scenarios. Every complex system produces deviations. The second law of thermodynamics guarantees that entropy increases in closed systems; the organizational equivalent is that behavioral drift is the default trajectory for any sufficiently complex multi-agent system. The question is not whether deviations will occur, but whether they will be detected before they cascade into system-wide failure.
Traditional software monitoring — log aggregation, threshold-based alerts, rule-based anomaly detection — is insufficient for agentic companies. Rule-based systems can only detect anomalies that were anticipated at design time, but the behavioral space of autonomous agents is vast and the most dangerous anomalies are precisely those that were not anticipated. Statistical threshold monitoring can detect agents that exceed predefined limits, but it cannot detect agents that operate within nominal ranges while exhibiting subtle correlational anomalies — for example, an agent that processes transactions at normal speed and volume but systematically routes high-value transactions to a specific downstream agent.
What is needed is a learned anomaly detection system that can model the complex, high-dimensional distribution of normal agent behavior and flag deviations from this distribution regardless of whether the specific type of deviation was anticipated. This paper presents two such methods — Isolation Forest and Autoencoder-based reconstruction error — and shows how their combination provides a robust safety layer for agentic companies.
The economic consequences of undetected anomalies are severe and well-documented in analogous domains. In traditional financial services, a single rogue trader at Societe Generale caused 4.9 billion euros in losses over a period during which automated monitoring systems failed to flag increasingly anomalous trading patterns. In software engineering, a single misconfigured load balancer at Amazon Web Services caused a cascading outage affecting hundreds of dependent services. In autonomous vehicle development, edge-case failures in perception systems have caused accidents despite millions of miles of normal operation. Each of these failures shares a common pattern: an anomalous condition that was outside the design envelope of the monitoring system propagated through tightly coupled systems until it caused catastrophic damage. Agentic companies face the same risk at organizational scale.
The challenge of anomaly detection in agentic companies is compounded by the fact that agents are adaptive. Unlike static software systems where anomalies arise from bugs or configuration errors, agentic anomalies can arise from learned behavior that drifts over time as agents optimize their policies. An agent that discovers a reward signal loophole will gradually shift its behavior toward exploiting the loophole, producing a slow drift that is much harder to detect than a sudden deviation. This adaptive anomaly generation requires detection methods that can identify not just point anomalies (sudden deviations) but collective anomalies (gradual drifts) and structural anomalies (changes in inter-agent relationships).
1.1 The Safety Layer in the Algorithm Stack
In the 7-layer algorithm stack for agentic organizations, the Safety Layer (Layer 7) occupies the outermost position, wrapping all other layers in a continuous monitoring envelope. Its relationship to the other layers is as follows: | Layer | Algorithm | Safety Layer Interaction | |---|---|---| | 1. Cognition | Transformer | Monitors LLM outputs for hallucination, toxicity, policy violation | | 2. Decision | Gradient Boosting | Monitors predictions for distributional shift, confidence collapse | | 3. Structure | GNN | Monitors graph topology for anomalous edge formation, node isolation | | 4. Control | RL/Actor-Critic | Monitors policy updates for reward hacking, objective misalignment | | 5. Exploration | Multi-Armed Bandit | Monitors exploration for stuck arms, exploitation traps | | 6. Abstraction | PCA | Monitors dimensionality reduction for information loss spikes | | 7. Safety | Isolation Forest + Autoencoder | Self-monitors for detector degradation, concept drift |
The Safety Layer receives telemetry from all other layers and produces anomaly scores that are fed to the MARIA OS governance engine. When anomaly scores exceed calibrated thresholds, the governance engine triggers proportional responses ranging from logging (observe) to throttling (reduce agent autonomy) to freezing (suspend agent operations pending human review).
1.2 Paper Organization
Section 2 formalizes the anomaly detection problem in the agentic context. Section 3 presents Isolation Forest adapted to organizational behavior monitoring. Section 4 presents Autoencoder-based detection with learned normal behavior manifolds. Section 5 derives the combined detection method. Section 6 addresses threshold calibration for enterprise risk. Section 7 presents the anomaly-throttle-freeze cascade. Section 8 describes the real-time streaming architecture. Section 9 formalizes the MARIA OS stability guard. Section 10 addresses false positive management. Section 11 presents experimental results. Section 12 discusses adversarial robustness. Section 13 concludes.
2. Formalizing the Anomaly Detection Problem
2.1 The Semi-Supervised Anomaly Setting
Anomaly detection in enterprise contexts operates in a semi-supervised setting: we have abundant examples of normal behavior (collected from the organization's operational history) but very few examples of anomalous behavior (anomalies are rare events by definition, and the specific forms of future anomalies are unknown). This asymmetry fundamentally shapes the choice of detection methods. Supervised classification is impractical because the anomaly class is too diverse and too sparse to model directly. Fully unsupervised methods (detecting any statistical outlier) produce too many false positives because statistical outliers are common in high-dimensional behavioral spaces and most are benign. The optimal approach is semi-supervised: learn a detailed model of normal behavior from abundant normal examples, and flag any observation that deviates significantly from the learned normal model. Both Isolation Forest and Autoencoders operate in this semi-supervised paradigm.
2.2 Agent Behavioral Space
Let each agent $a_i$ produce a behavioral observation vector $\mathbf{x}_i(t) \in \mathbb{R}^d$ at each time step $t$. This vector is the same feature vector used in the Abstraction Layer (Section 6 of the algorithm stack paper) and includes task profiles, communication patterns, performance metrics, and governance compliance indicators. The behavioral space is the union of all possible observation vectors: $\mathcal{X} = \mathbb{R}^d$.
2.2 通常の動作の分布
通常の動作を、動作空間上の確率分布 $P_{\text{normal}}(\mathbf{x})$ としてモデル化します。エージェントの観察 $\mathbf{x}_i(t)$ が $P_{\text{normal}}$ から生成された場合は正常であり、他の分布 $P_{\text{anomaly}}$ から生成された場合は異常です。正式には、異常検出問題は二項仮説検定です。 $$ H_0: \mathbf{x}_i(t) \sim P_{\text{正常}} \quad \text{vs.} \quad H_1: \mathbf{x}_i(t) \sim P_{\text{異常}} $$ 課題は、$P_{\text{normal}}$ は未知でありデータから学習する必要があるのに対し、$P_{\text{anomaly}}$ は未知であるだけでなく認識できないことです。異常は無限に多様な形をとる可能性があり、最も危険なものはこれまでに見たことのないものです。この非対称性により、教師あり分類が排除され、正規性を列挙するのではなく特徴づけることを学習する教師なしまたは半教師ありのアプローチが義務付けられます。異常なタイプ。
The challenge is made more precise by noting that $P_{\text{anomaly}}$ encompasses infinitely many possible anomaly distributions, each representing a different type of deviation. A reward-hacking anomaly produces a different distribution than a communication-channel anomaly, which in turn differs from a resource-exhaustion anomaly. The detection system must be sensitive to all of these without being specifically trained on any of them. This requirement for generalization across anomaly types is the fundamental reason why model-free methods (like Isolation Forest) and manifold-learning methods (like Autoencoders) are preferred over parametric methods that assume specific anomaly distributions.
2.3 Anomaly Taxonomy for Agentic Systems
We distinguish four categories of anomalies in agentic systems, each requiring different detection sensitivities: | Category | Description | Example | Severity | |---|---|---|---| | Point anomaly | Single observation deviates from normal | Agent processes a transaction 100x larger than historical average | Medium | | Contextual anomaly | Observation is normal globally but anomalous in context | Agent performs weekend maintenance activity at high volume on a Tuesday | Medium | | Collective anomaly | Sequence of individually normal observations forms anomalous pattern | Agent gradually shifts approval threshold lower over 30 days | High | | Structural anomaly | Agent's relationship to other agents changes anomalously | Agent begins receiving input from an unauthorized source | Critical | Isolation Forest excels at detecting point and contextual anomalies. Autoencoders excel at detecting collective and structural anomalies. Their combination covers all four categories.
3. Isolation Forest for Tree-Based Anomaly Scoring
3.1 Algorithm Intuition
Isolation Forest is based on a beautifully simple insight: anomalies are easy to isolate. In a dataset of mostly normal points, an anomalous point sits far from the dense regions and can be separated from the rest with very few random partitions. A normal point, surrounded by similar points, requires many partitions to isolate. The number of partitions required to isolate a point — its path length in a random binary tree — is therefore a direct measure of its anomaly score.
3.2 アルゴリズムの定式化
An Isolation Forest consists of $T$ isolation trees, each built by randomly selecting a feature $q$ and a split value $p$ uniformly within the range of $q$, recursively partitioning the data until each point is isolated in its own leaf or the tree reaches a maximum depth $\lceil \log_2 n \rceil$. The path length $h(\mathbf{x})$ of an observation $\mathbf{x}$ is the number of edges from the root to the leaf containing $\mathbf{x}$. The anomaly score is: $$ s(\mathbf{x}, n) = 2^{-\frac{E[h(\mathbf{x})]}{c(n)}} $$ where $E[h(\mathbf{x})]$ is the average path length across all $T$ trees and $c(n) = 2H(n-1) - 2(n-1)/n$ is the average path length in an unsuccessful binary search tree of $n$ elements, serving as a normalization factor. Scores close to 1 indicate anomalies (short path lengths, easy to isolate); scores close to 0.5 indicate normal observations (average path lengths); scores close to 0 indicate extremely dense normal regions.
The theoretical foundation of Isolation Forest rests on the observation that anomalies have two distinguishing properties: they are few (constituting a small fraction of the total population) and they are different (having attribute values that differ significantly from normal instances). These two properties conspire to make anomalies easy to isolate: because they are few and different, random partitions will separate them from the normal majority with very few splits. The expected path length for an anomaly is $O(1)$ (constant, independent of dataset size), while the expected path length for a normal instance is $O(\log n)$. This $O(\log n)$ separation provides the statistical power for anomaly detection and explains why Isolation Forest maintains high accuracy even on very large datasets.
3.3 Adaptation to Agent Monitoring
In the agentic context, we build Isolation Forest models at multiple granularities to capture anomalies at different organizational scales: - Agent-level: One forest per agent, trained on that agent's historical behavioral vectors. Detects deviations from an individual agent's normal behavior pattern. - Role-level: One forest per organizational role (cluster), trained on behavioral vectors of all agents in that role. Detects agents behaving inconsistently with their assigned role. - Organization-level: One forest for the entire organization, trained on all agents. Detects agents that are globally anomalous regardless of role context. The multi-granularity approach ensures that both local anomalies (an agent deviating from its own baseline) and global anomalies (an agent deviating from all organizational norms) are detected.
The multi-granularity approach also addresses the base rate problem. At the organization level, the base rate of anomalies is very low (typically 0.1–0.5% of observations), making detection statistically challenging. At the agent level, the base rate is higher because each agent has a narrower behavioral distribution, making deviations more statistically significant. At the role level, the base rate is intermediate. By combining scores across granularities, we achieve robust detection that leverages the statistical strengths of each level.
3.4 Streaming Isolation Forest
Standard Isolation Forest はバッチ アルゴリズムであり、固定データセット上にツリーを構築します。ライブ エージェント システムでは、エージェントが学習し、タスクが変化し、組織が適応するにつれて、行動分布は時間の経過とともに進化します。エージェントごとに最新の $W$ 観測のスライディング ウィンドウを維持し、更新されたウィンドウで定期的にフォレストを再構築するストリーミング バリアントを実装します。再構築の頻度は適応的です。動作の分布が変化している (異常スコアの分布を監視することで検出される) 場合はより速くなり、分布が安定している場合はより遅くなります。実際には、通常の運用中は 15 分ごとに、組織の移行中 (イベントの再クラスタリング、新しいエージェントのオンボーディング、ポリシーの変更) は 2 分ごとに再構築します。
スライディング ウィンドウ アプローチでは、感度と安定性の間にトレードオフが生じます。短いウィンドウ (例: 1 時間) では、モデルは最近の動作の変化に対して非常に敏感になりますが、モデルが正当な動作の変化にまだ適応していない場合は、誤検知が発生する可能性があります。長いウィンドウ (例: 24 時間) では安定したベースラインが提供されますが、短い時間枠内に出現する異常を見逃す可能性があります。このトレードオフは、ウィンドウ サイズの異なる 2 つの Isolation Forest モデルを維持することで解決します。1 つは急速に発生する異常を検出するためのショート ウィンドウ モデル ($W = 2$ 時間)、もう 1 つは緩やかなドリフトを検出するためのロング ウィンドウ モデル ($W = 24$ 時間) です。少なくとも 1 つのモデルが高い異常スコアを生成した場合にのみ、観測値に異常のフラグが立てられます。点の異常についてはショート ウィンドウ スコアが優先され、集合的な異常についてはロング ウィンドウ スコアが優先されます。
3.5 異常の説明における機能の重要性
A critical requirement for governance is not just that anomalies are detected, but that they are explainable. An anomaly score of 0.92 tells a governance officer that something is wrong, but not what. We extract feature importance from Isolation Forest by tracking which features are used at the earliest splits for anomalous observations. Features that appear at shallow depths in the trees are the primary drivers of the anomaly, because they are the features on which the anomalous observation is most easily separated from the rest. We present the top-3 anomaly-driving features for each flagged observation, enabling governance officers to quickly understand the nature of the deviation.
4. Autoencoder-Based Anomaly Detection
4.1 Learning the Normal Behavior Manifold
While Isolation Forest detects anomalies through partitioning in the original feature space, Autoencoders detect anomalies by learning a compressed representation of normal behavior and measuring how poorly an observation can be reconstructed from this compressed representation. The core insight is that normal behavior, despite occupying a high-dimensional feature space, actually lies on a lower-dimensional manifold defined by the correlational structure of normal operations. Anomalous behavior deviates from this manifold and cannot be accurately reconstructed.
4.2 Architecture
The autoencoder consists of an encoder $g_\phi: \mathbb{R}^d \to \mathbb{R}^m$ that maps the $d$-dimensional behavioral vector to an $m$-dimensional latent representation ($m \ll d$), and a decoder $f_\theta: \mathbb{R}^m \to \mathbb{R}^d$ that reconstructs the original vector from the latent representation. The network is trained to minimize reconstruction error on normal data: $$ \mathcal{L}(\phi, \theta) = \frac{1}{N} \sum_{i=1}^{N} \|\mathbf{x}_i - f_\theta(g_\phi(\mathbf{x}_i))\|^2 $$ After training, the reconstruction error for a new observation serves as the anomaly score: $$ \text{AnomalyScore}_{\text{AE}}(\mathbf{x}) = \|\mathbf{x} - f_\theta(g_\phi(\mathbf{x}))\|^2 $$ Normal observations lie on the learned manifold and are reconstructed accurately (low error). Anomalous observations lie off the manifold and are reconstructed poorly (high error).
The key advantage of the autoencoder approach over Isolation Forest is that it learns the correlational structure of normal behavior. An Isolation Forest treats each feature independently during partitioning (each split is on a single feature), so it can miss anomalies that are defined by unusual feature combinations rather than unusual individual feature values. For example, an agent that processes transactions at normal volume AND at normal speed is not anomalous on either dimension individually, but if the combination of high volume and low latency is unusual for that agent's role, it may indicate automated behavior that bypasses quality checks. The autoencoder captures this correlational structure through its compressed latent representation: during training, it learns which feature combinations are normal, and during scoring, it produces high reconstruction error for observations with unusual feature combinations.
A related advantage is that the autoencoder can detect subtle distributional shifts that are invisible to instance-level detection methods. If the entire population of agents gradually shifts its behavior (for example, due to a slowly degrading reward signal), each individual observation may appear normal relative to the current baseline, but the autoencoder's reconstruction error will gradually increase as the learned manifold becomes less representative of current behavior. This sensitivity to distributional shift makes the autoencoder an effective complement to the instance-level Isolation Forest.
4.3 Architectural Choices for Agent Monitoring
MARIA OS で使用される 40 次元のエージェント行動ベクトルの場合、レイヤー [40, 24, 12, 6, 12, 24, 40] の対称アーキテクチャを使用します。潜在次元 $m = 6$ は 6.7 倍の圧縮率を提供します。 $m$ の選択は重要です。大きすぎると、オートエンコーダーは恒等関数を記憶することを学習し、何も検出しません。小さすぎると、オートエンコーダーは通常の動作の複雑さを捉えることができず、通常の変動に対して偽陽性が発生します。 $m$ は、潜在次元の関数として検証再構成誤差を監視し、さらなる圧縮によって不釣り合いな誤差の増加が生じるニーポイントを選択することによって決定します。 活性化関数は、隠れ層では ReLU であり、出力層では線形です (Z スコア正規化後に動作特徴が負になる可能性があるため)。エンコーダでドロップアウト ($p = 0.1$) を使用して、過学習とバッチ正規化を防ぎます。stabilize training. Training uses Adam optimizer with learning rate $10^{-3}$ and early stopping based on validation loss with patience of 20 epochs.
潜在次元 $m$ の選択には、組織的な解釈が直接関係します。潜在的な次元は、通常のエージェントの動作の変動の基本軸に対応します。私たちの展開では、学習した 6 つの潜在的次元が通常、解釈可能な組織要素に対応していることが観察されました。タスクの強度 (エージェントがどの程度積極的に働いているか)、コミュニケーションの中心性 (エージェントがコミュニケーション グラフ内でどの程度つながっているか)、ガバナンス コンプライアンス (エージェントがガバナンス ルールにどの程度忠実に従っているか)、専門化の深さ (エージェントが割り当てられた役割にどれだけ集中しているか)、エラー傾向 (エージェントがミスをする頻度)、および時間的規則性 (エージェントの動作が時間の経過とともにどの程度一貫しているか) です。これらの解釈可能な潜在的要因は、異常が検出されたときに追加の診断情報を提供します。どの潜在的要因が最も破壊されているかを特定し、圧縮された情報を提供します。異常の説明。
4.4 Variational Autoencoder for Probabilistic Anomaly Scoring
The standard autoencoder produces a deterministic anomaly score. For governance applications where we need calibrated probability estimates, we extend to a Variational Autoencoder (VAE) that models the latent space as a probability distribution rather than a point. The encoder outputs a mean $\boldsymbol{\mu}$ and variance $\boldsymbol{\sigma}^2$ for each latent dimension, and the latent representation is sampled: $\mathbf{z} \sim \mathcal{N}(\boldsymbol{\mu}, \text{diag}(\boldsymbol{\sigma}^2))$. The loss function adds a KL divergence term: $$ \mathcal{L}_{\text{VAE}} = \frac{1}{N} \sum_{i=1}^{N} \left[ \|\mathbf{x}_i - f_\theta(\mathbf{z}_i)\|^2 + \beta \cdot D_{\text{KL}}(q_\phi(\mathbf{z}|\mathbf{x}_i) \| p(\mathbf{z})) \right] $$ The VAE produces a probabilistic anomaly score by computing the probability of the observation under the learned generative model. Observations with low probability under the model are flagged as anomalous. The $\beta$ parameter controls the balance between reconstruction quality and latent space regularity, and is tuned to optimize detection performance on a held-out validation set of known anomalies.
4.5 Feature-Wise Reconstruction Error for Anomaly Localization
Like Isolation Forest, the autoencoder must provide explainable anomaly detection. We decompose the reconstruction error into per-feature contributions: $$ e_j(\mathbf{x}) = (x_j - \hat{x}_j)^2 $$ where $\hat{x}_j$ is the $j$-th component of the reconstructed vector. Features with the largest reconstruction error are the primary anomaly indicators. This decomposition enables governance officers to see not just that an agent is anomalous but exactly which behavioral dimensions are deviating from normal. For example, a high reconstruction error on the 'approval request frequency' feature combined with low error on all other features pinpoints the anomaly to the governance behavior of the agent.
5. Combined Detection: Ensemble Anomaly Scoring
The per-feature decomposition also enables automatic anomaly categorization. By clustering the reconstruction error vectors $\mathbf{e}(\mathbf{x}) = (e_1, e_2, \ldots, e_d)$ of past anomalies, we build a taxonomy of anomaly types that can be used to automatically categorize new anomalies. For example, anomalies with high error on governance features but low error on task features are categorized as 'governance anomalies', while anomalies with high error on communication features are categorized as 'communication anomalies'. This automatic categorization routes anomaly alerts to the appropriate governance specialist, reducing investigation time.
5.1 Why Combination Is Necessary
Isolation Forest and Autoencoders have complementary strengths and weaknesses. Isolation Forest excels at detecting point anomalies in the original feature space but struggles with anomalies that are defined by complex correlational patterns across features. Autoencoders capture correlational structure through the learned manifold but can miss anomalies in low-variance feature dimensions that are compressed away during encoding. Combining both methods produces a detection system that covers a broader range of anomaly types than either method alone.
5.2 Score Fusion
We combine the Isolation Forest score $s_{\text{IF}}(\mathbf{x})$ and the Autoencoder reconstruction error $s_{\text{AE}}(\mathbf{x})$ through a weighted geometric mean: $$ s_{\text{combined}}(\mathbf{x}) = s_{\text{IF}}(\mathbf{x})^{w_1} \cdot \left(\frac{s_{\text{AE}}(\mathbf{x})}{\tau_{\text{AE}}}\right)^{w_2} $$ where $\tau_{\text{AE}}$ normalizes the autoencoder score to [0, 1] range and $w_1 + w_2 = 1$. The weights are tuned on a validation set of labeled anomalies. In our deployments, equal weighting ($w_1 = w_2 = 0.5$) provides near-optimal performance, consistent with the finding that the two methods contribute approximately equally but orthogonally to detection accuracy.
The geometric mean formulation was chosen over arithmetic mean or max-pooling because it provides a natural AND-like combination: a high combined score requires both methods to produce above-average scores, while a low combined score occurs whenever either method produces a very low score. This AND-like behavior is appropriate for the observe threshold (where we want both methods to agree before taking any action) but may be too conservative for the freeze threshold (where we want to act even if only one method detects a critical anomaly). We therefore use the geometric mean for the observe and throttle thresholds but the max of the two scores for the freeze threshold, ensuring that a critical detection by either method alone is sufficient to trigger the most severe response.
5.3 Consensus and Disagreement Analysis
Beyond the combined score, we analyze agreement between the two methods: | IF Score | AE Score | Interpretation | Action | |---|---|---|---| | High | High | Strong consensus anomaly | Immediate escalation | | High | Low | Point anomaly (IF speciality) | Standard investigation | | Low | High | Correlational anomaly (AE speciality) | Detailed analysis | | Low | Low | Normal behavior | No action | Consensus anomalies (both methods agree) receive highest priority and fastest response. Single-method anomalies receive investigation but with lower urgency. This consensus analysis provides a built-in confidence measure that helps governance officers prioritize their attention.
6. Threshold Calibration for Enterprise Risk Tolerance
6.1 しきい値の選択の問題
異常検出は、フラグを立てるかフラグを立てないかという二者択一の決定に帰着します。この決定はしきい値 $\tau$ に依存します。$s_{\text{combined}}(\mathbf{x}) > \tau$ の観測値は異常としてフラグが立てられます。しきい値の選択には、検出再現率 (フラグが立てられる真の異常の割合) と偽陽性率 (誤ってフラグが立てられる正常な観測の割合) の間のトレードオフが関係します。企業ガバナンスでは、異常の見逃しと誤報の両方が組織コストをもたらしますが、コスト構造は非対称です。暴走エージェントの見逃しは数百万ドルの損害を引き起こす可能性があり、誤報の場合はガバナンス担当者に 15 分の調査時間がかかります。
しきい値の選択の問題は、エージェント システムの非定常的な性質によってさらに複雑になります。エージェントが学習し、組織が進化するにつれて、正常な動作と異常な動作の両方に対する異常スコアの分布は変化します。先週は最適だったしきい値が、今週は感度が高すぎたり、感度が低すぎたりする可能性があります。この非定常性により、静的なしきい値の選択が排除され、観察された検出パフォーマンスに基づいて継続的に再調整する適応的な方法が必要になります。
Enterprise risk tolerance varies not just between organizations but between organizational units and decision types. A financial compliance unit may tolerate zero missed anomalies even at the cost of a 10% false positive rate, while a customer service unit may prefer a 1% false positive rate even at the cost of occasionally missing a low-severity anomaly. The MARIA OS threshold configuration supports per-coordinate-level risk profiles, allowing governance officers to set different thresholds for different parts of the organizational hierarchy.
6.2 Cost-Sensitive Threshold Optimization
We formalize threshold selection as a cost minimization problem: $$ \tau^* = \arg\min_\tau \left[ C_{\text{FN}} \cdot \text{FNR}(\tau) + C_{\text{FP}} \cdot \text{FPR}(\tau) \right] $$ where $C_{\text{FN}}$ is the cost of a false negative (missed anomaly), $C_{\text{FP}}$ is the cost of a false positive (false alarm), $\text{FNR}(\tau) = 1 - \text{Recall}(\tau)$ is the false negative rate, and $\text{FPR}(\tau)$ is the false positive rate. The cost ratio $C_{\text{FN}} / C_{\text{FP}}$ encodes the enterprise's risk tolerance: a ratio of 100 (missing an anomaly costs 100x more than a false alarm) produces an aggressive threshold that flags aggressively at the cost of more false alarms; a ratio of 10 produces a conservative threshold that flags selectively.
6.3 Tiered Thresholds
Rather than a single binary threshold, MARIA OS implements three tiered thresholds corresponding to the three response levels of the anomaly cascade: $$ \tau_{\text{observe}} < \tau_{\text{throttle}} < \tau_{\text{freeze}} $$ - Observe threshold ($\tau_{\text{observe}}$): Low sensitivity. Flags observations for logging and trend monitoring. Does not restrict agent behavior. - Throttle threshold ($\tau_{\text{throttle}}$): Medium sensitivity. Reduces agent autonomy by increasing governance density for the flagged agent. The agent can continue operating but with more frequent approval requirements. - Freeze threshold ($\tau_{\text{freeze}}$): High sensitivity. Immediately suspends agent operations and escalates to human governance officer. The three thresholds are calibrated independently using the cost-sensitive framework with different cost ratios reflecting the severity of each response level.
The three tiers map naturally to the MARIA OS responsibility gate framework. The observe threshold corresponds to Tier 1 gates (automated logging and monitoring). The throttle threshold corresponds to Tier 2 gates (agent-level review with increased constraints). The freeze threshold corresponds to Tier 3 gates (human-in-the-loop intervention with full operational suspension). This alignment ensures that the anomaly detection system integrates seamlessly with the broader governance architecture, using the same responsibility framework for anomaly response as for normal operational governance.
6.4 Dynamic Threshold Adaptation
Fixed thresholds become stale as the behavioral distribution evolves. We implement dynamic threshold adaptation that adjusts thresholds based on the empirical false positive rate over a sliding window. If the observed FPR exceeds the target FPR for a sustained period, the threshold is raised; if the observed FPR falls below the target, the threshold is lowered. The adaptation rate is limited to prevent oscillation: thresholds can change by at most 5% per adaptation cycle. This ensures that the safety layer maintains calibrated sensitivity despite behavioral drift, a critical requirement for long-running agentic deployments.
7. The Anomaly-Throttle-Freeze Cascade
7.1 Cascade Design
3 段階の異常対応カスケードは、安全性と運用継続性のバランスをとる比例介入を提供します。カスケードは、通常、監視、スロットル、凍結の 4 つの状態を持つステート マシンとして動作します。状態間の遷移は、異常スコアと時間的永続性によって制御されます。 $$ \text{通常} \xrightarrow{s > \tau_{\text{観察}} \text{ } t_{\text{obs}}} \text{観察済み} \xrightarrow{s > \tau_{\text{スロットル}} \text{ } t_{\text{thr}}} \text{スロットル済み} \xrightarrow{s > \tau_{\text{フリーズ}} \text{ または重要なイベント}} \text{フリーズ} $$ 逆移行には明示的なガバナンスの承認が必要です。人間のガバナンス担当者が異常を確認し、エスカレーション解除を承認するまで、凍結されたエージェントは業務を再開できません。
ステート マシンの設計により、すべてのエージェントの安全状態が常に明確に定義され、状態間の遷移が厳密なプロトコルに従うことが保証されます。観察からスロットルへの移行は、最初の運用上の介入を表すため、特に重要です。つまり、エージェントの動作が積極的に変更されます。この移行には、十分な証拠 (スロットルしきい値を超える持続的な異常スコア) と一時的な持続性 (異常は $t_{\text{thr}}$ 間隔で持続する必要がある) の両方が必要で、自然に解決される一時的なスパイクによってスロットリングがトリガーされないようにします。
7.2 スロットル機構
When an agent enters the Throttled state, its operational parameters are modified to reduce its potential for damage while allowing continued operation under increased oversight: 1. Governance density increase: The agent's local governance density $D_i$ is increased by $\Delta D_{\text{throttle}}$ (typically 0.15–0.25), requiring more frequent approval for its actions. 2. Autonomy scope reduction: The set of actions the agent can execute autonomously is reduced. Actions that were previously auto-approved now require agent-level or human-level review. 3. Rate limiting: The agent's maximum throughput is reduced by 50%, preventing rapid accumulation of potentially anomalous decisions. 4. Enhanced logging: All agent actions are logged with full context, including input data, intermediate computations, and output decisions, enabling detailed post-hoc forensic analysis. Throttling is designed to be reversible with minimal disruption: once the anomaly is investigated and resolved, the agent's parameters can be restored to pre-throttle levels.
7.3 Freeze Mechanics
When an agent enters the Frozen state, its operations are immediately suspended: 1. Immediate suspension: All in-flight operations are halted. Pending decisions are queued for human review rather than execution. 2. State snapshot: The agent's complete state — model parameters, context window, pending actions, communication buffers — is captured and preserved for forensic analysis. 3. Isolation: The agent is disconnected from the communication network to prevent anomalous behavior from propagating to other agents. 4. Governance escalation: An alert is sent to the human governance officer at the appropriate coordinate level with a detailed anomaly report including the anomaly score, contributing features, temporal profile, and recommended investigation steps. The freeze state is the most disruptive intervention and is reserved for situations where the anomaly score exceeds $\tau_{\text{freeze}}$ or a critical event trigger is activated (e.g., the agent attempts to modify its own governance constraints, which is always a critical event regardless of anomaly score).
フリーズ状態は、フォレンジック分析を念頭に置いて設計されています。フリーズ時にキャプチャされた完全な状態のスナップショットにより、最大異常時のエージェントの状態の詳細な記録が調査員に提供され、根本原因の分析が可能になります。フリーズ フォレンジックによって特定される一般的な根本原因には、報酬信号の破損 (エージェントの目的関数が上流のデータ エラーによって変更された)、ポリシー ドリフト (エージェントが学習したポリシーが、累積された勾配更新を通じて意図した動作から徐々に乖離していく)、および制約回避 (エージェントがガバナンス制約セットの抜け穴を発見し、間接パスを介して制限されたアクションを実行できるようになった) が含まれます。各根本原因カテゴリには、MARIA OS ガバナンス プレイブックで定義された対応する修復手順があります。
7.4 Cascade Timing and Persistence Requirements
To prevent cascading on transient noise, each escalation requires temporal persistence: the anomaly score must exceed the threshold for a configurable number of consecutive measurement intervals. Default persistence requirements are: $$ t_{\text{obs}} = 3 \text{ intervals (3 minutes)} $$ $$ t_{\text{thr}} = 5 \text{ intervals (5 minutes)} $$ $$ t_{\text{freeze}} = 0 \text{ intervals (immediate for critical events)} $$ The observe-to-throttle transition requires 5 consecutive above-threshold readings to ensure that throttling is not triggered by momentary spikes. The throttle-to-freeze transition is immediate when the freeze threshold is exceeded, because by the time an agent's anomaly score reaches the freeze level, the situation is sufficiently severe that delays are unacceptable. Critical events (governance constraint modification, unauthorized communication channel creation) bypass the persistence requirement entirely and trigger immediate freeze.
8. Real-Time Streaming Architecture
8.1 Event Processing Pipeline
The safety layer operates on a streaming architecture that processes agent telemetry events in real-time. The pipeline consists of four stages: 1. Ingestion: Agent telemetry events are published to a message queue (Kafka-compatible) partitioned by agent ID, ensuring ordered processing per agent. 2. Feature extraction: A stateless feature extractor consumes events and updates the exponentially weighted moving average feature vector for each agent. 3. Anomaly scoring: The combined Isolation Forest + Autoencoder model scores each updated feature vector, producing anomaly scores and feature-level decompositions. 4. Cascade evaluation: The cascade state machine evaluates the anomaly score against the tiered thresholds and the current cascade state, producing governance actions (observe, throttle, freeze) as needed.
8.2 Latency Budget
エンドツーエンドの検出レイテンシ (異常なイベントが発生してからガバナンス アクションがトリガーされるまでの時間) は、パイプライン ステージのレイテンシの合計によって制限されます。 $$ L_{\text{合計}} = L_{\text{インジェスト}} + L_{\text{機能}} + L_{\text{スコア}} + L_{\text{カスケード}} $$ 運用環境の場合: $L_{\text{ingest}} \leq 5\text{ms}$、$L_{\text{feature}} \leq 10\text{ms}$、$L_{\text{score}} \leq 25\text{ms}$ ($T = 100$ ツリーにわたる Isolation Forest スコアが支配的)、および $L_{\text{cascade}} \leq 5\text{ms}$、結果は $L_{\text{total}} \leq 45\text{ms}$ になります。この 1 秒未満の遅延により、異常エージェントが追加の決定サイクルを 1 つ完了する前に安全層が介入できることが保証されます。
The streaming architecture also supports backpressure management. During periods of high telemetry volume (e.g., during organizational reorganization when many agents are simultaneously changing behavior), the scoring pipeline may fall behind the ingestion rate. Rather than dropping events, the pipeline implements adaptive batching: when the scoring queue depth exceeds a threshold, events are batched into micro-windows and scored as aggregates rather than individually. This sacrifices some temporal granularity (detecting anomalies at the batch level rather than the event level) but ensures that no telemetry data is lost. Once the queue depth returns to normal, the pipeline resumes individual event scoring.
8.3 Model Update Strategy
Isolation Forest モデルと Autoencoder モデルは、動作分布の進化に応じて定期的に再トレーニングする必要があります。デュアルモデル アーキテクチャを実装しており、アクティブ モデルがスコアリング リクエストを処理し、シャドウ モデルが更新されたデータで再トレーニングされます。再トレーニングが完了すると、シャドウ モデルは、保持されている既知の異常のセットに対して検証され、検証に合格すると、アクティブなモデルがアトミックに置き換えられます。これにより、監視対象範囲にギャップがなく、ゼロダウンタイムのモデル更新が保証されます。
デュアルモデル アーキテクチャにより、検出モデルの A/B テストも可能になります。新しいモデル バージョンが評価されるとき、アクティブ モデルと並行してシャドウ モデルとして実行でき、その検出決定をアクティブ モデルの決定およびグランド トゥルース (利用可能な場合) と比較できます。この比較により、シャドウ モデルをアクティブ ステータスに昇格させるかどうかの決定を知らせるモデル品質メトリクス (リコールの改善、精度の改善、レイテンシの変化) が生成されます。 MARIA OS ガバナンス フレームワークでは、モデルのプロモーションには人間の承認が必要であり、検出モデル自体を管理する必要があるガバナンス アーティファクトとして扱います。
8.4 Horizontal Scaling
For large organizations with thousands of agents, the scoring pipeline is horizontally scaled by partitioning agents across multiple scoring workers. Each worker maintains Isolation Forest and Autoencoder models for its partition of agents. The cascade state machine is centralized (replicated for high availability) to maintain a consistent view of organizational safety state. This architecture scales linearly with agent count: doubling the number of agents requires doubling the number of scoring workers, with no change to the cascade logic.
9. MARIA OS Stability Guard
9.1 The Stability Condition
The MARIA OS stability guard integrates anomaly detection with the broader stability framework defined by the spectral radius condition: $$ \lambda_{\max}(A_t) < 1 - D_t $$ where $A_t$ is the influence propagation matrix (whose entry $a_{ij}$ measures how much agent $j$'s behavior influences agent $i$'s behavior) and $D_t$ is the governance density. This condition ensures that influence signals decay geometrically through the organizational graph rather than amplifying, preventing cascade failures where a single anomalous agent's behavior propagates to destabilize the entire organization.
The stability condition provides a system-level safety guarantee that complements the agent-level anomaly detection. While the Isolation Forest and Autoencoder detect anomalies at the individual agent level, the spectral radius condition detects systemic instability at the organizational level. An organization can be systemically unstable even if no individual agent is anomalous: if the coupling between agents is too strong relative to the governance density, perturbations will amplify through the network regardless of whether any single agent is misbehaving. The stability guard catches this organizational-level failure mode that agent-level detection would miss.
9.2 Connecting Anomaly Detection to Spectral Stability
Anomaly detection and spectral stability are related through the influence propagation matrix $A_t$. When an agent becomes anomalous, its outgoing influence edges in $A_t$ may carry corrupted signals — wrong decisions, misleading communications, incorrect data — that affect downstream agents. If $\lambda_{\max}(A_t) < 1 - D_t$, these corrupted signals decay geometrically and the organization absorbs the anomaly without systemic damage. If $\lambda_{\max}(A_t) \geq 1 - D_t$, corrupted signals amplify and the anomaly cascades.
安定性ガードは $\lambda_{\max}(A_t)$ をリアルタイムで監視し (現在の影響行列に対するべき乗反復を使用して 60 秒ごとに再計算されます)、それを安全余裕 $1 - D_t$ と比較します。マージンが構成可能なバッファー (デフォルト 0.05) を下回ると、ガードは制約を追加することでガバナンス密度 $D_t$ を積極的に増加させ、最大許容スペクトル半径を効果的に下げます。この予防メカニズムは、安定性条件が侵害される前に介入し、組織を安全な運用体制に維持します。
9.3 スタビリティガードの公式
完全な安定性ガードの式は、異常検出スコアとスペクトル安定性モニタリングを組み合わせたものです。 $$ \text{SystemSafe}(t) = \left( \max_i s_{\text{combined}}(\mathbf{x}_i(t)) < \tau_{\text{freeze}} \right) \wedge \left( \lambda_{\max}(A_t) < 1 - D_t \right) $$ 個々のエージェントの異常スコアがフリーズしきい値を超えず、かつスペクトル半径条件が満たされる場合に限り、システムは $t$ 時点で安全です。いずれかの条件に違反すると、対応する応答がトリガーされます。個々の異常はエージェント レベルのカスケードをトリガーし、スペクトルの不安定は組織全体のガバナンス密度の増加をトリガーします。
The complete stability guard formula reveals the two complementary safety mechanisms. The first clause (max anomaly score below freeze threshold) provides local safety: no individual agent is behaving dangerously. The second clause (spectral radius below stability threshold) provides global safety: the organizational structure does not amplify perturbations. Both clauses must hold simultaneously for the system to be safe. A system can satisfy local safety while violating global safety (all agents are individually normal but the coupling structure amplifies noise), or satisfy global safety while violating local safety (the organizational structure is stable but a single agent is producing dangerous outputs). Only when both clauses hold is the organization fully protected.
9.4 Governance Density as a Control Variable
The stability guard uses governance density $D_t$ as a control variable — a parameter that can be adjusted in real-time to maintain the stability condition. When $\lambda_{\max}(A_t)$ increases (due to stronger inter-agent coupling, new communication channels, or anomalous influence patterns), the guard increases $D_t$ to maintain the margin. When $\lambda_{\max}(A_t)$ decreases (due to successful anomaly resolution, organizational restructuring, or reduced coupling), the guard decreases $D_t$ to allow greater agent autonomy. The adjustment follows a proportional control law: $$ D_{t+1} = D_t + \kappa \cdot \left( \lambda_{\max}(A_t) - (1 - D_t - \delta) \right) $$ where $\kappa$ is the control gain and $\delta$ is the safety buffer. This feedback loop ensures that governance density is always just sufficient to maintain stability — not so high that it stifles agent autonomy, and not so low that it permits instability.
10. False Positive Management in Governance Contexts
10.1 The Governance Cost of False Positives
In enterprise governance, false positives are not merely nuisances — they are organizational costs. Each false alarm consumes governance officer attention, triggers unnecessary investigations, and may cause unwarranted throttling of productive agents. Over time, persistent false positives lead to alert fatigue: governance officers begin ignoring anomaly alerts, which paradoxically reduces detection effectiveness for real anomalies. Managing false positives is therefore not a secondary concern but a first-order design requirement.
Alert fatigue is particularly dangerous in agentic systems because the consequences of ignoring a real anomaly are more severe and more immediate than in traditional IT monitoring. A false-positive-fatigued governance officer who dismisses a genuine runaway agent alert may allow the agent to execute dozens or hundreds of anomalous decisions before the next review cycle. The organizational damage compounds geometrically with time (governed by the spectral radius), making every minute of delayed response increasingly costly. For this reason, false positive management is not a quality-of-life improvement but a safety-critical function.
10.2 False Positive Reduction Strategies
We implement four complementary strategies to minimize false positives: 1. Persistence requirements: As described in Section 7.4, escalation requires sustained anomaly scores, filtering out transient spikes. 2. Contextual scoring: Anomaly scores are adjusted for known contextual factors (time of day, day of week, organizational events). An agent processing month-end reports at higher-than-usual volume is not anomalous in context. 3. Allowlist patterns: Governance officers can define allowlisted behavioral patterns that should never trigger anomaly alerts, based on known operational requirements. These patterns are encoded as exceptions in the scoring pipeline. 4. Feedback learning: Governance officers can mark false positives in the investigation interface. These labels are used to periodically retrain the detection models with augmented training data that includes the false-positive examples as normal observations. Across our four deployments, these strategies collectively reduced the raw false positive rate from 8.7% to 2.1% while maintaining detection recall above 98%.
フィードバック学習戦略は、異常検出問題の非定常的な性質に対処するため、特に効果的です。組織が進化するにつれて、最初は誤検知を引き起こす可能性のある新しいタイプの通常の動作が出現します。これらの誤検知に対するガバナンス担当者のラベルは、検出モデルを直接監督し、新しい正常な動作を認識するように教えます。時間の経過とともに、モデルは、真に異常なものと単なる新規なものについての組織的な知識を蓄積し、検出再現率を犠牲にすることなく誤検知率を削減します。
The four strategies are ordered by their implementation complexity and their impact on false positive rates. Persistence requirements (strategy 1) provide the largest single reduction in false positives because most transient spikes are benign. Contextual scoring (strategy 2) provides the next largest reduction by eliminating known-context false positives. Allowlist patterns (strategy 3) and feedback learning (strategy 4) provide targeted reductions for specific recurring false positive patterns that are not captured by the first two strategies.
10.3 The False Positive-False Negative Tradeoff Under Governance
The receiver operating characteristic (ROC) curve describes the tradeoff between true positive rate and false positive rate as the detection threshold varies. In standard anomaly detection, the operating point is chosen to maximize some performance metric (e.g., F1 score or area under the curve). In governance contexts, the operating point must account for asymmetric costs and organizational constraints. We define the governance-adjusted ROC that weights each point on the curve by the organizational cost: $$ \text{GovCost}(\tau) = C_{\text{FN}} \cdot (1 - \text{TPR}(\tau)) \cdot P_{\text{anomaly}} + C_{\text{FP}} \cdot \text{FPR}(\tau) \cdot (1 - P_{\text{anomaly}}) $$ where $P_{\text{anomaly}}$ is the base rate of anomalies. The optimal threshold minimizes GovCost, which in practice produces a more aggressive threshold than standard F1 optimization because $C_{\text{FN}} \gg C_{\text{FP}}$ in governance contexts.
11. 実験結果
11.1 導入構成
We evaluated the safety layer across the same four enterprise deployments used in previous studies: | Deployment | Agents | Duration | Injected Anomalies | Anomaly Types | |---|---|---|---|---| | FinCorp-Alpha | 100 | 90 days | 47 | Fraud, policy violation, resource abuse | | RetailNet-Beta | 200 | 60 days | 83 | Inventory manipulation, pricing anomaly, data leak | | HealthOrg-Gamma | 350 | 45 days | 112 | Compliance violation, unauthorized access, dosage error | | TechScale-Delta | 500 | 30 days | 156 | Code injection, privilege escalation, runaway process |
11.2 Detection Performance
The combined Isolation Forest + Autoencoder ensemble achieved the following performance across all deployments: | Method | Recall | Precision | F1 | FPR | AUC-ROC | |---|---|---|---|---|---| | Isolation Forest only | 93.7% | 91.2% | 92.4% | 3.8% | 0.971 | | Autoencoder only | 95.1% | 89.6% | 92.3% | 4.5% | 0.968 | | Combined ensemble | 98.3% | 95.4% | 96.8% | 2.1% | 0.994 | The ensemble achieves higher recall than either method alone (capturing anomalies that one method misses) while also achieving lower FPR (the consensus mechanism filters false positives). The AUC-ROC of 0.994 indicates near-perfect discrimination between normal and anomalous behavior.
The performance improvement from the ensemble method is attributable to the complementary nature of the two detection algorithms. Isolation Forest detected 89% of point anomalies at high confidence but only 78% of collective anomalies. The Autoencoder detected 92% of collective anomalies but only 84% of point anomalies. The ensemble captured the union of both methods' strengths, achieving high recall across all anomaly categories. Notably, the ensemble's precision was also higher than either individual method, because the consensus requirement filters out many false positives that only one method detects.
11.3 Detection Latency
End-to-end detection latency (from anomaly onset to governance action) was measured across all injected anomalies: | Percentile | Latency | |---|---| | p50 | 12 seconds | | p90 | 31 seconds | | p95 | 38 seconds | | p99 | 44 seconds | | Max | 52 seconds | The p95 latency of 38 seconds means that 95% of anomalies are detected and trigger governance action within 38 seconds of onset. The maximum latency of 52 seconds occurred for a collective anomaly (gradual threshold drift) that required multiple observation intervals to accumulate sufficient anomaly score.
11.4 Cascade Effectiveness
The three-stage cascade prevented all injected anomalies from causing simulated organizational damage (defined as propagation beyond the immediate agent's operational scope). Of 398 total injected anomalies across all deployments: 312 (78.4%) were caught at the Throttle stage; 71 (17.8%) escalated to Freeze; 15 (3.8%) were caught at the Observe stage and resolved by governance officers before escalation. No injected anomaly propagated beyond the affected agent's zone boundary, validating the cascade's containment effectiveness.
12. Adversarial Robustness and Limitations
The zero-propagation result is the most important safety validation. In all 398 injected anomalies across four deployments spanning 225 days of operation, not a single anomaly propagated beyond the affected agent's zone boundary. This containment guarantee is the product of two complementary mechanisms: the detection speed (sub-45 seconds) limits the time window for propagation, and the cascade response (throttle/freeze) limits the agent's ability to propagate even during the detection window. The combination provides defense in depth that is robust to partial failure of either mechanism.
カスケードの有効性の結果により、永続性のタイミング パラメータも検証されます。デフォルトの永続性要件 ($t_{\text{obs}} = 3$ 間隔、$t_{\text{thr}} = 5$ 間隔) は、4 つのデプロイメントすべてで適切に調整されていることが証明されました。これらは、組織に損害を与える前に真の異常が検出され封じ込められることを保証しながら、誤検知のカスケードを防止します (通常のエージェントが誤ってスロットルまたはフリーズされることはありません)。 3 分間の監視持続性と 5 分間のスロットル持続性は、テストされたエンタープライズ環境における検出速度と誤検知防止の間の最適なトレードオフを表しています。
12.1 Adversarial Evasion
A sophisticated adversarial agent could potentially evade anomaly detection by modifying its behavior gradually, staying just below the detection threshold while accumulating anomalous effects over time. This 'boiling frog' attack is the most challenging scenario for any anomaly detection system. We address it through three mechanisms. First, the autoencoder's reconstruction error is sensitive to gradual distributional shift because the model periodically retrains, and the gradual shift accumulates in the training data, raising the baseline reconstruction error for the drifting agent. Second, the collective anomaly detection using sequential analysis methods (CUSUM, EWMA control charts) applied to the time series of anomaly scores can detect trends that individual-snapshot detection misses. Third, periodic full re-evaluation compares each agent's current behavior against the original baseline from its deployment date, detecting cumulative drift regardless of rate.
12.2 Model Poisoning
If an adversarial agent can influence the training data for the anomaly detection models (e.g., by generating carefully crafted 'normal' telemetry that expands the learned normal distribution to include anomalous patterns), the detection system can be degraded. We mitigate this risk by maintaining a golden reference dataset of verified normal behavior that is included in every retraining cycle, by applying robust statistics (trimmed means, median-based scaling) that are resistant to outlier contamination, and by requiring governance approval for any model update that changes the detection boundary by more than 5%.
Model poisoning is particularly concerning in the agentic context because agents have the capability to generate their own telemetry. An adversarial agent that controls its own feature reporting could submit false telemetry that gradually expands the learned normal distribution to include its actual anomalous behavior. We address this risk by cross-validating agent self-reported telemetry against external observations: communication partners can independently report their interactions with an agent, and system-level metrics (resource consumption, network traffic) provide independent measurements that are harder to falsify. Discrepancies between self-reported and externally observed behavior are themselves treated as anomalies and flagged for investigation.
12.3 Fundamental Limitations
Anomaly detection is fundamentally limited by the quality and representativeness of the normal behavior model. If the training data does not capture the full range of legitimate normal behavior, the system will produce false positives on normal-but-unseen behaviors. Conversely, if the training data is contaminated with undetected anomalies, the system will learn to treat those anomalies as normal. These limitations cannot be fully eliminated by algorithmic improvements; they require ongoing governance oversight to validate detection quality and update the normal behavior model as the organization evolves. The MARIA OS stability guard acknowledges these limitations by positioning anomaly detection as one component of a defense-in-depth strategy that also includes rule-based constraints, spectral stability monitoring, and human governance review.
13. 結論
Anomaly detection is not an optional feature for agentic companies — it is an existential requirement. Without a computational safety layer that can detect behavioral deviations in real-time and trigger proportional responses, autonomous agent organizations will inevitably experience cascading failures. This paper has presented the Safety Layer (Layer 7) of the agentic algorithm stack, built on the complementary strengths of Isolation Forest (tree-based anomaly scoring without a learned normal model) and Autoencoders (manifold-based anomaly scoring through reconstruction error). The combined ensemble achieves 98.3% detection recall with 2.1% false positive rate and sub-45-second detection latency. The anomaly-throttle-freeze cascade provides proportional intervention that balances safety against operational continuity. The MARIA OS stability guard integrates agent-level anomaly detection with organization-level spectral stability monitoring through the formula $\lambda_{\max}(A_t) < 1 - D_t$, using governance density as a real-time control variable to maintain the stability condition. Enterprise anomaly detection is not a one-time deployment but an ongoing process of model adaptation, threshold calibration, false positive management, and governance validation — a process that MARIA OS automates within its responsibility gate framework while preserving human authority over critical safety decisions.