Behavior Guards
Behavior Guards watch live coding-agent sessions (Cursor, Claude Code, Codex, OpenCode) for risky patterns—then apply the same allow / ask / deny ladder as Enforcement, with open incidents on Pulse, Live, and Guards.
Starter+ (and Full Platform / Relay paid tiers) include Behavior Guards. Free orgs see an upsell; entitled orgs can turn the feature off for the whole org, or disable individual detectors.
Why it matters
Control rules catch what an agent may call. Behavior Guards catch how it behaves when something goes wrong. Admins get a live incident surface; engineers get a clear stop signal in the IDE.
Detectors
| Detector | What it catches |
|---|---|
| Failure Loop | Same tool or command fails repeatedly |
| Retry Thrash | Same tool + input repeatedly (success or fail) |
| Tool Storm | Short burst of any tool calls (spray-and-pray) |
| Spawn Storm | Burst of subagent starts |
| Compact Thrash | Repeated context compaction |
| Destructive Burst | Deletes, destructive shell, sensitive writes |
| Rate Budget | Sustained tool volume over a longer window |
| Privilege Streak | Elevated rights: sudo, secrets paths, admin-ish MCP |
Warn and escalate thresholds and time windows are configurable per detector in Console. When more than one detector fires, the worst verdict wins (deny > ask > warn).
How they differ
- Failure Loop needs failures; Retry Thrash still fires on successful identical polls.
- Tool Storm = short spray; Rate Budget = longer quota-style volume.
- Spawn / Compact watch lifecycle events—not raw tool volume.
- Destructive = risky operations; Privilege = elevated rights (some writes can hit both).
How to try a detector
- Open Relay → Guards → detector row → Sample or Configure
- Trigger the pattern with Recommended hooks installed
- Confirm on Live wire and the nested incident → Acknowledge
Escalation and Enforcement
| Mode | At warn threshold | At escalate threshold |
|---|---|---|
| Observe | Warn (context only) | Warn only — never hard-blocks |
| Soft | Warn | Ask — engineer confirms |
| Enforce | Warn | Deny — block |
Org controls
- Included on Starter+ / Relay paid / Full Platform (pricing )
- Org kill switch + per-detector toggles and thresholds
- Optional skip lists and “seen in your org” suggestions where supported
- Incidents on Pulse, Live, and nested under each Guards row
Guards run alongside Control rules on the same connected surfaces—no separate install.
Related: Getting started, Seats and policy, Audit and replay.