Private Beta

SoulWatch
AI Runtime Security
Monitoring

See what your agents are actually doing. Without seeing anything they handle.

Your AI agents are running in production right now. Do you know what they're doing? SoulWatch gives you behavioral visibility across your agent fleet - anomaly detection against per-agent baselines, automated quarantine, and a SoulKey-signed audit trail. All from inside your own infrastructure.

Request AccessRead the Docs

The problem: blind spots in agent operations

You deployed 50 AI agents last quarter. They process customer data, make API calls, and execute business logic autonomously. But you have no idea what they're actually doing at runtime.

Traditional APM tools track latency and errors. They don't track whether your agent just accessed data it shouldn't have. They don't detect behavioral drift. They don't know that your analytics agent is suddenly making admin-level API calls at 3 AM.

SoulWatch does. From inside your own infrastructure - your data never leaves your store.

Ten capabilities for complete
agent fleet visibility

From real-time event streaming to automated incident response. Everything your SOC needs to monitor AI agents at scale.

Real-Time Anomaly Detection

Detect behavioral anomalies the moment they happen. Statistical analysis across your entire agent fleet catches threats that single-agent monitoring misses.

Behavioral Baselines

SoulWatch learns what normal looks like for each agent. When behavior deviates from the established baseline, you know immediately - before damage is done.

Request-Layer Signals

Detection runs on request-layer behavior - what an agent asked for, how often, and when. Your data at rest is never part of the detection pipeline.

Automated Response

Policy-driven responses triggered by detections - alerting, throttling, quarantine. Repeatable, reviewable, and recorded in the audit trail.

Quarantine Orchestration

Automated quarantine when threats are detected. Isolate compromised agents, revoke tokens, and contain incidents - with operator review to release.

Exportable Audit & Events

Structured, exportable security events plus the SoulKey-signed audit trail - evidence your SOC can pull into its existing pipeline and verify independently.

Agent Risk Scoring

Continuous risk scores calculated from behavioral signals, policy violations, and anomaly patterns. Prioritize investigation on the agents that matter most.

Audit Evidence on Demand

Exportable decision logs and policy history to support your compliance program. Formal certifications are on our roadmap - see the Security & Trust page.

Cost & Budget Governor

Usage metering per agent and per tenant, with a governor that blocks runaway usage before it burns your budget. Fail-closed, with operator alerts.

Monitor-First Rollout

Run every policy and detection in monitor-only mode first. See exactly what would be blocked, tune the rules, then flip to enforcement with confidence.

How SoulWatch works

Every agent event flows through a five-stage pipeline from ingestion to response.

EventsAgent telemetry stream
DetectionBehavioral baselines
AnalysisRisk scoring + correlation
ResponsePlaybooks + quarantine
RecordSigned audit + alerts
SoulWatch processing
Response layer
External

What it looks like

Query anomalies, review detections, release quarantines. (Illustrative examples - design partners get the current API reference.)

query_anomalies.sh (illustrative)
# Get open anomalies for the last 24 hours
curl -s https://tiresias.your-infra.internal/watch/anomalies \
  -H "Authorization: Bearer <operator-token>" \
  -d '{"status": "open", "hours": 24}' | jq

# Response:
# {
#   "anomalies": [
#     {
#       "type": "behavioral_drift",
#       "agent": "analytics-agent",
#       "description": "Admin-level calls outside business hours",
#       "action_taken": "quarantine"
#     }
#   ],
#   "total": 1
# }
detection.yaml (illustrative)
# Behavioral detection: flag off-hours privilege use
detections:
  - name: off-hours-admin-access
    level: high
    match:
      action: "admin.*"
      time_window: "22:00-06:00"
    baseline: per_agent        # compare to learned behavior
    response: quarantine       # or: alert, throttle
    mode: monitor              # observe first, enforce later
release_quarantine.sh (illustrative)
# Operator review: release an agent from quarantine
curl -X POST \
  https://tiresias.your-infra.internal/watch/quarantine/release \
  -H "Authorization: Bearer <operator-token>" \
  -d '{"agent": "analytics-agent", "reason": "false positive"}'

# The release itself is SoulKey-signed and lands in
# the same tamper-evident audit trail.

Pairs with SoulAuth

SoulAuth tells you who an agent is and what it's allowed to do. SoulWatch tells you what it's actually doing. Together, they close the loop between authorization and accountability.

SoulAuth provides

  • Agent identity via SoulKeys
  • Policy-based authorization decisions
  • Capability token issuance
  • Audit events for every decision

SoulWatch adds

  • Real-time behavioral visibility
  • Anomaly detection + risk scoring
  • Automated quarantine + response
  • Exportable, signed audit evidence

Pricing

SoulWatch ships as part of the Tiresias-ZT platform - it is not sold separately. Tier pricing is being finalized during the private beta.

Included with the Tiresias-ZT platform

Full SoulWatch access for design partners

  • Behavioral baselines + anomaly detection
  • Automated quarantine with operator review
  • Usage metering + budget governor
  • SoulKey-signed audit trail
  • Monitor-first rollout mode

Monitor your agents today

SoulWatch is in private beta as part of the Tiresias-ZT platform. Request a design-partner slot and start watching your fleet.

Request AccessRead the Docs