Skip to main content
An AI agent that can run commands, edit files and call APIs is a workload with unusually broad reach and unusually little instrumentation. AgentSight observes that behaviour from the kernel, using eBPF, rather than trusting the agent to report on itself.
AgentSight is a plan feature and requires its own agent installed on the hosts running your AI workloads. Talk to your account contact about enabling it.

​
What it shows

​
Why kernel-level

An agent’s own logs describe what it believes it did. Kernel observation records what actually happened at the system boundary — the process that was spawned, the connection that was opened, the file that was read.For a component whose whole purpose is taking autonomous action, the difference between those two is the entire point of monitoring it.
Because it observes from the kernel, it needs no cooperation from the agent framework, works across frameworks, and cannot be disabled by the workload being observed.

​
Governance alerting

Alert rules of type governance evaluate policy conditions against AgentSight data — so “an agent did something outside what we permit” becomes a notification rather than something discovered later. Governance rules run on the ordinary 60-second alerting loop. See Alerting.

​
Retention

Raw events are kept for 30 days; rolled-up aggregates for 90 days. Same shape as the rest of the platform — recent detail, longer-lived trends.

​
What it is not

AgentSight is not the zero-code instrumentation agent. They are separate products with separate purposes: AgentSight observes AI-agent behaviour for governance; zero-code instrumentation produces application traces and RED metrics for services generally.Both attach probes to the same TLS library symbols, and running both on one host is untested and not recommended. If you are evaluating both, use separate hosts and talk to your account contact.
It observes behaviour, not intent. It records that a process was spawned or a connection opened. Whether that was correct is a policy question, which is what governance rules are for — the data alone does not decide it.

​
Next

LLM observability

Cost, latency and errors for your model calls.

Alerting

Governance rules and how the loop evaluates.

Security events

Detections, runtime threats and exposed secrets.