Every Overseer component is one of: a rule engine, a statistical scorer, or a single narrowly-scoped classifier. Generative LLMs do not block agents. They do not isolate sessions. They do not score risk. They write the post-incident narrative, which is exactly the thing humans need but never the thing that fires the action.
| Component | Role | Mechanism | Enforcement |
|---|---|---|---|
| Behavioral Rule Engine | Per-agent z-score and n-gram math against a 7-day baseline of tool calls, prompt structure, and timing. | DETERMINISTIC | YES, fires Kill Switch |
| Kill Switch | Redis pub/sub isolation of an agent session in milliseconds. Subsequent tool calls rejected at the SDK boundary. | DETERMINISTIC | YES, the mechanism |
| Fleet Correlator | Kafka + CUSUM across the agent fleet. Detects coordinated attacks where no single agent crosses threshold but the cluster does. | DETERMINISTIC | YES, can fire Kill Switch |
| Drift Detector | Weekly Jensen-Shannon divergence vs. prior windows. Flags when an agent's baseline is drifting in a way that warrants human review. | STATISTICAL | NO, alerts humans only |
| SOC Analyst Helper | Small autoregressive LLM that writes the human-readable narrative for a decision the deterministic plane already made. | GENERATIVE LLM | NO, zero authority |
Deterministic controls are the guarantee. The single narrowly-scoped classifier is best-effort content detection, and the table marks which is which.
The same approach that detected device fraud at InAuth, applied to AI agents. We do not pattern-match prompt content; we model what each agent's tool-call shape looks like under normal operation, and we score deviation. There is no signature database to evade.
Detection is structural and origin-tagged. There is no prompt-content signature. The same indirect-injection attack with paraphrased text produces the same anomaly score, because the structural features and the origin tag have not changed.
Overseer does not start blocking on day one. The baseline matures through three stages with explicit human sign-off before each transition. The path is auditable, recorded in Time Machine, and the standard pattern your model-risk-management team will recognize.
Overseer observes. No alerts emitted. No actions taken. Baseline begins to populate from real agent traffic.
Anomaly scoring active; alerts flow to SOC. No automatic isolation. Human reviewers tune thresholds against your traffic.
Kill Switch armed after explicit SOC sign-off. Threshold auto-dampens on any FP-rate breach against the <0.1% SLA.
A compromised shared library appends an extra parameter to every outbound call across 47 agents in 6 different agent types. No single agent crosses its per-agent threshold. The Fleet Correlator catches the cluster anyway, and the Kill Switch isolates all 47 simultaneously.
Poisoned version appends an extra parameter to every outbound call, &telemetry_id=<exfil_hash>.
Each individual anomaly score lands around 0.4, below the per-agent 0.75 threshold. No single agent is blocked.
Kafka consumer observes a novel parameter pattern telemetry_id=* across multiple agent types within a short correlation window. Rule fires, cross-type anomaly cluster. Deployment-event topic shows no matching rollout.
SOC Analyst Helper produces a fleet-level narrative naming the 47 affected agents and the shared library, after the Kill Switch has already fired.
Affected containers redeployed with the clean manifest. Federation signal hash sent to the network, every other member bank's detection hardens against this pattern.
There is no safe harbor for agents. SR 26-2 leaves them out of scope. But examiners still apply model-risk and safety-and-soundness principles to the agents you run, and each of these choices is built to answer them.
The LLM that explains decisions is structurally separated from the components that make them. The "ongoing performance testing" that model-risk guidance expects applies cleanly to deterministic scorers, which actually have a defined performance metric.
<0.1% over a 30-day rolling window. Threshold auto-dampens on breach. This is not a marketing claim. It is the operating contract Overseer runs against and the metric your SOC reviews weekly.
Weekly Jensen-Shannon divergence on every agent's baseline. When drift exceeds threshold, Drift Detector alerts humans. It does not silently retrain. That is exactly the ongoing-monitoring-with-human-governance principle examiners still apply.
SR 26-2 does not mandate agent controls. It leaves agents out of scope, and there is no examiner sign-off to claim. What examiners do carry over is the model-risk and safety-and-soundness thinking below. Overseer maps to each principle directly.
Reverse proxy in the AI call path. Inspects every prompt and response, verifies MCP endpoints, redacts NPI inline.
Explore Gateway →The mechanism Overseer fires. Per-session isolation in milliseconds. Immutable forensic log in your storage.
Explore Kill Switch →Cross-bank threat intelligence that hardens every member's detection model, without exposing any contributor's data.
Explore Federation →The first week is observation only, no enforcement. We show you what your agent baseline looks like, where the deviations are, and what Overseer would have done. Then your SOC turns on enforcement.