observe-analyze

To analyze agent activity logs for security policy synthesis, collect JSONL events including file access, network egress, and shell commands, then identify action distributions and anomalies to generate candidate allowlists and blocklists.

Security policy synthesis is the process of analyzing agent activity events in JSONL format to identify file access patterns, network footprints, and tool usage, then generating candidate policies with allowlists and blocklists to secure agent behavior.

Building allowlists and blocklists from shell command and network egress logs requires pattern analysis of JSONL agent activity events, identifying anomalies and action distributions, then validating the synthesized candidate policies to ensure necessary guards are in place.

Yes, you can use JSONL file access logs to tighten existing agent security policies by reviewing observed events, identifying over-permissions, and refining the synthesized policy to add necessary guards and remove unnecessary access rights.

The best way to validate a synthesized security policy against observed agent events is to test the candidate policy against the collected JSONL activity logs and run suggested testing scenarios to ensure the policy removes over-permissions without blocking necessary actions.