Intrusion Detection for Agentic Processes:
Evidence-Based Runtime Monitoring

Abstract

Agent deployments increasingly combine language-model inference with retrieval, delegation, tool execution, external-system access, and human approval. Security-relevant deviations can therefore emerge across an evolving process rather than in one isolated input or action.

Building on the author's earlier product- and vendor-neutral black-box architecture for agentic processes and the subsequent evidence-claim model, this paper proposes an Agentic-Process Intrusion Detection System (A-IDS), an evidence-aware security interpretation layer for runtime intrusion detection whose monitored object is the agentic process itself. A-IDS compares evidence-supported observations with an explicitly governed and versioned expectation baseline for workflow state, authorization, communication, and mandatory events.

Its conceptual contribution combines dynamically due governed expectations, visibility separated from three-valued matching, explicit unresolved observation states, and bounded findings that separate evidentiary status from operational impact. The model further identifies the monitoring plane itself as an attack surface when adversarial content reaches semantic evidence producers through otherwise legitimate observation paths. Some observations may be produced outside the operational agent's self-report path, but the model does not assume complete observability or universally trustworthy capture. Prompt injection is treated not only as an input-security problem but also as a possible origin of later process deviations and cross-agent influence paths.

A-IDS does not infer malicious intent from anomalous behavior, does not treat an unobserved event as proof of non-occurrence, and does not claim a new anomaly detector, temporal logic, or provenance model. The contribution is conceptual: it does not validate a particular implementation, demonstrate empirical detection performance, establish causal attribution, or provide an enforcement mechanism.

Key concepts

• Governed and versioned expectations
• Dynamically due expectations
• Visibility separated from matching
• Three-valued matching
• Explicit unresolved observation states
• Bounded security findings
• Evidentiary status separated from operational impact
• Monitoring plane as an attack surface

Keywords

Agentic AI · AI Agents · Agentic Processes · Intrusion Detection · Cybersecurity · AI Security · Runtime Monitoring · Evidence · Multi-Agent Systems · Security Monitoring · Prompt Injection · Evidence-Based Security · Agent Security

Citation

Brömme, Arslan (2026). Intrusion Detection for Agentic Processes: Evidence-Based Runtime Monitoring. Version v0.9.1.8. Zenodo. DOI: 10.5281/zenodo.22764610.

BibTeX

@misc{broemme2026aids,
  author       = {Arslan Brömme},
  title        = {Intrusion Detection for Agentic Processes:
                  Evidence-Based Runtime Monitoring},
  year         = {2026},
  month        = sep,
  version      = {v0.9.1.8},
  publisher    = {Zenodo},
  doi          = {10.5281/zenodo.22764610},
  url          = {https://doi.org/10.5281/zenodo.22764610}
}