You're monitoring latency, error rates, and throughput. Your trade-surveillance agent processes thousands of flagged transactions overnight without a single exception. Everything looks green.
Then your analysts arrive in the morning to find escalation narratives citing accounts the agent never queried and routine wire transfers flagged as suspicious. Nothing crashed. The agent drifted.
These myths about AI agent monitoring persist because teams apply infrastructure and transaction-monitoring patterns to a fundamentally different problem. An agent-behavioral anomaly isn't a bad transaction or a slow API call. It's a reasoning failure that looks operationally healthy until someone reads the output.
Myth 1: "If the agent isn't crashing, it's working correctly"
Reality: Agent failures surface as quiet reasoning drift, not system errors.
Traditional monitoring watches for latency spikes, HTTP 500s, and memory exhaustion. Those signals tell you the infrastructure is healthy. They say nothing about whether the agent hallucinated a compliance narrative or invented retrieval results.
Consider an AML triage agent that starts over-escalating after an upstream schema change. The system logs show normal latency. The transaction data passed validation. The agent simply began reasoning incorrectly about what it retrieved. Research on the AgentSight system identifies this as a semantic gap: conventional monitoring sees high-level intent or low-level system actions, but it can't correlate the two.
You need span-level telemetry that captures every tool call, retrieval, and model completion in the agent's decision tree. That's where behavioral drift becomes visible.
Myth 2: "Transaction monitoring catches agent anomalies"
Reality: Transaction monitoring scores the payment, not the reasoning path.
Your transaction-monitoring system flags a suspicious wire transfer. That's its job, it watches inputs and outputs. But when the agent that triaged that transfer fabricates supporting evidence or skips a required data source, transaction monitoring sees nothing wrong.
The distinction matters. A transaction anomaly is what the agent is built to detect. An agent-behavioral anomaly is a failure in how the agent does that detection. Less than 0.1% of criminal proceeds worldwide are ever recovered, and traditional transaction-monitoring systems report false-positive rates above 90%. Adding autonomous agents on top of that foundation without behavioral oversight compounds the problem.
You're not looking for bad transactions. You're looking for an agent that's reasoning incorrectly about legitimate ones.
Myth 3: "Static rules will catch novel agent behavior"
Reality: Rules encode known-bad patterns; they can't anticipate emergent drift.
Static rules work when you know exactly what failure looks like and can script it as if-then logic. They fail when an agent develops a low-and-slow reasoning error no analyst anticipated, like gradually increasing confidence scores on marginal cases or silently dropping a retrieval step.
Deloitte projects US AI-enabled fraud losses reached $12.3 billion in 2023, expected to hit $40 billion by 2027. That 32% compound annual growth rate isn't driven by attacks your rules already cover. It's driven by novel exploits and emergent failures.
Effective detection requires behavioral baselines built from span-level telemetry during normal operation. You capture how the agent reasons when it's healthy, tool call patterns, retrieval sequences, decision lineage, then score live spans against that baseline for deviation. The RAGAS framework established faithfulness, answer relevance, and context relevance as core evaluation dimensions for exactly this reason.
Myth 4: "Sampling traces is fine if you catch the big issues"
Reality: Down-sampling hides the low-and-slow drift that matters most.
Teams sample traces to cut external evaluation costs. You send 10% of spans to your observability vendor and assume the sample is representative. It isn't.
Low-and-slow drift surfaces across many spans with small deviations. A 10% sample misses 90% of the signal. By the time your sample catches the anomaly, the agent has already executed hundreds of flawed decisions.
In-environment evaluation solves this. Models that run locally with no external API calls carry no per-evaluation cost and enforce policies in under 100ms. You score every span with 100% trace coverage, which is the only way to catch drift before it compounds.
Myth 5: "Detection is enough, we'll fix issues when we see them"
Reality: Detection produces incident reports; enforcement stops bad actions before they execute.
Detection tells you an agent misbehaved after the fact. Enforcement acts on the request-and-response path before an action executes. That's the difference between observing risk and controlling it.
Pre-LLM guardrails intercept inputs before they reach the model, catching prompt injection or malformed instructions. Post-execution guardrails inspect outputs and proposed actions before they're returned, catching fabricated narratives or unauthorized trades.
Every guardrail ends in one of three actions: allow (clean request proceeds), redact (remove sensitive content like PII while preserving the workflow), or block (reject the full request). Anthropic's guidance on building effective agents recommends pausing for human feedback at checkpoints, alongside sandbox testing and guardrails that constrain autonomy.
Wells Fargo researchers identify hallucination and toxicity as the primary novel model risks generative AI introduces in financial institutions, and they note US banks are obligated to enhance their model risk frameworks under SR 11-7 in response.
What to do instead
Start with span-level telemetry. Instrument every tool call, retrieval, and model completion so you can see the agent's full reasoning path, not just its final output.
Build behavioral baselines during normal operation. Capture how the agent reasons when it's healthy: which tools it calls, in what sequence, with what retrieval patterns. That baseline is your reference for deviation scoring.
Evaluate every span in real time. Score faithfulness, groundedness, and grounding against your baseline. Run evaluations in-environment to avoid sampling and external API costs.
Enforce inline. Apply pre-LLM guardrails to catch malicious inputs and post-execution guardrails to block fabricated or unauthorized outputs before they execute.
The governance burden is real. Only one in five organizations has a mature governance model for autonomous AI agents. Agentic AI amplifies safety, liability, and autonomy risks, and one-time validation with periodic review won't scale. Real-time adaptive oversight is required.
Oversight has to scale with autonomy. Every increment of agent independence you grant demands an equal increment in your ability to see, evaluate, and act on its behavior. That's visibility, context, and control, applied continuously, not once at launch.
