Runtime security evaluates what enters an agent and how the task evolves across later inputs, tools and external systems. That requires state, not only request-by-request filtering.
Barrikade · Updated 4 August 2026A stateless detector can classify one prompt, document or request. It cannot by itself determine whether a later action still serves the original task, whether several individually acceptable steps create excessive authority, or whether an agent is repeatedly contacting new systems.
Session-aware controls add declared intent, provenance, accumulated events and a bounded response policy to the detector result.
A risk budget represents how much uncertainty or elevated activity a task can accumulate before human review is required. New external domains, flagged inputs, permission changes or high intent drift can carry configurable costs.
The budget is not a universal risk score. It is a policy mechanism scoped to one workload session and tuned to that deployment.
Different workflows require different responses. A low-impact task might be resampled from a clean checkpoint; a consequential workflow might pause for escalation or revoke authority. Core defines halt, downgrade, resample, escalate and revoke as session actions separate from allow, flag and block detector verdicts.
These are alpha integration primitives. The application or orchestration layer remains responsible for enforcing the selected action.