See what every agent actually did, and catch what looks wrong.
Keel Intelligence is the observability and detection layer: it watches what agents and workloads actually do, learns normal behavior and flags anomalies and risk.
Why Keel Intelligence
Generic observability sees API calls without knowing who the agent is, who it acts for or what it was allowed to do. Intelligence sees every event with identity, delegation, policy decision and Registry context attached, which makes detections more precise and investigations faster.
- Who it's for
- Security operations and detection teams, plus AI platform teams who need to see agent activity, cost and drift.
- Build phase
- Phase 2 basics · Phase 5 analytics. See the roadmap
- First release scope
- Planned first release: unified event stream from KeelAuth, KeelKey and Registry, per-agent timeline, audit ledger, cost attribution, a small set of high-confidence rule-based detections, risk score to Governance, and SIEM export. Learned baselines, anomaly models and automated response come later.
What changes with Keel
| Problem | Today | With Keel |
|---|---|---|
| No visibility into agent activity | Actions are scattered across app, cloud and LLM logs. | One timeline per agent: tokens, credentials, context, tools, decisions. |
| Compromise goes unnoticed | A stolen agent token looks like normal API traffic. | Baselines per agent, with alerts on unusual scope, volume, timing or delegation. |
| Slow investigations | Reconstructing what an agent did takes days. | The full chain from user to agent to action, with what it saw. |
| Drift from declared scope | Agents gradually do more than they were approved for. | Declared versus observed comparison with drift alerts. |
| Untracked cost | Token and API spend cannot be attributed. | Cost and usage by agent, owner and team. |
No visibility into agent activity
Today · Actions are scattered across app, cloud and LLM logs.
With Keel · One timeline per agent: tokens, credentials, context, tools, decisions.
Compromise goes unnoticed
Today · A stolen agent token looks like normal API traffic.
With Keel · Baselines per agent, with alerts on unusual scope, volume, timing or delegation.
Slow investigations
Today · Reconstructing what an agent did takes days.
With Keel · The full chain from user to agent to action, with what it saw.
Drift from declared scope
Today · Agents gradually do more than they were approved for.
With Keel · Declared versus observed comparison with drift alerts.
Untracked cost
Today · Token and API spend cannot be attributed.
With Keel · Cost and usage by agent, owner and team.
What Keel Intelligence does
Observability
- Unified event stream from KeelAuth, KeelKey, Registry, Governance and the Context Gateway
- Per-agent timeline and delegation-chain view
- Cost and usage attribution: tokens, API calls and context volume by agent, owner and team
Behavioral analytics
- Baselines per agent and per agent class: scopes used, sources touched, volume, timing, peers called
- Declared versus observed access, with drift scoring
Detection
- Rules and models for token misuse, unusual delegation chains, access outside purpose, credential use from new locations and sudden data-volume spikes
- Risk score per agent fed back to Governance
- Optional automated response under Governance policy: step-up approval, scope reduction or suspension
Audit and investigation
- Tamper-evident audit ledger
- Investigation workspace to reconstruct an agent's inputs, decisions and actions
- Export to SIEM and data lake
How it works with the rest of Keel
Each Keel product feeds the others. The delegation chain and the audit trail only work when the same system issues the identity, makes the decision and records the result.
Built on standards you can evaluate
Nothing proprietary to adopt. These are the specifications the design is based on.
Put your first agent under control.
Join the design partner program: 90 days from federating your identity provider to a governed agent in production planning, with a named Keel engineer.