CONCEPT Cited by 1 source

Agent behavioral baseline¶

Definition¶

An agent behavioral baseline is a learned characterisation of an AI agent's normal behavioral pattern, derived from historical trace data, used as the reference against which the agent's runtime behavior is scored. When runtime behavior deviates from the baseline — different tool-invocation mix, unusual data access sequences, abnormal request volumes, cross-system access that wasn't in the historical pattern — the agent is flagged as anomalous before it violates an explicit policy rule.

It is the behavioral-analytics analogue of agentic workflow governance: where explicit governance rules catch known-bad actions, behavioral baselines catch previously-unseen actions that deviate from the agent's established pattern.

Role in the governance pipeline¶

The LangGuard/Databricks 2026-04-27 profile frames predictive governance as the "next evolution" of runtime enforcement:

Today — LangGuard enforces established policies at runtime. Every agent action is evaluated against rules defined in advance and denied/modified if it matches a known violation.
Next — train behavioral models on historical GRAIL trace data to detect anomalous agent behavior before it manifests as a policy violation. "If an agent starts acting erratically or deviating from its established baseline, those models will flag it as an anomaly before any damage is done."

The baseline is the shape the model learns, not the model itself; the model produces the score, the baseline is the reference the score is relative to.

(Source: sources/2026-04-27-databricks-inside-one-of-the-first-production-deployments-of-lakebase-langguard)

What goes into a baseline¶

The LangGuard profile doesn't disclose the exact feature set, but the implied dimensions — given GRAIL's multidimensional trace capture — include:

Tool-invocation mix — distribution of tools this agent typically calls per workflow
Data-access fingerprint — which datasets / rows / attributes this agent typically touches
Cross-system sequences — the order/shape in which this agent traverses systems of record
Model-call patterns — which foundation models it invokes, prompt-length distributions
Temporal rhythm — when it runs (burst pattern, idle windows, request-per-minute bounds)
Co-agent interactions — which peer agents it typically coordinates with

Training substrate¶

The architectural payoff of co-locating LangGuard's operational trace data in Lakebase is that MLflow, Databricks AI, and Model Serving can train anomaly-detection models directly on GRAIL trace data "without building separate ETL pipelines or standing up a second analytical platform". The baseline-learning pipeline reads from the same Lakebase tables the runtime engine is writing to.

Inference back into runtime enforcement¶

Once baselines exist, predictive signals feed back into the LangGuard engine: "These predictive signals feed back into the LangGuard Governance Engine, closing the loop between real-time enforcement and predictive monitoring and enabling enterprises to move from reactive controls to proactive, behavior-based AI governance on a single platform." The baseline deviation score becomes an input to the allow/deny/modify decision at runtime — with the same latency envelope that applies to the rest of runtime policy enforcement.

Distinction from adjacent concepts¶

concepts/anomaly-vs-incident-separation — an organisational process split in SRE practice; baseline deviation is input to that split (it tells you when to investigate as anomaly vs treat as incident).
concepts/anomaly-gated-config-update — uses anomaly detection to block config rollouts, not agent actions. Baseline-driven agent governance is the runtime analogue.
Traditional UEBA (user + entity behavior analytics) — established pattern in enterprise security for human users; agent behavioral baselines apply the same primitive at a new altitude (autonomous agents rather than human users or service accounts).

Status¶

Roadmap, not shipped. The LangGuard post explicitly frames predictive governance as the "next evolution" and "the architecture we are building today", not a live feature of the current product. Future posts should be watched for the baseline-feature set, detector architecture, and operational experience (false-positive rates, backfill strategy, drift handling).

Seen in¶

sources/2026-04-27-databricks-inside-one-of-the-first-production-deployments-of-lakebase-langguard (2026-04-27, Databricks) — introduces the primitive at roadmap altitude: baseline training on GRAIL trace data via MLflow, deviation signals feed back into the LangGuard runtime engine, closing the loop from reactive enforcement to proactive behavior-based governance. The stated cross-source architectural argument is that a single analytical platform (the broader Databricks Data Intelligence Platform) removes the ETL barrier that normally separates operational trace data from anomaly model training.