Intertrace Docs
Sign in

Guardian

Guardian watches your AI traffic and estate, opens findings for high risks, and recommends what to do next. Policy changes wait for your team.

What Guardian does

Guardian is always-on detection and response for the AI you already run through Intertrace. It reviews agents, models, tools, and MCP activity on a schedule, and again when something high-risk shows up.

What it flags is decided by rules. A high-risk signal becomes a finding in Work; for a severe one, or a run of repeated attacks, Guardian proposes an incident and a person decides whether to open it from the finding. Everything else is a short list of recommended actions, each with evidence. Guardian never opens incidents or tickets on its own.

How to use it

  1. 1

    Send traffic through Intertrace

    Point a client at Intertrace (Quickstart). Guardian reviews what already appears in Traffic and Estate.

  2. 2

    Open Guardian

    In the dashboard, open Guardian. You will see recent reviews, recommended actions, and when the next review is due.

  3. 3

    Decide on each recommendation

    Approve to create a finding in Work. Dismiss it if it is noise. Every finding you create is audited like any other item in Work.

  4. 4

    Run a review now (optional)

    After a deploy or a spike in Events, run a review immediately. Scheduled reviews keep going either way.

From a recommendation to Work

Live traffic can already raise findings on its own. Guardian is the always-on review: it groups related risk and proposes the next action.

When you create a finding from a recommendation, it lands in the same Work queue your team already uses.

Work

Your findings inbox: Guardian's high-risk findings and the recommendations you create.

Traffic

The live requests and events Guardian reviews.

Estate

The agents, models, and assets in scope.

Labs

On-demand red team and assessments, not the always-on review.

What stays with your team

Guardian recommends. Your team decides.

  • Guardian opens findings for high risks. For severe signals or a run of repeated attacks it proposes an incident, which a person opens; it never opens one itself. See Findings & incidents.
  • By default, production policy does not change until an authorized person approves, including applying a policy or blocking an MCP server. Disabling a tool is off.
  • Guardian does not replace Estate, Traffic, Work, or Policies. It watches the same activity and hands approved work to the inbox you already use.

If Guardian is empty

Connect a client (Quickstart) and confirm requests appear in Traffic. Then wait for the next review, or run one now.