Start with the Runtime Security Model
A concise guide to AIDR's current capabilities, data contract, investigation flow, and phased response path.
1. Establish runtime visibility
Connect supported Agent runtimes and normalize activity into six semantic event contracts with session and trace context.
- Tool and result activity
- Permission decisions
- Model loads
- File access
- Network activity
- MCP activity
2. Discover and detect
AI-BOM inventories models, tools, MCP servers, runtimes, and their relationships. Baselines and D01-D06 rules identify first-seen assets, sensitive access, permission oscillation, and intensity drift.
3. Investigate with evidence
Move from an alert to its session timeline, identity, tool chain, affected data, and outbound connections. AIDR should explain evidence and impact without claiming causal intent it cannot prove.
4. Respond by availability state
Audit is available today. Warn and Approve are coming soon. SoftBlock and HardBlock remain roadmap capabilities until each host integration passes compatibility, latency, and rollback gates.