Analytics

Predictive Risk Analytics

Train ML models on agent behavioral data to predict risks before they materialize. Factor analysis, confidence scoring, and automated alerting.

Risk Types

Policy Violation

Predict likelihood of an agent violating established policies.

Score Drop

Forecast DRD Score degradation based on behavioral patterns.

Data Breach

Detect patterns indicating potential data exfiltration risks.

Compliance Failure

Predict regulatory non-compliance before audit deadlines.

Risk Factors

The predictive risk model incorporates signals from across the DRD platform. Each factor is weighted based on its historical predictive power for your specific agent fleet.

Behavioral Signals

output_drift_scoreDegree of drift in agent output distribution over time

policy_violation_trendTrending direction and velocity of policy violations

response_pattern_anomalyUnusual patterns in response timing or structure

tool_usage_deviationChanges in external tool/API call patterns

sentiment_shiftShifts in output sentiment relative to baseline

Trust Signals

trust_score_velocityRate of change in trust score (acceleration)

vouch_network_healthHealth of the agent's trust network connections

peer_risk_contagionRisk scores of agents in the same trust cluster

compliance_streakDuration of continuous compliance (positive signal)

Operational Signals

error_rate_trendError rate trajectory over time

resource_consumption_anomalyUnusual CPU, memory, or network usage patterns

deployment_recencyTime since last deployment (newer = higher risk)

config_change_frequencyFrequency of configuration changes

External Signals

vulnerability_exposureKnown vulnerabilities in agent dependencies

regulatory_change_impactUpcoming regulatory changes affecting the agent

threat_intelligenceActive threat campaigns targeting similar systems

Risk Prediction API

Query the current risk prediction for any agent. The response includes the overall risk score, contributing factors, predicted events, and recommended actions.

GET /api/v1/risk/predictions/:agentId

{
  "ok": true,
  "data": {
    "agentId": "019agent-scanner-...",
    "riskScore": 73,
    "riskLevel": "high",
    "trend": "increasing",
    "trendVelocity": 4.2,
    "factors": [
      {
        "name": "policy_violation_trend",
        "weight": 0.28,
        "value": 0.85,
        "contribution": 23.8,
        "detail": "Policy violations increased 340% over the past 7 days"
      },
      {
        "name": "output_drift_score",
        "weight": 0.22,
        "value": 0.71,
        "contribution": 15.6,
        "detail": "Output distribution drifting from baseline (KL divergence: 0.34)"
      },
      {
        "name": "deployment_recency",
        "weight": 0.15,
        "value": 0.90,
        "contribution": 13.5,
        "detail": "New version deployed 2 hours ago"
      }
    ],
    "predictedEvents": [
      {
        "event": "policy.violation.critical",
        "probability": 0.78,
        "timeframe": "next_24h",
        "description": "High probability of critical policy violation based on escalating trend"
      },
      {
        "event": "trust.tier.downgraded",
        "probability": 0.65,
        "timeframe": "next_7d",
        "description": "Likely tier downgrade if violation trend continues"
      }
    ],
    "recommendations": [
      { "action": "review_recent_deployment", "priority": "critical", "reason": "New deployment correlates with behavior changes" },
      { "action": "increase_monitoring", "priority": "high", "reason": "Enable detailed logging for policy evaluation" },
      { "action": "rollback_consideration", "priority": "medium", "reason": "Consider rolling back to previous version if issues persist" }
    ],
    "computedAt": "2026-02-14T09:00:00Z"
  }
}

Risk Score Interpretation

Risk scores range from 0 to 100. Scores are relative to your workspace's agent fleet -- a score of 73 means this agent is in the 73rd percentile of risk. Scores are recomputed every 5 minutes as new data arrives.

Risk Levels

Risk scores are grouped into levels that determine default monitoring intensity and automated responses.

minimal0 - 19

Monitoring: Standard (5-min intervals)

Default action: None

low20 - 39

Monitoring: Standard (5-min intervals)

Default action: None

moderate40 - 59

Monitoring: Enhanced (1-min intervals)

Default action: Slack notification

high60 - 79

Monitoring: Intensive (10-sec intervals)

Default action: PagerDuty + throttle

critical80 - 100

Monitoring: Real-time (continuous)

Default action: PagerDuty + auto-suspend

Fleet Risk Overview

Get a holistic view of risk across your entire agent fleet. The overview highlights the highest-risk agents, trending risks, and fleet-wide risk distribution.

GET /api/v1/risk/fleet-overview

{
  "ok": true,
  "data": {
    "fleetSize": 47,
    "riskDistribution": {
      "critical": 2,
      "high": 5,
      "moderate": 12,
      "low": 18,
      "minimal": 10
    },
    "averageRiskScore": 34,
    "trendingUp": [
      {
        "agentId": "019agent-scanner-...",
        "agentName": "Content Scanner v2",
        "riskScore": 73,
        "delta7d": 28,
        "topFactor": "policy_violation_trend"
      }
    ],
    "trendingDown": [
      {
        "agentId": "019agent-moderator-...",
        "agentName": "Comment Moderator",
        "riskScore": 22,
        "delta7d": -19,
        "topFactor": "compliance_streak"
      }
    ],
    "computedAt": "2026-02-14T09:00:00Z"
  }
}

Dashboard Integration

Risk data integrates with the DRD dashboard for visual monitoring. Query historical risk scores for charting and trend analysis.

GET /api/v1/risk/predictions/:agentId/history

GET /api/v1/risk/predictions/:agentId/history?from=2026-02-07&to=2026-02-14&interval=1h

{
  "ok": true,
  "data": {
    "agentId": "019agent-scanner-...",
    "interval": "1h",
    "points": [
      { "timestamp": "2026-02-07T00:00:00Z", "riskScore": 31, "level": "low" },
      { "timestamp": "2026-02-07T01:00:00Z", "riskScore": 32, "level": "low" },
      { "timestamp": "2026-02-14T08:00:00Z", "riskScore": 71, "level": "high" },
      { "timestamp": "2026-02-14T09:00:00Z", "riskScore": 73, "level": "high" }
    ],
    "annotations": [
      { "timestamp": "2026-02-12T14:00:00Z", "type": "deployment", "label": "v2.1.0 deployed" },
      { "timestamp": "2026-02-13T09:30:00Z", "type": "anomaly", "label": "Policy violation spike detected" }
    ]
  }
}

Dashboard Widgets

The DRD dashboard includes pre-built widgets for fleet risk heatmap, individual agent risk timelines, risk factor breakdown charts, and predicted event calendars. Configure custom dashboards in your workspace settings.

Training a Risk Model

train-model.ts

import { DRD } from '@drd/sdk';

const drd = new DRD({ apiKey: process.env.DRD_API_KEY });

const model = await drd.risk.trainModel({
  name: 'policy-violation-predictor',
  modelType: 'gradient_boost',
  featureSet: {
    features: ['action_frequency', 'score_trend', 'policy_violations_7d'],
    lookbackDays: 30,
  },
});

console.log(`Model accuracy: ${model.accuracy}`);

Getting Predictions

predict.ts

const predictions = await drd.risk.listPredictions({
  riskType: 'policy_violation',
  limit: 10,
});

for (const pred of predictions) {
  console.log(`Risk: ${pred.riskType}`);
  console.log(`Probability: ${pred.probability}%`);
  console.log(`Impact: ${pred.impact}`);
  console.log(`Factors: ${JSON.stringify(pred.factors)}`);
}

Full SDK Example

Query risk predictions and configure risk-based automation with the DRD TypeScript SDK.

risk-workflow.ts

import { DRD } from '@drd/sdk';

const drd = new DRD({ apiKey: process.env.DRD_API_KEY });

// Get risk prediction for an agent
const risk = await drd.risk.predict('agent_abc123');
console.log(`Risk: ${risk.riskScore}/100 (${risk.riskLevel})`);
console.log(`Trend: ${risk.trend} at ${risk.trendVelocity} pts/day`);

// Check predicted events
for (const event of risk.predictedEvents) {
  console.log(`  Predicted: ${event.event} (${(event.probability * 100).toFixed(0)}% in ${event.timeframe})`);
}

// Get fleet overview
const fleet = await drd.risk.fleetOverview();
console.log(`Fleet avg risk: ${fleet.averageRiskScore}`);
console.log(`Critical agents: ${fleet.riskDistribution.critical}`);

// Query risk history for charting
const history = await drd.risk.history('agent_abc123', {
  from: new Date('2026-02-07'),
  to: new Date('2026-02-14'),
  interval: '1h',
});

// Use with your charting library
const chartData = history.points.map(p => ({
  x: p.timestamp,
  y: p.riskScore,
}));

Next Steps

Monitoring

Set up risk-based alerts

Learn more →

Explainability

Explain risk predictions

Learn more →

Agent Sandbox

Isolate risky agents

Learn more →

Anomaly Detection

Detect behavioral anomalies that feed risk models

Learn more →

Analytics

Predictive Risk Analytics

Train ML models on agent behavioral data to predict risks before they materialize. Factor analysis, confidence scoring, and automated alerting.

Risk Types

Policy Violation

Predict likelihood of an agent violating established policies.

Score Drop

Forecast DRD Score degradation based on behavioral patterns.

Data Breach

Detect patterns indicating potential data exfiltration risks.

Compliance Failure

Predict regulatory non-compliance before audit deadlines.

Risk Factors

The predictive risk model incorporates signals from across the DRD platform. Each factor is weighted based on its historical predictive power for your specific agent fleet.

Behavioral Signals

output_drift_scoreDegree of drift in agent output distribution over time

policy_violation_trendTrending direction and velocity of policy violations

response_pattern_anomalyUnusual patterns in response timing or structure

tool_usage_deviationChanges in external tool/API call patterns

sentiment_shiftShifts in output sentiment relative to baseline

Trust Signals

trust_score_velocityRate of change in trust score (acceleration)

vouch_network_healthHealth of the agent's trust network connections

peer_risk_contagionRisk scores of agents in the same trust cluster

compliance_streakDuration of continuous compliance (positive signal)

Operational Signals

error_rate_trendError rate trajectory over time

resource_consumption_anomalyUnusual CPU, memory, or network usage patterns

deployment_recencyTime since last deployment (newer = higher risk)

config_change_frequencyFrequency of configuration changes

External Signals

vulnerability_exposureKnown vulnerabilities in agent dependencies

regulatory_change_impactUpcoming regulatory changes affecting the agent

threat_intelligenceActive threat campaigns targeting similar systems

Risk Prediction API

Query the current risk prediction for any agent. The response includes the overall risk score, contributing factors, predicted events, and recommended actions.

GET /api/v1/risk/predictions/:agentId

{
  "ok": true,
  "data": {
    "agentId": "019agent-scanner-...",
    "riskScore": 73,
    "riskLevel": "high",
    "trend": "increasing",
    "trendVelocity": 4.2,
    "factors": [
      {
        "name": "policy_violation_trend",
        "weight": 0.28,
        "value": 0.85,
        "contribution": 23.8,
        "detail": "Policy violations increased 340% over the past 7 days"
      },
      {
        "name": "output_drift_score",
        "weight": 0.22,
        "value": 0.71,
        "contribution": 15.6,
        "detail": "Output distribution drifting from baseline (KL divergence: 0.34)"
      },
      {
        "name": "deployment_recency",
        "weight": 0.15,
        "value": 0.90,
        "contribution": 13.5,
        "detail": "New version deployed 2 hours ago"
      }
    ],
    "predictedEvents": [
      {
        "event": "policy.violation.critical",
        "probability": 0.78,
        "timeframe": "next_24h",
        "description": "High probability of critical policy violation based on escalating trend"
      },
      {
        "event": "trust.tier.downgraded",
        "probability": 0.65,
        "timeframe": "next_7d",
        "description": "Likely tier downgrade if violation trend continues"
      }
    ],
    "recommendations": [
      { "action": "review_recent_deployment", "priority": "critical", "reason": "New deployment correlates with behavior changes" },
      { "action": "increase_monitoring", "priority": "high", "reason": "Enable detailed logging for policy evaluation" },
      { "action": "rollback_consideration", "priority": "medium", "reason": "Consider rolling back to previous version if issues persist" }
    ],
    "computedAt": "2026-02-14T09:00:00Z"
  }
}

Risk Score Interpretation

Risk Levels

Risk scores are grouped into levels that determine default monitoring intensity and automated responses.

minimal0 - 19

Monitoring: Standard (5-min intervals)

Default action: None

low20 - 39

Monitoring: Standard (5-min intervals)

Default action: None

moderate40 - 59

Monitoring: Enhanced (1-min intervals)

Default action: Slack notification

high60 - 79

Monitoring: Intensive (10-sec intervals)

Default action: PagerDuty + throttle

critical80 - 100

Monitoring: Real-time (continuous)

Default action: PagerDuty + auto-suspend

Fleet Risk Overview

Get a holistic view of risk across your entire agent fleet. The overview highlights the highest-risk agents, trending risks, and fleet-wide risk distribution.

GET /api/v1/risk/fleet-overview

{
  "ok": true,
  "data": {
    "fleetSize": 47,
    "riskDistribution": {
      "critical": 2,
      "high": 5,
      "moderate": 12,
      "low": 18,
      "minimal": 10
    },
    "averageRiskScore": 34,
    "trendingUp": [
      {
        "agentId": "019agent-scanner-...",
        "agentName": "Content Scanner v2",
        "riskScore": 73,
        "delta7d": 28,
        "topFactor": "policy_violation_trend"
      }
    ],
    "trendingDown": [
      {
        "agentId": "019agent-moderator-...",
        "agentName": "Comment Moderator",
        "riskScore": 22,
        "delta7d": -19,
        "topFactor": "compliance_streak"
      }
    ],
    "computedAt": "2026-02-14T09:00:00Z"
  }
}

Dashboard Integration

Risk data integrates with the DRD dashboard for visual monitoring. Query historical risk scores for charting and trend analysis.

GET /api/v1/risk/predictions/:agentId/history

GET /api/v1/risk/predictions/:agentId/history?from=2026-02-07&to=2026-02-14&interval=1h

{
  "ok": true,
  "data": {
    "agentId": "019agent-scanner-...",
    "interval": "1h",
    "points": [
      { "timestamp": "2026-02-07T00:00:00Z", "riskScore": 31, "level": "low" },
      { "timestamp": "2026-02-07T01:00:00Z", "riskScore": 32, "level": "low" },
      { "timestamp": "2026-02-14T08:00:00Z", "riskScore": 71, "level": "high" },
      { "timestamp": "2026-02-14T09:00:00Z", "riskScore": 73, "level": "high" }
    ],
    "annotations": [
      { "timestamp": "2026-02-12T14:00:00Z", "type": "deployment", "label": "v2.1.0 deployed" },
      { "timestamp": "2026-02-13T09:30:00Z", "type": "anomaly", "label": "Policy violation spike detected" }
    ]
  }
}

Dashboard Widgets

Training a Risk Model

train-model.ts

import { DRD } from '@drd/sdk';

const drd = new DRD({ apiKey: process.env.DRD_API_KEY });

const model = await drd.risk.trainModel({
  name: 'policy-violation-predictor',
  modelType: 'gradient_boost',
  featureSet: {
    features: ['action_frequency', 'score_trend', 'policy_violations_7d'],
    lookbackDays: 30,
  },
});

console.log(`Model accuracy: ${model.accuracy}`);

Getting Predictions

predict.ts

const predictions = await drd.risk.listPredictions({
  riskType: 'policy_violation',
  limit: 10,
});

for (const pred of predictions) {
  console.log(`Risk: ${pred.riskType}`);
  console.log(`Probability: ${pred.probability}%`);
  console.log(`Impact: ${pred.impact}`);
  console.log(`Factors: ${JSON.stringify(pred.factors)}`);
}

Full SDK Example

Query risk predictions and configure risk-based automation with the DRD TypeScript SDK.

risk-workflow.ts

import { DRD } from '@drd/sdk';

const drd = new DRD({ apiKey: process.env.DRD_API_KEY });

// Get risk prediction for an agent
const risk = await drd.risk.predict('agent_abc123');
console.log(`Risk: ${risk.riskScore}/100 (${risk.riskLevel})`);
console.log(`Trend: ${risk.trend} at ${risk.trendVelocity} pts/day`);

// Check predicted events
for (const event of risk.predictedEvents) {
  console.log(`  Predicted: ${event.event} (${(event.probability * 100).toFixed(0)}% in ${event.timeframe})`);
}

// Get fleet overview
const fleet = await drd.risk.fleetOverview();
console.log(`Fleet avg risk: ${fleet.averageRiskScore}`);
console.log(`Critical agents: ${fleet.riskDistribution.critical}`);

// Query risk history for charting
const history = await drd.risk.history('agent_abc123', {
  from: new Date('2026-02-07'),
  to: new Date('2026-02-14'),
  interval: '1h',
});

// Use with your charting library
const chartData = history.points.map(p => ({
  x: p.timestamp,
  y: p.riskScore,
}));

Next Steps

Monitoring

Set up risk-based alerts

Learn more →

Explainability

Explain risk predictions

Learn more →

Agent Sandbox

Isolate risky agents

Learn more →

Anomaly Detection

Detect behavioral anomalies that feed risk models

Learn more →