An agent baseline is the normal behavioural profile for a specific AI tool, process, or user-linked session. It helps defenders distinguish expected activity from drift, such as new credential access, unusual command execution, or calls to unfamiliar resources. Baselines are essential for spotting AI misuse at runtime.
What an agent baseline captures
An agent baseline is the expected runtime pattern for a specific AI tool, process, or session. It is not a static policy document, but a behavioural reference point that helps defenders notice when an agent starts doing something meaningfully different, such as reaching for new credentials, executing unfamiliar commands, or contacting unexpected resources.
The key value of a baseline is context. A single action may look normal in isolation, but abnormal for that agent, that workflow, or that time window. For example, an assistant that usually reads files and drafts text may become suspicious if it suddenly requests token access, opens a shell, or pivots into systems it has never used before.
Because the baseline is tied to a specific tool or session, it should reflect the actual scope of authority and the normal shape of work. A weak baseline that is too broad will miss drift, while a baseline that is too narrow will create noisy alerts and hide real misuse in false positives.
How baselines help detect drift and misuse
Baselines matter because AI misuse often appears first as behavioural drift rather than an obvious compromise. When an agent begins to access new resources, expand its command set, or alter its call pattern, that change can indicate prompt injection, task hijacking, overreach, or abuse of delegated access.
In practice, defenders compare current activity with what the agent normally does, then investigate deviations that affect trust, authority, or data exposure. A baseline can also help distinguish legitimate workflow changes from malicious ones, especially when an agent is operating inside a larger automation chain where normal and abnormal actions can look similar.
Used well, baseline monitoring supports runtime detection rather than after-the-fact review. That makes it especially useful for catching suspicious behaviour early, before an unusual action becomes a broader incident.
What a useful baseline should include
A useful agent baseline usually covers the actions, resources, timing, and interaction patterns that define normal behaviour. That can include the typical tools used, the resource types accessed, the frequency of calls, the command families issued, and the usual boundaries of the session.
It should also capture what normal does not look like. If an agent never needs credential access, shell execution, or external retrieval from a given domain, those events become strong drift signals. If an agent is expected to touch sensitive systems, the baseline should be specific enough to distinguish routine use from overbroad access.
For a broader control perspective, baseline work aligns with operational hardening and detection discipline. A baseline is only valuable when it is measured against a real environment and updated as the agent’s approved function changes.
How to operationalise baselines without overfitting
Why practitioners should care: An agent baseline is only useful when it tracks the real shape of authorised work, not an idealised version of it. If the profile is too rigid, ordinary changes create noise; if it is too loose, unusual behaviour blends into the background.
Teams should treat baselines as living detection references, especially when an agent’s permissions, tools, or workflows change. A baseline built for one task can become misleading once the agent is repurposed, connected to new data, or given broader execution authority.
Practitioner takeaway: The best baseline is the one that is narrow enough to catch drift, but current enough to match how the agent actually works today.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 5 — Account Management | Agent baselines track unusual access and session behaviour tied to account use. |
| CIS Control 6 — Access Control Management | Baseline drift often shows up as access to new resources or commands beyond normal authority. | |
| CIS Control 8 — Audit Log Management | Baselines depend on log data that reveals normal versus abnormal agent actions and resource calls. | |
| Recommendation — Monitor account activity baselines and investigate deviations that suggest misuse or compromise. Define expected access patterns and revoke or review any newly observed access paths that exceed normal use. Collect and review audit logs that expose behavioural drift for automated or user-linked sessions. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Agent baselines are a continuous monitoring mechanism for spotting runtime deviation. |
| PR.AA — Identity Management, Authentication and Access Control | The baseline changes when an agent's authority, credentials, or access scope changes. | |
| Recommendation — Continuously compare agent activity to its baseline and alert on meaningful deviations. Tie monitored behaviour to the agent's approved identity and access scope. | ||
