Your agent is making nine requests a minute. The limit is sixty. The dashboard is green.
Three of those nine requests are quietly walking customer records out the door.
The rate limiter has exactly one question — how many? — and nine is a perfectly polite answer. Volume was never the problem. The problem is that "under the limit" and "behaving" are two different claims, and most agent stacks only instrument the first one.
Rate limits are necessary. They're also blind.
We're not here to dunk on rate limiting. VeriSwarm rate limits its own API and stamps X-RateLimit headers on every response. Fixed-window counters stop runaway loops, brute force, and the intern's while-true. Keep them.
But a rate limit is a volumetric control, and the attacks — and failures — that matter for AI agents are increasingly semantic. The industry data is unambiguous on the direction. Akamai's telemetry, summarized in DeepStrike's 2026 bot-attack roundup, shows daily API attacks up 113% year over year — and, more to the point, 61% of API attacks in 2025 involved unauthorized workflows and abnormal activity, up from 30% in 2024. In one year, the modal API attack stopped being "too many requests" and became "the wrong requests, at a reasonable pace." Distributed, credentialed, low-and-slow traffic sits comfortably inside every threshold you set.
Agents make this worse, not better. An agent doesn't need to spike its request volume to go wrong. It drifts: a prompt injection lands, a tool gets swapped underneath it, a model update shifts its judgment, its context degrades over a long session. Each individual call looks routine. The distribution of what it's doing changes.
Volume is not intent. You need a control that measures intent's observable proxy: behavior over time.
What "behavioral" actually means (with math, not vibes)
Practitioners already know this. The 2026 SANS AI Survey (536 IT and security professionals) found that behavioral detection outranks every specialized AI defense as the most effective control against AI-enabled threats — and that 63% report significant shortcomings when AI detects or responds to threats, precisely because judging a behavioral anomaly is a context-dependent call that black-box classifiers handle poorly. The same survey's practitioners trust AI for structured classification and distrust it for anomaly judgment.
Read those two findings together and you get a design requirement: behavioral detection works, but only if the "anomaly" verdict is explainable enough for a human to act on. A model whispering "this feels off" is exactly the thing practitioners say they can't trust.
So Gate's approach is deterministic statistics, not a second LLM grading the first one.
Every trust decision an agent requests — allow, review, deny — lands in a per-day outcome series: decision counts, review rate, deny rate, average risk score. That series is the agent fleet's behavioral fingerprint, and it accumulates automatically from the decision checks you're already making.
The trust drift report then does what a careful analyst would do, without the analyst:
- Establish a baseline. A trailing window — 14 days by default, clamped between 7 and 90 — computes the mean and standard deviation of your fleet's review rate, deny rate, and average risk.
- Score the present against it. Each recent day gets a z-score per metric: how many standard deviations is today from your own normal?
- Flag what's actually anomalous. A day gets flagged when |z| ≥ 2.5 — a threshold that ignores ordinary jitter and catches the day your deny rate jumps three sigmas at a completely unremarkable request volume. And because a young tenant's baseline can be nearly flat (standard deviation ~0), the detector falls back to absolute deltas: a 15-point review-rate jump, a 10-point deny-rate jump, or a 12-point average-risk move gets flagged even when there's no variance to divide by.
No embeddings, no inference bill, no "the model thinks something is wrong." The anomaly report tells you which metric moved, by how much, against which baseline. That's the context-dependent judgment SANS respondents say AI fumbles — reduced to arithmetic a human can verify in their head.
The response is behavioral too
Detection without response is a dashboard. Gate closes the loop at decision time: scores update as events arrive, and an agent whose risk score crosses 75 — or that triggers a severe incident like a credential exposure — drops to tier X, where policy denies it outright. Not because it exceeded a quota. Because its behavior stopped resembling an agent you'd trust.
That's the layering:
- Rate limit — stops volumetric abuse. Cheap, necessary, blind to semantics.
- Per-decision scoring (Gate, free tier) — every check scored across identity, risk, reliability, autonomy; policy tiers demote misbehaving agents automatically, at any request volume.
- Fleet analytics and trust drift (Pro/Max) — daily allow/review/deny series with precision and recall proxies, plus the z-scored drift report for operators, so the slow bend in your fleet's behavior surfaces before it becomes an incident.
The firewall post from last week argued that agent defense has to live at the action layer, gating what agents do. This is the other half of that argument: the action layer needs a memory. A gate that only sees the current request can block a bad action; a gate with a baseline can notice that this week's actions don't look like last month's — which is the only way you catch the failure mode that never trips a single-request rule.
Instrument first, detect free
The uncomfortable part of behavioral detection is that it requires behavior — recorded, normalized, and queryable. If your agents' decisions aren't being logged as a series, there is no baseline, and every anomaly is invisible by construction.
The instrumentation is the free part. Sign up, point your agents' decision checks at Gate, and every allow/review/deny starts accruing into the outcome series that drift detection reads. The rate limiter keeps answering "how many." Gate starts answering the question that matters: is this still the agent you deployed?