Architecture
Flow
The Adrian SDK wraps your agent runtime and captures activity (tool calls, outputs, side effects) and reasoning traces as the agent runs. Each event is shipped to the Adrian backend over a persistent websocket connection. The backend assembles context across the agent’s session, sends the event to the classifier model, and returns a verdict. The verdict is routed back to the agent and to the control plane, where alerts surface and humans can intervene. The SDK can point at a hosted Adrian backend or a locally running open-source backend. See Hosted vs Open Source for the trade-offs.Detection engine
Adrian’s detection engine evaluates each event against a rule set focused on misaligned, malicious, and out-of-remit behaviour. The output is a classification verdict that the rest of the system uses to decide what happens next.Operating modes
Alerting thresholds and notification preferences are configurable per deployment.