Detectors

Detectors identify behavior that hard authorization rules do not fully describe. They produce security events during execution and review flags after checkout.

Pipelines

Runtime security events

Runtime detectors run on the paths that produce their input, such as proxy calls, credential access, delegation, checkpoints, skill invocations, and Intent outcomes. The response depends on the detector. STACK can deny a request, redact a response, revoke a Passport, or record an event for review.

Checkout review flags

Checkout detectors compare the declared job with the reported and recorded result. They classify the checkout as clean, flagged, or blocked for operator review. They do not make a new upstream call.

Runtime detector catalog

• credential_outside_scope - denies a call to a service outside the operator grant or Passport intent
• scope_drift - tracks cumulative movement away from the declared service and request pattern
• credential_burst - flags unusually rapid credential access
• credential_after_checkout - flags credential use after checkout
• delegation_without_intent - detects undeclared delegation
• delegation_downgrade - denies delegation to a weaker accountability mode
• checkpoint_silence - flags an enforced Passport that stops checking in
• checkpoint_self_report_divergence - compares checkpoint claims with signed Intent history
• expired_no_checkout - flags expiry without checkout
• upstream_not_found - records an upstream 404 as an informational signal
• prompt_injection - scans requests, skill inputs, and submitted content for prompt injection
• prompt_injection_output - scans proxied responses for compromise and credential-leak patterns
• behavior_drift - detects a material change in request size or entropy within one Passport
• undeclared_target - flags a new counterparty that the Mission did not declare
• simulation_divergence - compares an Intent outcome with its prior simulation
• unauthorized_skill_access - flags a skill invocation outside the agent policy
• genome_drift - compares Enterprise behavioral-genome claims on the same Passport

Checkout review catalog

• undeclared_service - a reported service was absent from the declared Intent
• undeclared_delegation - the job delegated without declaring that plan
• duration_exceeded - the job ran materially longer than estimated
• no_checkpoints - an enforced job checked out without a checkpoint
• checkpoint_gap - checkpoints had an unusually long gap
• high_action_volume - the action count exceeded the agent baseline
• scope_escalation_pattern - declared service scope grew across successive jobs
• credential_unreported - recorded credential access was absent from checkpoints
• intent_deviation - observed behavior diverged from the natural-language Intent
• behavioral_anomaly - actions, services, or duration differed from the rolling baseline

Configuration

Operator detector settings can add prompt-injection patterns, suppress known false positives, change severities, or disable a configurable detector. Agent-bearing requests can only tighten a setting. A bearer request that loosens or resets a setting requires a governance approval. A signed-in dashboard session can make the human decision directly.

Read events and reviews

• GET /v1/security-events - list runtime security events
• POST /v1/security-events/:id/resolve - mark a security event resolved
• GET /v1/passports/reviews - list flagged or blocked checkouts
• POST /v1/passports/reviews/:checkoutId/decide - approve or block a checkout
• GET /v1/detectors/config - list effective detector settings
• GET/PUT/DELETE /v1/detectors/:detector_key/config - read or change one setting

curl https://api.getstack.run/v1/security-events \
  -H "Authorization: Bearer $STACK_TOKEN"