AppsAI Agent Firewall

Threat detection

Unusual-request alerts

Unusual-request alerts learn what is normal for each person on each agent, their tools, channel, hours, location and volume, and raise a plain-language alert such as “First time this caller asked for Get payroll; new country” when a request doesn’t fit.

Turn on the firewall
Alert · Unusual requestsensitivity: MediumSAMPLE
CHALLENGECaller •••4421 · HR Assistant

Δ First time this caller asked for Get payroll

Δ New country: carrier in RO (usually US)

Δ Outside usual hours: 03:12 local

Δ 6 requests in the last hour (usually 1)

anomaly score 0.87 · learned from 214 earlier requests

The problem

A stolen login or a leaked API key produces requests that look perfectly legitimate. The only tell is that they don’t match how that person normally behaves.

How unusual-request alerts works

STEP 1

Learn each person

A person is a signed-in member, an API subject, a caller’s number or a website visitor. Their first 10 requests are only learned from.

STEP 2

Compare every request

Each request is compared with that person’s own history on that agent: tools and details, channel, day and hour, country and network or the number’s carrier, requests per hour, and how different the message is.

STEP 3

Explain what changed

A request that stands out raises an Unusual request alert that says in plain words what was different.

STEP 4

Act

Flag, ask the person to verify, or hold the request for an admin’s approval.

Every setting

Sensitivity

Low, Medium or High: how different a request must be.

Action

Flag, Ask to verify, or Require approval.

Custom rule condition

Use the unusual-request score in any rule.

Who can do what

Admins

Set sensitivity and action, read alerts and approve held requests.

What to know

  • History is kept as counts and summaries per person, not copies of messages.
  • Nothing is flagged during the learning period, so new users aren’t punished.
  • Daily sensitive-record counts follow the same person, so starting a new conversation doesn’t reset them.

More in Threat detection

Prompt injection protection →The firewall scores every user message and every tool result for prompt injection, flags it, and requires approval for any later tool call in the same run that sends data to another site.Pressure-tactics check →Before a sensitive tool runs, an AI review checks the recent conversation for social-engineering cues such as urgency, impersonation, gift cards or bank changes, and quotes them.All of Threat detection →

FAQ

Unusual-request alerts: questions

How does Autessa detect a compromised account talking to an agent?

It compares each request with that person’s own history on that agent and alerts when tools, timing, location, channel or volume stand out.

Does it store users’ messages to learn from?

No. It keeps counts and summaries per person, not copies of their messages.

Turn on unusual-request alerts.

The firewall learns each person’s usual tools, channel, hours, location and volume on each agent, and raises a plain-language alert when a request stands out. Start in Monitor and see what it would catch on your real traffic.

Turn on the firewall

Starts in Monitor · nothing changes for your customers until you enforce

100% customizable, code and all

Make Autessa AI Agent Firewall fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours