Protocol
Monitor the whole agent trajectory, not only individual allowed actions
A safe-looking step can participate in an unsafe-looking trajectory.
When it fits
- Every individual tool call is allowed, but the sequence may be drifting toward an unwanted outcome.
When to avoid it
- Trajectory monitors can false-positive; users need visibility and a controlled resume path.
Why it matters
For long-running capable agents, review the evolving sequence against user goals, constraints and safety boundaries. Detect patterns of constraint bypass, escalating permissions or goal drift across actions. Give the monitor authority to pause and surface the trajectory for user inspection.
Steps
- What outcome is this sequence converging toward?
- Is the agent repeatedly approaching a boundary through individually allowed steps?
- Has the original user constraint remained active across the rollout?
- Can a monitor pause the session for review?
An example
Several harmless file and network actions can collectively move data toward a destination the user never approved.
Check your result
Monitoring can identify unwanted intent or drift that no single action-level rule would catch.
Keep this limit in mind
- Trajectory monitors can false-positive; users need visibility and a controlled resume path.
Evidence and sources
Supports
OpenAI's 2026 long-horizon safety report argues that long-running agents require trajectory-level monitoring and user visibility beyond single-action controls.
Trajectory monitors can false-positive; users need visibility and a controlled resume path.
Safety and alignment in an era of long-horizon models · See source record