Doorway Thresholds

Logging every tool call buries the anomaly. Logging the right thresholds surfaces it. The difference is an engineering decision with a budget, and the budget is where the judgment lives.

The volume problem

A production agent fleet generates tool calls at a rate that makes exhaustive logging useless in practice. Storage is not the constraint. Attention is. A signal that requires reading ten thousand normal records to find is a signal that will not be read in time.

So the engineering question is not what can we log. It is what should we log, knowing the answer competes with everything else for the same attention.

What earns a threshold

Four properties, ranked. Rate of change: a doorway whose traffic suddenly spikes is more interesting than one that is always busy. Irreversibility: actions that cannot be undone get watched tighter than ones that can. Authorization distance: the gap between what the agent was authorized to do and what the API would let it do. And blast radius: how many people the action touches who did not consent to being touched.

Rank any set of doorways by those four and the list that falls out is short. The short list is where the instrumentation budget goes.

The budget forces the ranking

The discipline comes from the constraint. With unlimited logging, no ranking is needed, and no ranking means no thinking. A finite budget forces the question the team would otherwise defer: which doorways matter, and how do you know.

The ranking method ships with the harness, like everything else the lab builds. The thresholds are not the product. The ranking is.