Anomaly detection

Baselines

Govern builds baselines from historical agent actions. Baseline quality depends on sample size and time window. No baseline in production currently carries a usable sample, so detection does not yet fire.

Detection methods

The pipeline scores statistical, rule-based, and semantic signals against a baseline. Severity maps to workflows and notifications; auto-actions are configurable on Enterprise but are not currently wired end-to-end.

Resolution

Anomalies can be acknowledged, resolved with notes, and linked to approvals or policy updates.