What operational monitoring should I set up to detect prompt injection or tool misuse in Catalyst-managed agents?

Monitor Catalyst’s audit logs for spikes in denied tool authorization attempts—these often indicate prompt injection probes. Set alerts on unusual tool call frequency or calls to tools outside the agent’s normal pattern. Use Catalyst’s built-in metrics for policy evaluation latency and failure rates. Integrate these logs with your SIEM for correlation. Regularly review tool authorization policies to ensure they still match the agent’s intended blast radius.