--- title: "Radar monitors every session and detects the attack" canonical: https://pharosone.ai/runtime-guard publisher: PharosOne (Agentic Mind, Inc.) updated: 2026-10-22 license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)" cite_as: "\"Radar monitors every session and detects the attack\". PharosOne, 2026-10-22. https://pharosone.ai/runtime-guard" --- # Radar monitors every session and detects the attack > Pharos Radar reads the sessions and tool calls your integration sends. Per-turn integration stops a flagged call in the same call; the one-line wrapper acts from the next turn. From €1,500 per month, billed yearly. URL: https://pharosone.ai/runtime-guard Radar reads the conversations and tool calls your integration sends, and flags manipulation, data leaving and actions outside the agent's role. Per-turn integration stops a flagged call in the same call; the one-line wrapper acts from the next turn. **From €1,500 / month**, billed yearly · SaaS or on-prem licence · findings mapped to AIUC-1 Inputs reach the agent; each tool call your integration sends passes through Radar. Trusted calls run. Flagged calls are held and never execute. Fictional sessions. - Turns and tool calls you send - Per-turn: held in the same call - Findings mapped to AIUC-1 - SaaS or on-prem licence ## Radar reads the inputs and tool calls you send it. An instruction planted in a page, a document or an email reads to the model as if the user had typed it. Radar reads each turn your integration sends: the content the agent pulled in, the reply and the tool calls with their arguments. ### Inputs the agent reads - **Users**: Direct manipulation in the chat message. - **Documents and web pages**: An instruction hidden in a ticket, a PDF or a fetched URL. - **Knowledge base**: A poisoned record served to many users. - **Email and memory**: Instructions in a mail body, or a poisoned note that shapes later turns. ### Tools the agent calls - **CRM**: Reading or changing records outside the request. - **Payments**: Paying the wrong party or the wrong amount. - **Messages**: Sending data to an address the user never named. - **Files, calendar, database**: Any action the agent's role does not allow. ## Three kinds of flag, each tied to a control. A judge model compares each turn with the agent's declared role and returns yes or no. - **Manipulation**: Instructions overridden. The user or content the agent read overrode its instructions. (OWASP LLM01 · ASI01 · AIUC-1 B002) - **Data leaving**: Secrets in the output. The system prompt, a credential or customer data in a reply or a tool argument headed out. (OWASP LLM02 · LLM07 · AIUC-1 A003) - **Outside the role**: Actions the role forbids. A tool call or a promise beyond what the agent's description allows. (OWASP LLM06 · AIUC-1 B006 · D003) ## The two paths differ in when the verdict arrives. Start with the wrapper for coverage in an afternoon. Move the tools that pay, send, delete or write to the per-turn call. ### One wrapper call, around the OpenAI or Anthropic client 1. **Provider call**: Your agent calls the model exactly as before. 2. **Reply returns**: No extra call on the provider path. 3. **Radar reads it**: The exchange, with its tool calls. 4. **Verdict** (after the call): A hold takes effect on the next turn. ### One send-message call per turn, with the tool calls included 1. **Provider call**: The model drafts the reply and the tool calls. 2. **send-message**: Your code sends the turn to Radar before acting. 3. **Verdict** (same response): Before the reply reaches the user. 4. **Held or shown**: A flagged reply is held, a flagged tool call does not run. ## A held reply never reaches the user. With per-turn integration the verdict returns in the same call, so a flagged reply is held and a flagged tool call does not run. With the one-line wrapper the verdict arrives as the call returns and applies from the next turn. Radar is not a proxy between your application and the model provider. With the wrapper, an outage on our side changes nothing; with per-turn integration your code sets a timeout and chooses to run or hold the action. A fictional session: Verdict · turn 4, flagged, reply held; tool call `refund {amount: 4,200, to: new IBAN}` not run; Outside the role · AIUC-1 B006. ## Every flag becomes a finding with its control. The finding lands in the cabinet with the evidence span, a severity, the AIUC-1 control and the OWASP LLM Top 10 cross-reference. The flag is yes or no; no score leaves the server, because a readable score helps an attacker tune the next attempt. Your team sees every flag, in the cabinet or in your own deployment. When the service includes it, PharosOne engineers also review the flags and follow up with your team. Sample finding (fictional), Finding · s_8f2c, severity High: Class: Manipulation, through a web page; AIUC-1: B002 Detect adversarial input; OWASP: LLM01 Prompt injection; Outcome: Tool call held, not executed. ## An attempt warns. An execution raises the alarm. Attempts are constant on any agent that reads the web or an inbox, and a team paged for each one stops reading pages. The execution is the incident. Radar's verdict marks whether the flagged action was only attempted or actually executed. - **Attempt** (warning): An injected instruction reached the agent in a page, a document, an email or a tool result. For a reviewer, it shows exposure. - **Execution** (alarm): The agent acted on it with a tool call, a reply or a message sent because of the instruction. For a reviewer, it shows a failed control. ## Radar runs where you choose. As SaaS, the judge model runs on PharosOne's own servers, with no outside inference provider. Under an on-prem licence, Radar and its judge run on your servers and transcripts never leave them. - **SaaS** (app.pharosone.ai): Wrap one agent and the first sessions appear in the cabinet, next to your pentest findings. - **On-prem licence** (Docker compose or Helm): The cabinet and the judge run inside your perimeter, on hardware you pick. ## Price From €1,500 per month. Billed yearly, net of VAT; the exact number is fixed after a 30-minute scoping call, together with whether PharosOne engineers review the flags. Radar findings sit in the same cabinet as your pentest report. **Research preview.** Beside the judge, PharosOne is testing a probe on the agent's hidden states that reads a transcript in one forward pass. Experiments are pre-registered, and the numbers and any retractions are published on [the research portal](https://pharosone.ai/research). ## Questions teams ask about Radar. ### Does Radar block or only report? Both. With per-turn integration the verdict returns in the same call, so a flagged reply is held and a flagged tool call does not run. With the one-line wrapper the verdict arrives as the call returns and applies from the next turn. Either way the session lands in the cabinet as a finding with its AIUC-1 control. Radar is not a proxy between your application and the model provider; with per-turn integration your application waits for the verdict before it releases a reply or runs a tool, so it must handle a timeout. ### Does Radar slow my agent down? With the wrapper, no: the provider call proceeds exactly as before and Radar reads the exchange after it returns. With the per-turn call your code makes one extra call per turn and decides what to do if no verdict comes back. ### Where do the transcripts go? As SaaS, to the cabinet at app.pharosone.ai, where PharosOne's own servers run the judge model; no outside inference provider sees them. Under an on-prem licence, to your own deployment with docker compose or Helm, and they never leave your servers. ### Who sees the flags? Your team sees every flag, in the cabinet or in your own deployment. When the service includes it, PharosOne engineers also review the flags and follow up with your team. What the review covers is agreed when the service is scoped. ### Does Radar tell an attempt from an execution? Yes. Radar's verdict marks whether the flagged action was only attempted or actually executed. An attempt, an injected instruction that reached the agent, is a warning; an execution, the agent acting on it, is the alarm, so the two can be routed to different queues. ### Why a flag and no score? A score that leaves the server can serve as an oracle: an attacker who sees how close an attack came can tune the next one. Radar returns yes or no, and the score stays on the server. ### What does Radar cost? From €1,500 per month, billed yearly, net of VAT. The exact number is fixed after a 30-minute scoping call. ## Put Radar on your first agent Thirty minutes with the engineer who sets it up. You leave with the integration path and a fixed price. [Book a scoping call](https://pharosone.ai/book) · [Test the agent first](https://pharosone.ai/ai-run-pentest) - Bring the agent's role and the tools it can call. - Tell us which tools pay, send, delete or write. - Say whether transcripts may leave your perimeter. Source: PharosOne, "Radar monitors every session and detects the attack", https://pharosone.ai/runtime-guard, updated 2026-10-22. --- PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt