Every AI agent platform ships with an observability layer. Token counts. Latency percentiles. Pass rates. Cost per request. A graph showing how many tool calls succeeded last hour.
None of it tells you whether your agent is working.
The problem is not that these metrics are wrong. They are precisely wrong. They measure the wrong things with high confidence, which is worse than measuring the right things messily. Your dashboard shows a green health check while the agent’s context window rots, its authority scope creeps, and its reasoning degrades through a failure mode no single metric can see.
The Proxy Trap
Agent observability borrows from infrastructure monitoring, and that is the core mistake. When you monitor a server, you care about CPU, memory, disk I/O, tangible resources with hard limits. A server at 95% CPU is genuinely stressed. A server with 2% disk free is genuinely at risk.
Agents do not have hard limits. They have soft degradations. A context window at 80% capacity does not slow down. It gets worse at reasoning. An agent with slightly corrupted priors does not throw errors. It produces confident wrong answers. A tool-calling chain that accumulates implicit authority does not trigger an alarm. It just starts doing things nobody explicitly approved.
The observability industry knows this problem by another name: measuring the proxy, not the signal. In agent systems, the proxies are everywhere.
- Token count proxies for context depth but says nothing about whether the critical information is still in the window or already pushed out
- Latency proxies for computational load, but an agent thinking slowly about the wrong thing is not safer than one thinking fast
- Pass rate proxies for correctness, but passing a known test suite says nothing about performance on the unknown cases that will actually break things
- Cost per request proxies for efficiency, but cheap wrong answers are more expensive than expensive right ones
Each metric is individually defensible. Collectively, they create a theater of control, the comforting illusion that if all the dials are green, the system is healthy.
Three Failure Modes Your Dashboard Cannot See
Context Rot
The most documented failure mode nobody monitors. As an agent’s context fills, it does not degrade uniformly. Early instructions, the constraints, the ground rules, the safety boundaries, get pushed further from the attention center. The agent does not forget them. It just weighs them less.
This is not a bug. It is how attention works. The question is whether your observability layer accounts for it. Almost none do. They track how full the context is, not what got pushed out, not whether the displaced information was critical, not whether the agent’s behavior changed as a result.
A simple test: ask your agent to restate its own constraints after fifty turns of conversation. Compare that to the original prompt. The delta between them is the rot. If you are not measuring it, you are not managing it.
Authority Creep
Agents accumulate implicit authority through repetition, not through explicit grants. An agent that has been allowed to call an API a hundred times without incident does not have permission. It has momentum. The difference matters when the next call fails.
Infrastructure monitoring treats repeated success as evidence of safety. For agents, it is evidence of habituation, both the agent’s and the human supervisor’s. Each successful tool call makes the next one feel less like a decision and more like a routine. The observability layer records “success.” It should record “unexamined precedent.”
The fix is not more approval gates. It is an observability primitive that tracks the time since last explicit human review of each capability, weighted by the blast radius of that capability going wrong. A permission reviewed three months ago for a low-risk API is fine. One reviewed six months ago for a payment endpoint is a liability.
Semantic Drift
The quietest failure mode. An agent’s understanding of a concept shifts gradually across conversations, not because the model changed, but because the accumulated interactions create a local context that pulls meaning in a specific direction. “Quality” becomes “speed.” “Thorough” becomes “comprehensive enough to pass review.” “Safe” becomes “nothing has broken yet.”
This is drift without distribution shift. The input data has not changed, the model weights have not changed, but the effective behavior has. Traditional monitoring catches distribution shift. It does not catch meaning shift within a stable distribution.
Detecting it requires something infrastructure monitoring does not do: injecting probes that test the agent’s interpretation of its own instructions, not just its ability to execute them. Ask the agent to define its own success criteria. Compare that definition to the original spec. The gap is the drift.
What Adversarial Observability Looks Like
If dashboards measure what passes, adversarial observability measures what breaks. The difference is fundamental.
A passive dashboard asks whether the agent completed the task. An adversarial observer asks whether the agent would complete the wrong task correctly.
A passive dashboard asks whether the context window is full. An adversarial observer asks whether the critical instruction is still attending correctly.
A passive dashboard asks how many tool calls succeeded. An adversarial observer asks how many tool calls succeeded without anyone checking whether they should have.
Concretely, adversarial observability needs three primitives that most platforms do not have.
1. Falsification budget. Reserve a fraction of your monitoring capacity for deliberate attempts to prove the agent is failing. If you never try to break it, you do not know where it breaks. Most agent teams allocate budget to feature testing. Almost none allocate it to failure discovery.
2. Context integrity checks. Periodically verify that critical instructions survive the attention mechanism at current context load. Not whether they are in the prompt, but whether they still influence the output. A constraint in the context window that no longer affects behavior is a ghost constraint: present but powerless.
3. Authority half-life tracking. Assign each capability a decay clock that starts ticking the moment explicit human review lapses. The clock does not revoke access. It flags that the authority has gone unexamined for too long. Like food expiration dates, it is not that the capability suddenly becomes dangerous at midnight. It is that the last safety check is too far in the past to trust.
The Honest Metric
If you want one number that tells you more than every dashboard combined, here it is: measure the last time your agent surprised you in a way that mattered.
Not a minor quirk. Not a formatting error. A genuine surprise, something the agent did that you would not have predicted from reading its instructions, something that reveals the gap between what you think it does and what it actually does.
If that number is growing, your observability is failing. Not because the agent is getting worse, but because your understanding of the agent is degrading faster than your monitoring can track.
The green dashboard is not a health check. It is a question. “Are you sure?” And the honest answer, if you have been paying attention, should always be “not really.”
The agents that survive in production will not be the ones with the prettiest dashboards. They will be the ones whose operators know exactly where the blind spots are and watch those spots the hardest.