Skip to main content

​
Overview

Detect is an enforcement mode in Cascade that surfaces safety and security violations in real time while allowing agent execution to continue. Detect mode evaluates policies against runtime activity, classifies violations by severity, and generates findings that can trigger alerts and downstream workflows. Agent behavior is never blocked or modified. Detect mode is designed for production environments where visibility and response are required without introducing execution risk.

​
When to Use Detect Mode

Detect mode is recommended for:
  • Production deployments during early enforcement rollout
  • Agents with moderate operational or security risk
  • Teams that want real-time awareness without blocking actions
  • Security monitoring and compliance workflows
  • Environments where intervention requires human review

​
How Detect Mode Works

Detect mode operates as an active detection and alerting layer on top of Cascade’s tracing system. As agents execute, Cascade continuously evaluates safety and security policies against live runtime context. When a violation is detected, it is immediately classified by severity. Based on this classification, the system can generate active alerts while recording the full context of the event. Agent execution proceeds unchanged, allowing teams to respond quickly without disrupting workflows.

​
SDK Integration

Detect mode builds directly on the existing observability integration and requires no changes to tracing or instrumentation. You can enable Detect mode globally or specify it workflow or agent run.

​
Global Configuration

Python
from cascade import init_tracing

init_tracing(
    project="my_project",
    enforcement_mode="detect",
    endpoint="https://api.runcascade.com/v1/traces",
    api_key="your-api-key"
)

​
Execution-Level Configuration

Detect mode can also be set at execution time using trace metadata.
Python
from cascade import trace_run

with trace_run(
    "MyAgent",
    metadata={
        "agent_id": "agent-123",
        "enforcement_mode": "detect"
    }
):
    agent.run(ticket)
This allows enforcement behavior to vary across agents or workflows within the same project.

​
Recorded Findings & Visibility

Detect mode records and surfaces:
  • Policy violations and near-misses
  • System-assigned severity levels for each finding
  • Active alerts triggered based on severity
  • Full contextual data tied to agent execution
  • Associated LLM calls, tool usage, and reasoning
Findings and alerts are visible in the Cascade dashboard and can be integrated with external monitoring or incident response systems. Detect mode provides actionable, real-time visibility without interrupting agent behavior.