# MON-03 Real-time anomaly detection

Domain: MON Continuous Monitoring & Human Oversight · HI-AAF v1.3 · Public review · https://humanintel.net/standard/mon/mon-03

Real-time anomaly detection is performed against the deployment baseline, covering volume, tool-use patterns, error rates, output distributions, and fairness metrics.

The agent's behavior in production is compared in real time against the deployment baseline captured under SPC-06. Anomaly detection covers volume, tool-use patterns, error rates, output distributions, and fairness metrics. Anomalies that cross documented thresholds trigger alerts and, for critical anomalies, automatic escalation to the human review queue.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for MON-03: Anomaly detection is active for all production agents; detection covers the baseline metrics from SPC-06; thresholds are documented; alerts are generated and routed to the appropriate team; false-positive rates are tracked and tuned.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Anomaly detection is active for all production agents.
- Detection covers the baseline metrics from SPC-06.
- Thresholds are documented.
- Alerts are generated and routed to the appropriate team.
- False-positive rates are tracked and tuned.

## Framework mappings

- NIST AI RMF: MANAGE 1.1, MANAGE 2.1
- ISO/IEC 42001: A.6.2.4, A.9.4
- SOC 2 (TSC): CC5.2, CC7.3
- EU AI Act: Art. 14(4)
- Singapore: MAIGF Incident Reporting, AI Verify Human Agency & Oversight

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites SPC-06 Behavior baseline capture: https://humanintel.net/standard/spc/spc-06

## Cite this control

Human Intelligence. HI-AAF v1.3, MON-03 Real-time anomaly detection. Public review edition, July 2026. https://humanintel.net/standard/mon/mon-03