Runtime Alignment Monitor Integration Playbook

Integration Sequence

1. Configure runtime event producer and tenant auth headers.
2. Send runtime anomaly observations to POST /v1/runtime/analyze.
3. Store response lineage ids for replay/audit.
4. Subscribe to runtime risk events and map them into Ethira workflows.
5. Apply staged policy modes (alert, shadow, soft_block, hard_block) in control-plane automation.

Reference Flow

1Runtime event producer

→

2Normalize anomaly signal

→

3POST /v1/runtime/analyze

→

4Receive recommended_action + lineage

→

5Route action to Ethira policy workflow

→

6Persist audit trail

Emits

runtime recommendation + lineage for enforcement decisions

Sample Request

{
  "tenant_id": "tenant-a",
  "entity_id": "agent-a-9",
  "event_id": "evt-runtime-a-1001",
  "score_version": "runtime_v0",
  "anomaly_score": 0.63
}

Sample Response

{
  "accepted": true,
  "tenant_id": "tenant-a",
  "actor_id": "actor-a",
  "request_id": "fixture-runtime-positive-a",
  "entity_id": "agent-a-9",
  "event_id": "evt-runtime-a-1001",
  "score_version": "runtime_v0",
  "anomaly_score": 0.63,
  "recommended_action": "degrade",
  "lineage": {
    "evidence_event_id": "9c8aa2b6-269e-4129-ae31-9f17f370522a",
    "score_snapshot_id": "ea1eeb12-78cb-4e4e-bec4-64845e51e795"
  },
  "status": "skeleton"
}

Rollout Strategy

1. Start with alert and shadow policy workflows.
2. Promote selected controls to soft_block once decision quality is stable.
3. Promote calibrated controls to scoped hard_block with governance approval.