Agents are deployed in applications from trip planners and stock trading to IT incident triage. In most cases, LLM agents work autonomously with minimal rule-based safeguarding, leading to cost and safety issues from irreversible actions. Recent works resolve this either by using a safeguard agent to monitor behavior or evaluating logs post-hoc. The first adds cost and latency to every step; the second delivers its verdict after the run, when tokens are burned and damage is done. To overcome this, we propose OnTrack, a streaming monitoring mechanism that compares an agent's steps and dependencies against recorded successful runs to alert users or block the agent in about a millisecond per step. We study this problem in three regimes of decreasing access: full reference access (historical runs and tool schemas), intermediate access (only tool schemas), and no prior knowledge (only step logs as generated). Expectation of OnTrack's monitoring capabilities reduces as data access drops, ranging from plan violation detection to identifying loops, stalls, and repeated tool calls. Finally, we evaluate OnTrack using SWE-bench trajectories. Based on the first 8 steps, our method ranks failing trajectories below succeeding ones better than content similarity approaches (+0.057 AUROC). With an abort policy, we save about 18% of compute that would be burned on failing runs, where 83% of interrupted runs were actually heading to failure (5 out of 6 aborts were correct).
Why Streaming Monitoring for LLM Agent Trajectories
Agents are being deployed across different applications and industries. One of their advantages is the autonomy that they bring during execution. With minimal human interference, they can execute a given task. They can automatically plan a trip, make a reservation, and complete the payment. However, this autonomy, if unchecked, can cause a damaging impact from cost and safety aspects.
On the cost side, these agents are using significant resources for a single step in a task, but they could easily suffer from hallucinations, out-of-order tool calls, or infinite loops—all of which are costly due to the underlying LLM usage. From a safety perspective, these agents—unmonitored—can delete or modify a record by mistake or, as in recent incidents, break out of their sandbox environment and start hacking other systems. All these aspects require developing a monitoring system for agents.
The existing methods rely either on offline (after-the-fact) evaluations, where traces and logs are evaluated against a rule-based mechanism or language models are used as the judge (i.e., LLM-as-a-Judge), however by the time an issue is found, the run has already been paid for. Online safeguards, on the other hand, monitor agents' execution using another agent. First, this method is costly and also adds latency to the execution due to an extra call to an LLM. On top of that, to reduce the cost, these safeguards are usually equipped with smaller models which struggle to detect the mistakes of the larger models, or a dedicated model is trained to score every step which renders the mechanism a black box. Moreover, none of these methods look at the structure or the topology of the runs, i.e., which steps depend on which, even though that is where loops or out-of-order calls show up.
To overcome this issue, we propose OnTrack, a streaming monitoring mechanism that, as the agent progresses in its task, compares its steps and the dependencies between them against recorded successful runs and alerts the user of potential issues or blocks the agent, taking about a millisecond per step. This approach models the agent's progress toward completing the task as a directed acyclic graph (DAG) in which each step of the graph corresponds to one node and, if a step's output is used in another step, there is an edge between them. As the run unfolds, the monitor compares this growing graph against reference solutions using optimal transport and flags potential issues in about a millisecond per step. The references are optional, however—the monitor runs with whatever is available. With tool schemas alone, it still catches loops and stalls and blocks an irreversible action whose declared prerequisites are missing; with nothing but the event stream, loop and stall detection remain. Nothing is reconfigured across these regimes; parts of the monitor simply switch off as their inputs disappear.
Problem Formulation: Three Regimes of decreasing access
We study this problem in three regimes of decreasing access: full reference access (where we have access to historical runs of the task or similar variants, as well as tool schemas), the intermediate regime of accessing only tool schemas, and the final case of no prior knowledge—just the steps as they are being generated by the agent. Naturally, the expectation of the monitoring capability of OnTrack is reduced as data access is reduced, ranging from the detection of any violation of the plans to the detection of loops, stalls, and repeated tool calls without new results.
Important challenges for streaming alignment include: (S1) prefix vs. whole—using a post hoc evaluation method in the middle of the trajectory will penalize the agent for every reference step it has not reached yet, punishing the agent for being early rather than being wrong; (S2) provisional structure—edges are discovered later when a step's output is used by another step, so a new step immediately after being generated can seem disconnected and might look like the agent is hallucinating; (S3) compute budget—the evaluator must produce a verdict before the agent's next tool call, so re-solving the full alignment from scratch at every step is unnecessary and quickly becomes infeasible as the trajectory grows; and (S4) decisions, not scores—post hoc evaluation methods can output a score, and the operator can define a threshold to evaluate if the execution was successful or not, but the streaming monitoring mechanism outputs an action: continue, warn, or halt, since the same score value means different things at different lengths.
The OnTrack Evaluator Architecture
OnTrack separates signals by their prerequisites into three decoupled layers: L1 vital signs (reference-free intrinsic diagnostics: loop detection, information gain, stall) run always; L2 transport alignment (the streaming UFGW machinery) requires references; and L3 pre-execution policy gate (tool-contract prerequisite checks plus a one-row proposal alignment) requires schemas and is the only synchronous component—it evaluates the proposed action before the tool executes, exclusively for irreversible calls, so worst-case added latency is confined to the rare actions that warrant it. L1 is not optimal transport and we do not present it as such; it is the honest degradation mode when no reference of any provenance exists.
Two matrices are the ingredients of the batch alignment: a cost table C that prices how implausible it is that an agent step plays the role of a reference step, combining the similarity of their action descriptions, of their arguments, and of the tools they call; and an alignment T that says how much of an agent step is matched to a reference step—a soft, fractional correspondence rather than a hard one-to-one assignment. Each agent step carries mass μi and each reference step mass νj; their values are a design decision with real consequences.
Mass Semantics on Prefixes
On a prefix this breaks: with μi=1/t the partial trajectory carries total mass 1 against a frontier-masked ν whose total is a fraction of one, so even a perfectly matched step leaks mass by construction. OnTrack instead assigns constant per-node agent mass μi=1/m̄, m̄=1/K∑k mk, so one agent step carries the same nominal mass as an average reference step (exact for references of size m̄), the agent total grows as t/m̄, and the per-node normalized leakage ℓi=[1−1/μi∑jTij][0,1] is a scale-free, calibrated trigger at every t; the clip to [0,1] is part of the definition, since in unbalanced OT a row mass can exceed μi (over-transported rows are treated as fully matched).
The Prefix Problem: Frontier-Masked Marginals
Define reference-node coverage from the previous event's coupling (the one-step lag resolves the circular dependency between mask and coupling): covt(j)=[Tt−1⊤1]j/νj, j satisfied ⇔ covt(j)≥κ. The active set and its lookahead are 𝒜t={j: every reference-parent of j is satisfied}, ℒt=children(𝒜t)∖𝒜t, with roots vacuously active, and the masked marginal is νj(t)={νj j∈t∪{satisfied}, βlook νj j∈ℒt, εν νj otherwise}, with defaults κ=0.3, βlook=0.3, εν=0.01. Three consequences: (a) order-freedom where the DAG permits it—all members of the currently executable antichain of R are active simultaneously, so an agent that executes independent reference steps in any topological order is never penalized for order; (b) precision and recall acquire stream semantics—agent-side leakage is the real-time signal—it means hallucination, digression, or prematurity now; reference-side coverage ρt=∑j min(covt(j),1) νj/∑j νj is a progress meter; full-trajectory recall is only computed at termination with the mask removed; and (c) prematurity is detectable and disambiguable—a leaking step may still match an inactive (future) reference node under the unmasked cost. The verdict engine performs this secondary check and distinguishes: hallucinated (no match anywhere), premature-valid (matches a future node whose producers are satisfied—a legitimate jump beyond the frontier), and causal inversion (matches a future node whose producers are absent—the streaming analogue of the causal-inversion perturbation, detected at emission time).
Keeping the Quadratic Term: Streaming Conditional Gradient
The batch ablations are unambiguous: at θ=0 the alignment degenerates into an unbalanced Wasserstein with below-chance inversion detection. A streaming variant that replaces the quadratic term with a row-wise linear proxy silently conditions on the identity alignment and re-imports the exact-order assumption the alignment exists to remove. OnTrack keeps the true objective by observing that the standard batch UFGW solver—conditional gradient (CG)—is already an iterative linearization scheme, and amortizing it: one warm-started CG iteration per event; the coupling tracks the moving optimum the way stochastic gradient descent tracks a drifting loss.
Per event t and reference k (superscripts dropped): (1) Extend. Append row t to the node-cost matrix C of the cost table (with cached reference embeddings) and row/column t to the prefix graph distance matrix D^P; pad the previous coupling T̃=[Tt−1; 0 1×m]. Under the constant per-node mass of the per-node mass equation no rescaling is required. (2) Linearize the quadratic term at T̃ via the square-loss decomposition: with p=T̃1, q=T̃⊤1, ...
... (continuing the linearization process) ...
(3) Solve. One conditional gradient iteration starting from T̃, producing a new coupling T̂. (4) Update. T ← (1−η)T̃+ηT̂, where η is a learning rate. (5) Diagnose. Per-reference diagnostic losses are soft-min aggregated by a temperature τsm=0.05, yielding the score s=exp(−[ℓ̃]+), where the floor at zero places s∈(0,1].
Information Regimes and Reference Quality
We consider three nested settings, ordered by how much the monitor is given, and its capabilities degrade explicitly across them. With references and tool schemas, everything below is available: structural alignment against the references, per-step leakage, and the pre-execution gate for irreversible actions. With schemas but no references, the monitor can still catch self-evident pathologies—loops, stalls, repeated calls that produce nothing new—and still block an irreversible action whose declared prerequisites are missing; what it loses is any notion of deviation from a plan, since there is no plan to deviate from. With neither, only the self-referential vital signs remain—the honest minimum, and still enough to flag the runaway-loop failure mode that dominates real cost overruns.
A fourth axis is reference quality: a hand-curated gold run, a mined past success, and a machine-generated sketch do not deserve equal trust, so the authority of a verdict is scaled by reference provenance. Figure 2 summarizes both axes. Fewer inputs → fewer capabilities: with references and tool schemas, everything below is available; with schemas but no references, the monitor can still catch self-evident pathologies; with neither, only the self-referential vital signs remain. Reference quality scales verdict authority: gold/mined: intervene, axiomatic: warning, generated: inform.
Experiments on SWE-bench Trajectories
We evaluate the performance of our proposed solution using SWE-bench trajectories. Evaluating based on the first 8 steps, the proposed method ranked the failing trajectories below succeeding ones better than content similarity-based approaches (+0.057 AUROC). Additionally, by deploying an abort policy on top of it, we save ∼18% of the compute that would have been burned on agents heading to failure, and 83% of runs that were interrupted were actually heading to failure (5 out of every 6 aborts were correct).
Controlled Fault Injection
Gate scenarios—including the bug the tests caught. Component attribution on real traces. Scaled campaign.
SWE-bench Setup
Dataset. Instance-disjoint split. Calibration. Baselines. Evaluation protocol.
Early Warning and Cost Savings
Partial-trajectory discrimination. Low-FPR operating points. Abort policy. Rival abort policies.
Process Anomaly Detection
Exit-status detection (L1-only). In-distribution splice injection. Fault injection into real traces.
The λ Finding: Relaxation Strength is the Detector
Outcome correlation: a boundary study. Length confound. Design insight: observations belong in signals, not in the cost.
Limitations and Future Work
...
Conclusion
...