Anthropic's cookbook describes a reviewer for completed agent sessions. Observed facts: It checks for out-of-allowlist hosts, credentials the agent was not given, unapproved data transfers, retries after blocked calls, and prompt injection in read content. It can read Managed Agents sessions, Messages API logs, or Claude Agent SDK logs. In 20 example sessions, it flags four for action, and Anthropic says all four were staged to exercise the review.
Mechanism: A reviewer analyzes transcripts and produces a ranked report with quoted evidence; network limits and permission policies remain the controls that block actions. Why now: Teams running agents unattended need a way to inspect what happened after execution across different logging surfaces. First implication: Teams can treat transcript review as a triage layer that directs human attention, while retaining preventive limits in the runtime and tool handlers.
Evidence boundary: The four flagged sessions are staged examples, not a measured production benchmark, so the source does not establish real-world recall or precision. The cookbook also estimates a cost for its example review, not a general operating cost across workloads.
First watch condition: Look for independent production evaluations that report both missed incidents and false positives, alongside the policies used to block actions. Whether this workflow improves real security outcomes remains unproven by the supplied source.