c15 — Agent-Native Audit: Did the Egress-Traffic Hypothesis Leak In?

Question (from the requester): We are shifting completely to an agents ecosystem. Analyze each persona-app page for relevance to agents, and make sure none of our old hypothesis — egress-traffic governance — leaked in.

Short answer: it leaked in pervasively. Almost every page is the old traffic-observability product wearing agent vocabulary. Evidence (term counts in the actual .vue source):

*egress-matrix's "agent" hits are mostly "Tool APIs" used as a network destination class — not capability framing.

Root cause

c15 descends from Phase 1, which re-framed app.qpoint.io — an API/traffic observability product — "through an agent-governance lens." That lens silently encoded a mental model:

OLD model (leaked): an agent is a source of network egress. Governance = observe and control its outbound traffic (destinations, requests, bytes, sensors, proxy enforcement).

The agents ecosystem needs the opposite mental model:

NEW model (target): an agent is an autonomous actor. Governance = control and observe its capabilities, actions, instructions, decisions, and outcomes — most of which never appear as network egress at all.

The leak isn't cosmetic wording — it's the unit of analysis. The whole app reasons about network destinations and requests when it should reason about actions, tools, tasks, and behavior.

Per-page verdict

Relevance = how agent-native the page is (0 = pure traffic governance, 5 = fully agent-native).

Keep (agent-native at the core)

agent-spend — Relevance 4 · Keep, minor reframe. Cost/spend per agent is genuinely agent-native and a real gap-closer. Leak: it derives spend from "agent egress" bytes and uses "cost / 1k req." Agents are metered by invocations, tokens, and tool calls, not egress volume. Fix: meter by agent run / task / tokens; drop "egress-derived" and "requests."

risk-report — Relevance 3 · Keep the container, replace the contents. A ranked risk register is framing-agnostic. But every finding is a traffic finding ("PII → unapproved LLM endpoint," "egress is default-allow," "agent calling OpenAI"). Agent-native findings: unauthorized action taken, instructions modified, excessive tool permissions, task failure spike, prompt-injection detected, goal misalignment.

Reframe (right idea, traffic-rooted execution)

agent-registry — Relevance 3 · Reframe. An inventory of agents is core agent-native. But the profile describes each agent by egress destinations, API tokens, and data-scope — network identity. An agent profile should be: purpose/goal, capabilities & tools it can use, instructions/system prompt, autonomy level, owning human, recent tasks & outcomes. Identity ≠ API credential.

posture-board — Relevance 2 · Reframe. The index is fine; its categories are traffic governance: "Egress Control," "Coverage" (=sensor coverage). Agent-native posture dimensions: Capability/least-privilege, Action-safety (guardrails on dangerous actions), Instruction integrity, Autonomy controls (human-in-the-loop), Outcome quality, Spend discipline.

agent-reliability — Relevance 2 · Reframe. Pure network SLO (availability %, p95 latency, error rate, retry storms) — this is /traffic/performance. Agent reliability = task success rate, goal completion, output quality, hallucination/error rate, human-intervention rate. A slow HTTP call is not the agent reliability story; a failed task is.

data-flow — Relevance 2 · Reframe. "Sensitive data → LLM endpoint" is a network-egress flow. The agent-native concern is data-in-context: what data an agent reads into a prompt or moves via a tool (export, email, write). Reframe producer→agent→tool/action, not producer→agent→destination.

dataset-views — Relevance 3 · Reframe. Scoping what an agent can access is agent-relevant, but it's framed as "views over the traffic dataset." Agent-native: what knowledge / memory / data sources / RAG corpora an agent may read — retrieval scope, not a filter over captured traffic.

Replace (the page is the old hypothesis)

egress-matrix — Relevance 1 · Replace. The clearest leak — literally "Egress Control," agents × network destination classes (Approved/Unapproved LLMs, Tool APIs, Internal, Unknown), default-allow/deny on domains. Replace with a Capability / Action Authorization matrix: agents × what they may do (use the email tool, write to prod DB, execute payments, call sub-agents) — authorize actions, not destinations.

audit-trail — Relevance 1 · Replace. Named "Agent Egress Audit Trail" — an HTTP request log (method, status, destination, token, verdict). This is /traffic/requests. Replace with an Agent Activity / Decision log: the task the agent pursued, its reasoning/tool-call trace, the actions it took, and the outcome — not packets.

stacks — Relevance 1 · Replace. Proxy/middleware enforcement chain ("LLM Allow/Deny," "PII Redaction" adapters) = the Qproxy stack. Replace with Action Guardrails & Approvals: policy on what agents may do, required human approvals for high-risk actions, tool-permission gates — guardrails on behavior, not a network pipeline.

sensor-coverage — Relevance 1 · Replace. Entirely network-capture ("% of agent egress under sensor coverage," "egress capture on/off," "deploy sensor"). Replace with Agent Instrumentation Coverage: which agents/runtimes/ frameworks are registered and reporting their actions — are we seeing agent behavior, not agent packets. Blind spots = unregistered agents, not uncaptured traffic.

data-residency — Relevance 1 · Replace. "Where payloads live" = storage of captured traffic bodies (object store, event store, qscan). Replace with Agent Memory & Record Stores: where conversation history, agent memory, vector stores, and task records live and how long they're retained.

Vocabulary to purge vs. adopt

Purge (egress-traffic hypothesis): egress, endpoint, destination, domain, request, connection, bytes, bandwidth, sensor, traffic capture, proxy, middleware/adapter chain, p95/p99 latency, payload, allow/deny domains, IP, geolocation, "what it called."

Adopt (agents ecosystem): capability, tool, action, permission/authorization, instruction/ system prompt, guardrail, task/run, goal, outcome/result, decision/reasoning trace, autonomy level, human-in-the-loop/approval, delegation/sub-agent, memory/knowledge, behavior, "what it did."

What's entirely missing (no page covers these)

These are first-class in an agents ecosystem and absent from c15:

1. Capability & tool authorization (what an agent can do).
2. Instruction / prompt governance (system prompts, guardrails, change control).
3. Task outcomes & quality (success rate, goal completion, output quality).
4. Action guardrails & human approvals (high-risk action gating).
5. Agent topology / delegation (multi-agent: who delegates to whom, sub-agents).
6. Behavioral risk (unauthorized actions, prompt injection, goal misalignment, harmful output).

Recommendation

The leak is structural, not page-by-page — so don't patch wording. Reset the unit of analysis from network egress to agent actions & outcomes, then:

• Keep & lightly reframe: agent-spend, risk-report, agent-registry, dataset-views.
• Reframe substantively: posture-board, agent-reliability, data-flow.
• Replace outright: egress-matrix → Capability/Action Authorization; audit-trail → Agent Activity/Decision log; stacks → Action Guardrails & Approvals; sensor-coverage → Agent Instrumentation Coverage; data-residency → Agent Memory/Record stores.
• Add the six missing surfaces above, leading with Capability/Action Authorization, Instruction/Prompt Governance, and Task Outcomes — the spine of agent governance.

Net: roughly 2 of 12 pages are agent-native today; ~5 are reframable; ~5 are the old product re-skinned. A clean agents-ecosystem pass (wf2) should be authored from the agent-as-actor model directly, not derived again from the traffic product.