Struct AnomalyDetector 

pub struct AnomalyDetector { /* private fields */ }

Behavioral anomaly detector.

Implementations

impl AnomalyDetector

pub fn new(config: AnomalyConfig) -> Self

Create a new anomaly detector with the given config. Pre-compiles intent keywords into RegexSets for O(1) matching.

pub fn classify_intent(&self, declared_intent: &str) -> IntentTier

Classify the declared intent into a privilege tier. Highest matching tier wins: Admin > Write > Read > Unknown.

pub fn detect( &self, declared_intent: &str, operation_type: OperationType, tool_name: &str, ) -> AnomalyResponse

Detect anomalies for a tool call given the session’s declared intent.

Tiered detection:

• Admin intent: delete ops flagged, all others normal
• Write intent: admin ops flagged, everything else normal
• Read intent: write/delete/admin ops flagged
• Unknown intent: no anomaly detection

pub fn detect_with_args( &self, declared_intent: &str, operation_type: OperationType, tool_name: &str, arguments: Option<&Value>, ) -> AnomalyResponse

Detect anomalies with argument-level scanning.