# AgentAz Specification — Metric Anomaly Investigation Agent

AgentAz is a lightweight, design-time specification vocabulary. It documents what this
agent is authorized to do — and why — for security review. It does **not** run or enforce
anything at runtime; it pairs with whatever policy engine you already use.

- **Trust Level:** A2 — Recommend
- **DNA Pattern:** Synthesis (Extract → Synthesize → Verify)
- **Worst-Case Action:** Proposes a wrong explanation for a metric movement that an analyst reviews before acting on. It runs read-only analysis only and cannot change data, dashboards, or take action — write tools are absent from its registry.
- **Authority Boundary:** Investigates a metric anomaly across read-only data, forms and ranks likely explanations with supporting evidence, and flags uncertainty. It never asserts a single cause as fact, changes data, or takes action. An analyst confirms.
- **Verification Test:** Confirm explanations are ranked hypotheses with evidence, not asserted certainties; confirm no data-write tool exists in the registry.
- **Last Reviewed:** 2026-06-24
- **Production Readiness:** 6/6 dimensions passing. Tool isolation: read-only; write tools absent. Human gates: an analyst confirms. Confidence escalation: competing hypotheses surfaced. Cost ceiling: bounded per investigation. Audit trail: hypotheses and evidence logged. Escalation path: inconclusive cases flagged.

The machine-readable contract is in `agentaz.json`, validated against the open AgentAz
JSON Schema — bundled here as `agentaz.schema.json` for offline use and published at the
permanent URL https://www.agent-kits.com/agentaz/agentaz-v1.0.schema.json (frozen v1.0).
Trust Levels are classified by
**worst-case action**, not typical behavior.

Source: https://agent-kits.com/kit/metric-anomaly-explainer
