Tool Storm Alert

Get alerted when one AI agent run makes an unusual number of tool calls. Tool Storm Alert checks every trace as it lands and opens a violation above your limit. Use Loop Cap to stop a run live.

After Run(Detective)Checked after the trace lands, so it records and alerts

An agent is supposed to call a handful of tools per task. One run calls the same search tool eighty times. Tool Storm Alert checks every trace as it arrives and opens a violation when a single run goes over your limit.

Runs On
After each trace lands, one run at a time
You Set
The most tool calls one run should make.
Your Agent Sends
Nothing extra. Normal tracing is enough.

The template starts at a Tool Call Count above 25 for a single run, with Warning severity. You can change every value.

What Happens

What Traccia seesResult
A run makes your limit or fewer tool callsNo violation.
A run makes more tool calls than your limitA violation opens for that trace. With Warn or Block, the next governed run is warned or stopped.
A later run is fineThe earlier violation stays Open until someone Acknowledges it.

This runs after the trace is accepted, so the run that triggered it is never undone. Observe records the violation. Warn also warns the next governed run. Block stops the next governed run. Ingest never rejects a trace because of a policy.

Set It Up

  1. In the app, open Policies and click Create Policy.
  2. Choose Tool Storm Alert under After Run.
  3. Give the policy a name and pick its scope: the organization, a workspace, or one Agent ID.
  4. Leave Metric on Tool Call Count and set the Threshold to the most calls one run should make.
  5. Pick a mode. Observe only records. Warn and Block act on the next governed run.
  6. Turn on Email Alerts if you want mail when a violation opens.
  7. On Review, run Simulate Last 7 Days to see how often it would have matched, then click Activate Policy.

Good To Know

  • This is a Per Trace policy. Each trace is judged on its own, so there is no window and nothing averages out.
  • Tool Storm Alert reports a run that already finished. To stop a runaway run while it is happening, use Loop Cap.
  • On a Per Trace policy, Evaluate Now replays the rule against recent traces and opens any violations that were missed.

Where You See Results

Open the policy's Violations tab for what needs attention and Decision Log for every check. See Violations for the full lifecycle.

Next Steps

Loop Cap

Stop a run that calls too many tools, live.

Traces

Open the run and see which tool repeated.

Policies

Every template, plus Observe, Warn, and Block.

© 2026 Traccia.