Signals
Signals are deterministic rules that annotate the graph. Each looks for a specific, well-understood pattern in prompt text, tool calls, tool results, or tool definitions, and marks the exact activity where it matches. A signal is a finding, not a guess: it fires because a rule matched, not because a model thought something looked off.
The first set we’re publishing is security detections, on by default and maintained by Origin: credential and financial data, prompt injection, risky commands and exfiltration, tool poisoning. Each firing is anchored to the activity it found, so you can jump straight from a finding to the surrounding trace, or read it as a dimension across the fleet in Explore.
Role-based access control
Not everyone who uses Origin needs the same view of it. Until now, everyone who wasn’t an admin collapsed into a single "Member" role, so access was effectively all or nothing.
Role-based access control replaces that with a set of built-in roles that allow for more granular control, assigned by admins from User Management. Enforcement runs across both the interface and the underlying data: each role sees only the sections it should, analytics queries are scoped to the endpoints and data it’s allowed to read, and prompt content stays gated even for users who can see that a signal fired. Roles can map to your directory groups, so access follows the structure you already maintain.