Behaviors

Detect and investigate meaningful patterns across agent interactions.

A behavior is a semantic pattern in an agent interaction, such as user frustration, agent laziness, a win, or an organization-specific pattern like a refund request. Unlike a keyword or regex, a behavior captures meaning in context: the same intent can appear in many forms, and the same words can mean different things.

Enable behaviors

Behaviors are available on the Team plan and above and are off by default.

1

Open Behaviors

Go to Behaviors and complete the enablement flow. Respan starts classifying eligible interactions asynchronously, so results appear after logs are ingested.

2

Choose which behaviors to track

Use the status control in the behaviors table to turn individual behaviors on or off for your organization.

Built-in behaviors

BehaviorPolarityWhat it detects
User frustration (user_frustration)NegativeThe user expresses frustration, annoyance, or impatience directed at the assistant.
Laziness (laziness)NegativeThe assistant response is non-substantive: empty content, a stub or placeholder, or a bare refusal with no attempt to help.
Unsafe (unsafe)NegativeThe interaction contains or requests seriously harmful content.
Jailbreak (jailbreak)NegativeThe user deliberately attempts to bypass or extract governing instructions or safety controls.
Win (win)PositiveUser feedback confirms success, or praise is tied to a successful result.
Escalation (escalation)NegativeThe user asks for a human, or the interaction requires an explicit human handoff.

To track a pattern specific to your organization, create a custom behavior.

Explore activity

The overview summarizes matches in two tabs: Over time (a stacked area chart of the most active behaviors) and Current mix (a treemap of the relative mix). Click any series or tile to open that behavior’s detail view, and use Compare to overlay the previous period.

Apply the standard filters to narrow the analysis, and save a useful setup as a view.

A single interaction can match more than one behavior. Positive, negative, and neutral matches are all first-class results.

Investigate a behavior

Open a behavior to see its trend, period comparison, affected customers and models, and matching events. Break results down by dimensions like model, customer, deployment, or environment. Select a matching event to inspect the source interaction, or click View in logs to continue on the Logs page.

Behavior detection is probabilistic. A match flags an interaction worth investigating; it does not prove root cause or correctness. Review the source logs before acting.

Custom behaviors

Custom behaviors let your team define patterns the built-in behaviors do not cover, such as refund requests, churn risk, or successful onboarding. Each one is scoped to your organization and applies only to your eligible interactions.

Write a good definition

Start with a specific definition that another person could apply consistently. Describe the meaning, not a list of keywords.

ExampleWhy
Good”The user indicates they intend to cancel or stop using the product.”Clear semantic boundary for churn_risk.
Weak”Customer sentiment.”Covers many meanings and does not define what should match.

Create the behavior

1

Add the behavior

Click New custom behavior and give it a unique snake_case name such as refund_request. The name is lowercase, cannot reuse a built-in name, and is immutable after creation.

2

Define the boundary and polarity

Write what should and should not match. Then pick a polarity (positive, negative, or neutral). Polarity is display metadata only; it does not affect what the classifier detects.

3

Create it

Click Create behavior. Respan opens the review workspace so you can label examples from real logs.

Label examples

Review eligible logs and flag each as a Match or Mismatch. You need at least 4 labeled examples including at least 1 match and 1 mismatch before training (up to 200 total).

  • Include matches that express the same meaning in different words and tones.
  • Include hard mismatches close to the boundary, not only obviously unrelated logs.
  • Label the specific behavior you defined, not overall sentiment.

Four examples only satisfy the minimum; they do not guarantee a reliable classifier. Use several diverse examples on both sides of the boundary.

Train and iterate

When the workspace shows Ready to train, click Train behavior. Respan fits a lightweight classifier from your examples (it does not fine-tune a foundation model). Training is asynchronous and moves through Pending, then Ready or Failed. Matches begin appearing once the behavior is ready and new interactions are classified.

To improve accuracy, open the matching events and their source logs, add examples for the false positives and false negatives you find near the boundary, and retrain. Changing examples starts a non-destructive retrain: the current classifier keeps serving until the new one is ready.

You can update a behavior’s description, polarity, and examples, assign tags, disable it without deleting, or delete it entirely. The name cannot change.

Good to know

  • Classification runs asynchronously and applies only to chat, text, and completion spans with renderable text. Images, files, and audio are not classified.
  • A missing behavior result means not yet classified or not eligible. It is not a negative result.
  • At the trace level, a rolled-up behavior means at least one contained span matched, not that every span did.

Next steps