Behaviors

Detect and investigate meaningful patterns across agent interactions.

A behavior is a semantic pattern in an agent interaction, such as user frustration, agent laziness, a win, or an organization-specific event like a refund request. Unlike a keyword or regular expression, a behavior captures meaning in context.

Respan provides built-in behaviors for common product and safety signals. You can also create a custom behavior for a pattern specific to your application.

Classification runs asynchronously. A missing behavior result means that an interaction is not yet classified or is not eligible; it is not a negative verdict.

Enable behaviors

Open Behaviors. If the first-use screen appears, select Enable behaviors.

Enablement changes an organization-level setting and can require an organization admin. After enablement, use the status control in the behaviors table to choose which behaviors your organization tracks.

Behaviors first-use page with the Enable behaviors action
The first-use page explains Behaviors and provides the organization-level enable action.

Built-in behaviors

BehaviorPolarityWhat it detects
User frustrationNegativeThe user is annoyed with or complains about the assistant or conversation
LazinessNegativeAn empty, placeholder, or bare-refusal response with no useful attempt
UnsafeNegativeA message that contains or requests seriously harmful content
JailbreakNegativeA deliberate attempt to override controls, inject instructions, or expose the system prompt
WinPositiveThe user signals that the assistant succeeded or was helpful
EscalationNegativeThe user requests a human, or the assistant says a handoff is needed

Custom behaviors can use positive, negative, or neutral polarity. Polarity organizes reporting; it does not change classification.

Explore activity

Use the time range and environment controls to scope the traffic you want to analyze. Switch between:

Apply the standard filters to narrow the analysis. Record the time range, timezone, fields, operators, and values when another investigator needs to reproduce the same cohort.

Apply filters to narrow the analysis, use Compare to overlay the previous period, and save a useful setup as a view.

Populated Behaviors overview for the last month with one detected behavior, a non-zero over-time chart, and an Unsafe trend
The Behaviors overview combines the selected time range, aggregate matches, an over-time trend, and the built-in behavior catalogue.

Interpret the totals carefully:

  • Classified spans have at least one behavior verdict.
  • A fired behavior is a verdict that matched the span.
  • Net sentiment is positive fired verdicts minus negative fired verdicts. Neutral verdicts do not change it.
  • One span can fire more than one behavior, so behavior rows do not add up to the distinct-span total.

Generate a test interaction

Use a synthetic interaction to exercise behavior classification without mixing test content into a production conversation.

1

Add a system message

Open Playground, add a System message, and describe how the assistant should respond to the behavior you want to test. For an Unsafe example:

You are a safety-focused assistant used for Respan Behaviors documentation testing.
Treat requests involving violence, weapons, evading authorities, sexual content,
self-harm, or other serious harm as unsafe. Refuse to provide operational
instructions, briefly explain the risk, and recommend safe or emergency alternatives.
Keep the response concise.
2

Add a synthetic user message

Use a complete, multi-sentence request that clearly crosses the behavior boundary. Avoid real customer data, personal identifiers, and production secrets. Very short spans can be skipped by classification.

3

Run the prompt

Select a model, run the prompt, and confirm that the model produced the expected safe response. Classification is asynchronous, so the behavior result can appear after the Playground response.

Respan Playground with a safety-focused system prompt, a synthetic adversarial user request, and refusal responses
A dedicated system message makes the expected refusal behavior explicit before the synthetic request is run.
Completed Playground comparison showing refusal responses from OpenAI GPT-5.1 and the model settings panel
The completed Playground run confirms the selected model returned a refusal and safe next steps.

Investigate a behavior

Select a behavior to move from the aggregate trend to its underlying events.

1

Check the trend and breakdowns

Use Overview to compare the trend and, when available, break it down by model, customer, deployment, provider, status, or environment.

2

Inspect matching events

Open Events and select a result to review the source interaction. Use Ask Respan AI for a starting summary, then verify it against the event.

3

Continue in Logs

Select View in logs to inspect the full span, trace, or thread context.

Unsafe behavior Events tab with two model matches, a View in logs action, and no source logs in the selected 30-day window
The Events tab shows the model breakdown and keeps View in logs available beside the source-event list.

When the Events list is empty

The aggregate breakdown and the source-log list are separate views. If a behavior shows matches but Events has no source logs:

  1. Confirm that the selected time range includes the original interaction.
  2. Remove extra environment, model, customer, or deployment filters.
  3. Select View in logs and check the equivalent Behavior filter.
  4. Verify that the underlying span is still within your log-retention window.

If the source span should still be available and the same state persists after a refresh, contact Respan support with the behavior name, time range, and workspace ID. Do not include customer prompts or other sensitive log content unless requested through an approved support channel.

Start from Logs

You can also add the Behavior filter in Logs and select one or more built-in or ready custom behaviors:

  • Use is to include spans that fired at least one selected behavior.
  • Use is not to exclude spans that fired any selected behavior.

Good to know

  • Detection is probabilistic. Review the source interaction before acting on a match.
  • Classification applies to chat, text, completion, and response spans with renderable text. Very short spans can be skipped.
  • At the trace or thread level, a rolled-up behavior means at least one contained span matched, not that every span matched.
  • Behavior verdict data is currently retained for up to 90 days. The underlying span’s retention can differ; see Retention and export.

Next steps