# Signals that wake agents

Let a ticket-volume spike or an output-drift finding start an agent run with the signal attached, debounced, within a daily budget, and through approval by default.

A spike in tickets, or an agent whose answers have drifted, usually needs someone to look into it. A **wake rule** lets the signal start an agent that does, for example a problem-management agent with the cluster of tickets attached, instead of only raising an alert.

## Wake rules

`PUT /api/governance/signal-wakes/{name}` (`agents.update` and Cedar `update` on the agent):

```json
{
  "source": "sentinel",
  "agent": "problem-manager",
  "match": {"min_severity": "high", "prefix": "category:Network"},
  "input": "Tickets are spiking. Find the common cause and draft a problem record.\n\n{signal}",
  "debounce_s": 3600,
  "max_runs_per_day": 5,
  "budget_usd_per_day": 10,
  "require_approval": true
}
```

| Field | Meaning |
| --- | --- |
| `source` | `sentinel`, the ticket-volume spike detector, or `drift`, the [output drift](/docs/monitor/output-drift) check |
| `match` | `min_severity` (sentinel: `warning`, `high` (default) or `critical`; drift: `warning` (default) or `critical`), `prefix` of the spike's signature (`category:Network`, `code:E-*`), and for drift the `metric` and `watched_agent` |
| `input` | What the agent is told. `{signal}` is replaced by the signal as JSON: the spike's count, its baseline and up to 20 ticket ids, or the drift metric and its score |
| `debounce_s` | The same signal does not wake the agent again within this many seconds (default 3600) |
| `max_runs_per_day` | At most this many wakes per UTC day (default 5) |
| `budget_usd_per_day` | Optional. No wake once the agent has spent this much today |
| `require_approval` | Default `true`: the wake is filed in the approvals queue and the run starts only when a person approves it. When it is approved, the rule is read again; if it was deleted, disabled or now names another agent, the approval is refused |

`GET /api/governance/signal-wakes` lists the rules; `DELETE` removes one.

## The run

A woken run goes through the same governed path as a scheduled run, under the trigger name `signal:<rule>`. It is leased, can resume after a crash, and appears in that trigger's run list. Its tools are gated by the agent's postures, policies and autonomy level like any other run.

## Audit events

`agent.signal_wake.saved`, `agent.signal_wake.deleted`, `agent.signal_wake.proposed`, `agent.signal_wake.started`, `agent.signal_wake.debounced`, `agent.signal_wake.over_budget`.