[lloeki]

(Sqreen Ruby engineer here) Agents are mostly glue to bind to and instrument code on the specific runtime/framework as well as communicate security metadata to our servers. Most of the event detection logic is dynamically pushed to the agents and runs isolated. This means security logic can usually be updated without having to update the agents themselves (although we do improve the agents themselves on a regular basis!) or even restart the app/service.