Creates a hidden "honey pot" file and watches it. If any process modifies or deletes this file (typical ransomware behavior), it triggers an alert.
Permissions are shown for transparency. In demo mode these agents are stubbed, and no real privileged actions run unless you wire them into your local runner.
receipts.jsonartifacts/This agent is designed to emit a run receipt with steps + artifacts. See Runs & Receipts for examples.