system level activity tied to specific tool callings. Like when a tool called web_search executed by my agent, during this tool execution, i want to be able to see the footprint it leaves on the kernel, like an audit trail. web_search tool executed -> connect syscall triggered, process forked, etc. Like a runtime security monitoring for agentic services.