INCIDENT RESPONSE FOR AGENTS

CONTAINING HARMFUL OR RUNAWAY BEHAVIOR Containment means stopping the damage from spreading before the root cause is fully understood. Priority number one is to stop the harm, and priority number two is to find the cause. Containment tools include the following. A kill switch: a control that immediately stops an agent or all agents. Pausing: freezing a run so that it can be examined and possibly resumed. Budget tracking limits: automatic stops when spending passes a cap, as built in Chapter 25. Disabling a tool or permission: removing the agent's access to the dangerous capability while leaving other functions alive. Rolling back: returning to the last known good version, as practiced in Chapter 58. Rate limiting or blocking specific users or inputs, if the trigger is an attack. Quarantine: isolating suspicious outputs, accounts, or data for review. Falling back to safe mode: for example, requiring human approval for every action. Containment should be proportionate. Shutting down everything for a minor glitch may cause more harm than the glitch. But when real harm is occurring, it is better to stop first and ask questions later. After containing, communicate. Tell affected users and stakeholders clearly what happened, what was done, and what to expect next, without hiding facts.