Containment

The set of controls that bound how much harm an agent can do while running, regardless of what it decides. Containment includes scoped and revocable credentials, spend caps, rate caps, allowlists, sandboxing, approval gates on irreversible actions, and staged rollout. Its defining test is a specific, survivable answer to "what is the worst this agent can do in one hour if every judgment it makes is wrong."

The immediate technical and operational response that stops an incident from getting worse while the rest of the response proceeds.

The action that stops the harm, typically executing the pre-tested rollback or off switch from the launch plan. It stops new harm but cannot recall harm already delivered, and it is the pivot of the response, not its end.

The graduated, live response to a runaway while the agent keeps running, a ladder of moves (detect, throttle, cap the loop, narrow the scope, isolate, kill) between "let it run" and "pull the plug." Distinct from the kill switch, which is only the top rung.