The agent containment problem
AI agents are autonomous software that use models to plan and execute actions across tools, APIs, databases, and services. Unlike a model endpoint, which responds to requests, an agent initiates actions. This makes containment fundamentally different from model shutdown — you cannot simply stop serving requests and expect the agent to stop acting.
An agent may hold active credentials, maintain persistent connections, queue actions for later execution, or operate across multiple environments. Containment must address all of these vectors simultaneously.
Containment vectors
Effective agent containment operates on multiple vectors: (1) credential revocation — invalidate the agent's API keys, tokens, and service accounts at the identity provider; (2) tool gateway blocking — revoke the agent's access to external tools and APIs at the gateway level; (3) network isolation — block the agent's egress routes and prevent lateral movement; (4) process suspension — suspend or terminate the agent runtime; and (5) queue draining — cancel or hold any queued actions.
The order of operations matters. Revoking credentials first prevents the agent from re-authenticating if its process is restarted. Blocking the tool gateway prevents actions that use cached credentials. Network isolation is the broadest enforcement but also the most disruptive to other systems sharing the network segment.
Maintaining operational continuity
Containing an agent does not mean stopping the business function it serves. A mature containment architecture includes approved fallbacks: earlier model versions, alternate providers, deterministic rules engines, read-only modes, queue-and-hold modes, and human-operated workflows. The fallback should be activated before or during containment to minimize operational disruption.
The choice of fallback depends on the function's criticality and the nature of the incident. A customer service agent can fall back to a rules engine or human operators. A trading agent should fall back to a read-only or queue-and-hold mode. A physical system controller should transition to a known-safe operating state.
Per-agent identity and authority
Containment at the individual agent level requires per-agent identity: each agent has its own credentials, bounded authority scope, and independent execution context. Without per-agent identity, containment becomes all-or-nothing — you must contain the entire fleet because you cannot distinguish one agent from another.
DecisionHypervisor's authority and delegation model supports per-agent identity with bounded authority grants, delegation chains, jurisdiction scoping, and time-limited execution tokens. Each agent's actions are evaluated against its specific authority, and containment can target individual agents without affecting the fleet.