Forced Quarantine

Upon detection of anomalous behavior, the agent is instantly moved to a micro-segmented VLAN with no default gateway to production systems. All ingress and egress traffic is routed through a transparent proxy that logs every packet. The quarantine network enforces a strict allowlist-only communication policy, typically permitting only connections to a forensic logging service and a secure shell for human analysts. This prevents lateral movement and data exfiltration while preserving evidence.

The agent's operating system processes are not terminated but are instead placed in a frozen cgroup or equivalent container runtime state. This suspends execution without destroying volatile memory contents, preserving the exact state of:

• Open file descriptors and network sockets
• In-memory data structures and partial computations
• Active tool call chains and their intermediate results This allows forensic analysts to perform a live memory dump before any cleanup routines execute.

All credentials, API keys, and service account tokens previously issued to the agent are immediately invalidated at the identity provider level. The quarantine protocol triggers an automated rotation of any secrets the agent had access to. Simultaneously, the agent's service mesh sidecar proxy is reconfigured to return HTTP 503 Service Unavailable for any outbound tool call, preventing the agent from interacting with external systems even if it bypasses network controls.

While in quarantine, the agent's telemetry streams are duplicated to a dedicated forensic observability pipeline separate from production monitoring. This includes:

• Full OpenTelemetry trace data with all span attributes
• Structured logs at DEBUG verbosity
• A continuous recording of the agent's internal reasoning traces and planning steps The mirrored pipeline allows security teams to replay the agent's decision sequence without risking contamination of production dashboards or alerting systems.

An immutable state snapshot is taken immediately upon quarantine activation, capturing the agent's vector store embeddings, conversation history, and any pending action queue. A cryptographic hash of this snapshot is generated and logged to a tamper-evident audit chain. Analysts can compare this snapshot against previous known-good checkpoints to identify exactly when and how the agent's state diverged from expected behavior, enabling precise root cause analysis.

The quarantine environment includes a data diode or unidirectional gateway that allows forensic data to be extracted for analysis while physically preventing any inbound communication to the quarantined agent. Analysts interact through a jump host with session recording enabled, ensuring all investigative commands are logged. Any attempt by the agent to communicate externally is captured as evidence rather than blocked silently, providing insight into potential command-and-control patterns.

A mechanism designed to completely and immediately shut down an autonomous agent or system, overriding all other processes to prevent unintended harm. Unlike quarantine—which preserves the agent for observation—a kill switch is a destructive termination with no intent to recover state.

• Can be hardware-based (physical button) or software-based (API call)
• Often paired with a Dead Man's Switch for operator absence scenarios
• Must bypass all agent-level error handlers to guarantee execution

A software design pattern that prevents an agent from repeatedly attempting an operation that is likely to fail, immediately failing such calls for a set timeout period. In threat modeling, circuit breakers act as automated pre-quarantine triggers.

• Closed state: Normal operation, requests pass through
• Open state: All requests immediately rejected, agent isolated
• Half-open state: Limited trial requests allowed to test recovery
• Prevents cascading resource exhaustion across agent fleets

The process of reverting an agent's internal state, memory, and environment to a previously saved, stable checkpoint. This is the primary recovery mechanism after a forced quarantine event concludes.

• Requires Immutable State Snapshots taken at known-good intervals
• Must be idempotent—applying the same rollback multiple times yields identical results
• Critical for undoing partial transactions that may have corrupted external systems

The dynamic and immediate removal of an agent's access rights to specific tools, APIs, or data sources. Often used as a non-lethal containment measure that is less disruptive than full quarantine.

• Can target individual scopes: file system, network, database, API keys
• Implemented via RBAC or attribute-based access control systems
• Allows the agent to continue operating in a degraded but observable mode
• Reversible without state reconstruction

A pre-defined, secure condition that an autonomous system automatically enters upon detecting a critical malfunction. Forced quarantine is often the transitional mechanism that moves an agent from an active state into its fail-safe configuration.

• Must be designed to minimize potential damage in the specific deployment context
• For embodied systems: physical home position, power-off, or neutral posture
• For software agents: read-only mode with all write operations blocked
• Contrast with Fail-Closed (blocks all actions) vs Fail-Open (maintains availability)

A resilience pattern that prevents a failure in one agent or component from propagating and causing a domino-effect collapse across an entire multi-agent system. Forced quarantine is the primary enforcement mechanism for this pattern.

• Uses bulkhead patterns to partition agent pools into isolated failure domains
• Quarantined agents cannot send messages to healthy peers
• Requires Orphan Process Reapers to clean up child processes spawned before isolation
• Critical in heterogeneous fleet orchestration where agent types have different risk profiles