Agentic Interventions Matrix
How do I stop the bleeding now?
Filter
Layers, by what they can actually enforce
- In-agent (empty) — none
An agent acting badly cannot be reliably told to stop. Empty for response. Listed for completeness.
- Client-side cutoffs — fast
Operator-machine actions. Milliseconds to seconds. Effective if the agent is contained to one host.
- Server-side cutoffs — authoritative
Target-system actions. Seconds to minutes. Catches agents and operator hosts that have been compromised.
Showing 3 of 15.
Authorization at In-agent (empty)
(no enforcement)
Authorization at Client-side cutoffs
Force-replace local hook config with deny-all, lock with chattr +i, kill running agent.
Authorization at Server-side cutoffs
Apply emergency Kyverno deny-all, replace agent Role with empty rules, attach IAM deny-all, Git pre-receive reject.