Agentic Interventions Matrix
How do I stop the bleeding now?
Filter
Layers, by what they can actually enforce
- In-agent (empty) — none
An agent acting badly cannot be reliably told to stop. Empty for response. Listed for completeness.
- Client-side cutoffs — fast
Operator-machine actions. Milliseconds to seconds. Effective if the agent is contained to one host.
- Server-side cutoffs — authoritative
Target-system actions. Seconds to minutes. Catches agents and operator hosts that have been compromised.
Showing 3 of 15.
Blast radius at In-agent (empty)
(no enforcement)
Blast radius at Client-side cutoffs
kill -KILL the agent process tree, tear down sandbox, optionally network-isolate operator host, docker stop or kubectl delete pod.
Blast radius at Server-side cutoffs
Apply emergency NetworkPolicy default-deny, scale Deployment to zero, force-delete pods, optionally cordon node, block egress at cloud firewall.