Agentic Interventions Matrix
How do I stop the bleeding now?
Filter
Layers, by what they can actually enforce
- In-agent (empty) — none
An agent acting badly cannot be reliably told to stop. Empty for response. Listed for completeness.
- Client-side cutoffs — fast
Operator-machine actions. Milliseconds to seconds. Effective if the agent is contained to one host.
- Server-side cutoffs — authoritative
Target-system actions. Seconds to minutes. Catches agents and operator hosts that have been compromised.
Showing 3 of 15.
Identity at In-agent (empty)
(no enforcement; the agent that misuses identity will not voluntarily revoke it)
Identity at Client-side cutoffs
Kill agent process tree, delete local credential file, force re-authentication on next launch, logout SSO session on the operator host.
Identity at Server-side cutoffs
Revoke OIDC token at IdP, disable ServiceAccount, rotate IAM keys, attach deny-all IAM policy, invalidate all active sessions.