Triaging Agent Deviations — Delegated Authority

Every safeguard in this series is designed to make an agent act within its authority. But defenses are not perfect, agents are probabilistic, and the world is adversarial — so sooner or later an agent will do something it should not. The decisive question is not whether that happens but what happens next. A deviation caught, classified, and contained in seconds is a footnote; the same deviation ignored or fumbled is a breach. Triaging agent deviations is the discipline of recognizing when an agent has stepped out of bounds, deciding how serious it is, and responding in proportion — fast enough to matter, calm enough to be right.

When an agent steps outside its authority

A deviation is any action an agent takes that falls outside what it was authorized, intended, or expected to do. It is broader than an attack. A compromised agent deviates, but so does one following a poisoned instruction, one whose plan went wrong, and one that hit an edge case its designers never imagined. What they share is a gap between what the agent did and what its authority actually permitted.

This framing matters because it tells you where to look. Everything earlier in this series — shared identity, intent-bound grants, delegation records, time rules, and an evidence budget — exists precisely so that a deviation is visible and bounded. Triage is what turns that visibility into action. Without it, all the boundaries in the world just record the damage after the fact.

Spotting a deviation

You cannot triage what you cannot see, so detection comes first. Deviations announce themselves through a handful of recurring signals. An agent reaches for a tool it has never used for this kind of task. It requests a resource outside the scope of its grant. Its rate of actions spikes far beyond a human-plausible pace. Or the authorization layer starts returning denials where an aligned agent would never have asked.

None of these is proof on its own — each has innocent explanations — but together they form a picture. The job of detection is not to be certain; it is to surface candidates quickly and route them into triage. A system that only notices deviations in the monthly log review has, in practice, no detection at all.

A handful of recurring signals, read together, flag an agent that may have stepped out of bounds.

Not every deviation is an attack

The instinct to slam the brakes on any anomaly is understandable and wrong. Over-reacting to benign deviations trains teams to ignore alerts and makes agents useless; under-reacting to real ones is how incidents grow. Triage is the middle path: a quick, structured judgment about how serious this specific deviation is, so the response fits the risk.

A workable triage asks a few sharp questions in order. Is the deviation already contained by existing boundaries, or is it live? Is its effect reversible, or has it done something you cannot take back? The answers sort deviations into watch it, constrain it, or stop it now — and crucially, they can be evaluated in seconds, which is the only speed that matters when an agent acts at machine pace.

A few ordered questions sort a deviation into watch, constrain, or stop.

A graduated response

Response should be a dial, not a switch. The most common failure is having only two settings — ignore, or kill everything — because that forces every deviation into one of two bad choices. A graduated ladder gives triage somewhere proportionate to land. At the gentle end, observe: keep the agent running but log intensively and raise a signal. Next, constrain: tighten its scope, drop it to read-only, or route its actions through human approval.

If that is not enough, suspend: pause the agent so it takes no new actions while you look. And at the top, revoke: pull its authority entirely — the credentials, the grants, the delegated tokens — so it can do nothing at all. Because authority in this series is short-lived and explicitly granted, revocation is fast and clean: you are not chasing scattered permissions, you are cancelling the specific grants the agent holds.

Match the response to the triage: escalate only as far as the risk requires.

Contain before you investigate

Under pressure, the temptation is to understand the deviation fully before acting. Reverse the order. The first goal is to limit the blast radius — contain the agent so it cannot do further harm — and only then investigate at leisure what happened and why. A live deviation is a fire; you put it out before you study the arson report.

So the incident flow is: detect the signal, contain the agent's authority, investigate using the evidence you preserved, and finally learn — feed what you found back into policy so the same deviation is harder next time. Each stage has a different tempo. Detection and containment are measured in seconds and are largely automatable; investigation and learning are human, careful, and slow. Confusing the two — investigating at the speed of containment, or containing at the speed of investigation — is how triage goes wrong.

Limit the damage first; understand it second; improve the system last.

Preserve the evidence

Containment must not destroy the very trail you need to understand what happened. A panicked response that kills the agent and wipes its state leaves you contained but blind. This is where the evidence budget pays off: because consequential actions already carry verifiable, tamper-evident records, containment can freeze and capture that trail rather than erase it.

Practically, this means designing containment to snapshot before it suspends — preserving the agent's recent actions, the grants it held, the delegation chain it was part of, and the signals that triggered the alert. The difference between an incident you can learn from and one you can only apologize for is whether the evidence survived the response.

⚠️

Freeze, don't erase. Containment should snapshot the agent's actions, grants, and delegation chain before suspending — a response that destroys the trail leaves you blind.

Blameless, but accountable

The final stage, learning, works only if it is safe to surface deviations. A culture that punishes every anomaly drives them underground, where they fester; a blameless approach treats each deviation as information about a gap in the system rather than a person to blame. But blameless is not the same as consequence-free: the agent that deviated is still held accountable in the technical sense — its authority reviewed, its grants tightened, its behavior fed into detection.

This closes the loop the whole series has been building. A deviation triaged well does not just get contained; it makes the next deviation less likely, because what it revealed flows back into intent-bound grants, delegation limits, time windows, and evidence requirements. Triage is where a system stops merely enforcing authority and starts improving it.

What builders and leaders decide

For engineers, triage turns into concrete machinery: detectors for the recurring deviation signals, a fast triage rule that classifies by containment and reversibility, a graduated response from observe to revoke, and a containment step that snapshots evidence before it acts. Because grants are short-lived and explicit, the strongest response — revocation — is a clean, reliable operation rather than a frantic hunt for stray permissions.

For leaders, the payoff is resilience. Deviations are treated as expected events with a rehearsed response, not surprises that trigger panic. The organization can move fast with agents precisely because it knows that when one steps out of bounds, it will be seen, judged, and contained in proportion — and that every such moment makes the system a little harder to fool. That is what it means to run agents you can actually trust: not agents that never deviate, but a system that handles deviation well.

Detect the recurring signals — unexpected tools, out-of-scope resources, abnormal rates, policy denials — and route them into triage automatically.
Triage fast by containment and reversibility; not every deviation deserves the same response.
Respond on a graduated ladder — observe, constrain, suspend, revoke — escalating only as far as the risk requires.
Contain before investigating, and snapshot the evidence before suspending, so you can learn and feed fixes back into policy.

Key takeaways

A deviation is any action outside an agent's authority — broader than an attack, and expected to happen eventually.
Detect deviations from recurring signals read together, and surface candidates fast rather than at log-review pace.
Triage by whether the deviation is contained and reversible, sorting it into watch, constrain, or stop.
Respond on a graduated ladder from observe to revoke; short-lived explicit grants make revocation clean.
Contain before you investigate, and snapshot the evidence trail before suspending so you stay able to learn.
Handle deviations blamelessly but accountably, feeding each one back into grants, delegation, time, and evidence rules.

Glossary

Deviation: Any action an agent takes outside what it was authorized, intended, or expected to do.
Triage: A fast, structured judgment of how serious a deviation is, so the response fits the risk.
Containment: Limiting an agent's blast radius so it can do no further harm, done before detailed investigation.
Blast radius: The extent of damage an agent can cause before it is stopped or constrained.
Graduated response: A range of proportionate reactions — observe, constrain, suspend, revoke — rather than an all-or-nothing switch.
Revocation: Pulling an agent's authority entirely by cancelling its credentials, grants, and delegated tokens.
Circuit breaker: An automatic mechanism that halts or constrains an agent when signals cross a danger threshold.
Blameless postmortem: Reviewing an incident as a gap in the system to fix rather than a person to blame, to keep deviations visible.