Runtime Containment When Classification Fails — Layered Resilience for Agents

Every defense that depends on correctly classifying something in advance will, sometimes, classify it wrong. A scanner marks a real flaw as safe; a filter passes a malicious input; a model judges a dangerous action as fine. If your only protection is that first judgment, a single misclassification becomes a breach. Runtime containment is the discipline of building the next layer down: controls that stop exploitation at the moment of action, even when the earlier judgment was mistaken. It is defense in depth applied to agents, and its premise is humbling but essential: assume the classifier is wrong.

Assume the classifier is wrong

Prevention is valuable, but it is probabilistic. A model deciding whether an action is safe, a filter deciding whether input is malicious, a scanner deciding whether code is vulnerable, each has a false-negative rate. Over enough actions, some dangerous ones will be waved through.

Runtime containment starts from that fact rather than denying it. Instead of trying to make the first judgment perfect, it ensures that a wrong judgment is survivable, because another layer stands between the mistake and real harm.

Layers that don't rely on being right

A resilient design stacks controls that fail independently. Prevention tries to stop bad things up front. Detection notices when something slipped through. Containment limits what a slipped-through action can actually do. And recovery restores a good state after the fact.

The point of the stack is that no single layer has to be perfect. Each catches a different share of what the others miss, and the gaps rarely line up.

Prevention, detection, containment, and recovery each catch what the others miss.

Runtime protection catches the miss

The key move is to add a check at the moment of action that does not trust the earlier classification. Even if a finding was marked safe, the runtime can still block the exploit when the action actually fires, based on what the action would do rather than what a model believed about it.

Trace the paths and the value is clear: prevention stops most things, but the ones it misses hit a second gate at execution. Only if both fail does it become an incident, and two independent failures are far rarer than one.

A misclassified action meets a second, runtime gate before it can cause harm.

Single perimeter versus layered

The failure mode to avoid is the single perimeter: one wall that, once breached, leaves everything exposed. It looks efficient and it is brittle, because its whole security rests on never being wrong.

A layered design trades a little efficiency for a lot of resilience. Breaching one layer buys an attacker very little, because the next layer still constrains what they can do.

A single perimeter fails all at once; layers degrade gracefully.

What containment looks like for agents

For an agent, runtime containment is concrete. It asks whether exploitation can be blocked even if a finding was misclassified, whether an unsafe output can be stopped before it reaches a downstream system, and whether a malicious payload can be caught before a tool executes it.

These are runtime controls, not pre-flight judgments, and they are what make a misclassification a near miss instead of a breach.

Block an action at execution based on what it would do, not a prior label.
Stop an unsafe output before it reaches a downstream system.
Catch a malicious payload before a tool acts on it.
Detect anomalous request patterns and cut the action off.

Contain, don't just detect

Detection without containment tells you about a breach after it happens. That is useful for learning, but it is not protection. The layer that matters most under a misclassification is the one that limits what the slipped-through action can actually do.

So invest in controls that constrain and stop, not only ones that observe. The cost of a miss is bounded only if something can act on the miss in time.

✅

A miss becomes a signal. With runtime containment, a single misclassification becomes a contained near miss, not a breach.

What a practitioner decides

Building runtime containment means deciding which controls run at the moment of action, independent of any earlier classification, and how they bound the damage of a wrong judgment. It costs more than a single check, and it is what makes the system survive being wrong.

The question is not only did we classify this correctly. It is: if we classified it wrong, what stops it from becoming a breach?

Key takeaways

Any control that classifies in advance will sometimes be wrong; assume it.
Stack layers that fail independently: prevention, detection, containment, recovery.
Add a runtime gate at the moment of action that does not trust the earlier label.
Two independent failures are far rarer than one, so a misclassification is survivable.
Avoid the single perimeter; layered defenses degrade gracefully instead of all at once.
Prioritize containment over detection: bound what a slipped-through action can do.

Glossary

Runtime containment: Controls that stop or limit an exploit at the moment of action, independent of earlier classification.
Defense in depth: Layering independent controls so that breaching one still leaves others in place.
False negative: A dangerous thing incorrectly classified as safe.
Prevention: Controls that try to stop bad actions before they occur.
Containment: Controls that limit the damage of an action that got through.
Single perimeter: A design whose security rests on one boundary that, once breached, exposes everything.
Blast radius: The extent of damage a single mistaken or malicious action could cause.