Containment Primitives for Agents: Quarantine, Capability Revocation, and Safe Rollback

There is a seductive fantasy in incident response: the big red button that stops everything. In a mesh of autonomous agents it is exactly the wrong instinct, because the systems you would shut down are the ones doing legitimate work, and a false alarm that hits the button causes an outage worse than most threats. Real containment is not one drastic action but a graduated set of reversible primitives, each stopping a specific kind of harm with the smallest possible disruption. An autonomous responder needs three: it must be able to isolate an agent so it can do no further damage, strip its authority so it cannot use the tools it holds, and undo the harm it has already done. These are quarantine, capability revocation, and safe rollback. This article specifies each precisely — what it does, what it guarantees, and where it fails — and argues that the discipline binding them is the principle of least disruption: always the smallest, most reversible action that is sufficient to stop the harm, never the largest one that is available.

What containment must guarantee

Containment sits between detection and recovery in the incident lifecycle described by the NIST Computer Security Incident Handling Guide (SP 800-61 Rev. 2): its job is to stop the bleeding — to limit the damage a confirmed threat can do while eradication and recovery proceed. For an autonomous responder acting at machine speed, containment primitives carry three non-negotiable requirements. They must be fast, because a slow control loses the speed race the whole discipline exists to win. They must be reversible, because a responder acts on imperfect verdicts and a false containment must be undoable at the same speed it was applied. And they must be composable, because real incidents need combinations — isolate and revoke, or revoke and roll back — applied in a controlled sequence.

The reversibility requirement deserves emphasis because it inverts a common intuition. The most powerful-sounding containment action — delete the agent, wipe its state — is the least useful to an autonomous responder, precisely because it cannot be undone if the verdict was wrong. The primitives that earn a place in a machine-speed responder are the ones whose worst-case error is a brief, recoverable disruption: quarantine that can be lifted, revocation that can be re-granted, rollback that restores a known-good state. This is the same reversibility-first principle that governs the response ladder, expressed at the level of individual controls. A containment toolkit built from reversible primitives can be handed to a machine; one built from irreversible sledgehammers cannot.

Quarantine: isolating an agent

Quarantine isolates an agent from further interaction without destroying it — the containment analogue of a medical quarantine, cutting the pathways by which harm spreads while keeping the patient available for examination. In an agent mesh, quarantine means the policy mesh stops routing the agent's calls: its requests to other agents are rejected, and often its inbound requests are held too, so it can neither act on the mesh nor be used as a stepping stone. The agent's state is preserved for investigation, which matters — a quarantined agent is a live specimen you can examine to confirm the compromise and understand it, whereas a deleted one takes its evidence with it.

Quarantine is graduated, not binary, and the gradations are what make it useful. A soft quarantine might merely subject the agent's actions to step-up verification or heavy rate limiting, buying time on a weaker signal. A hard quarantine cuts it off entirely. The right level follows the confidence in the verdict: a strong, corroborated verdict justifies hard isolation; an ambiguous one warrants a soft, reversible throttle while investigation continues. The critical property is that quarantine at every level is trivially reversible — lifting it is a single policy change that restores routing — so a soft quarantine on a false positive is a momentary slowdown, not an outage. This reversibility is exactly what lets an autonomous responder apply quarantine on its own for the reversible, confident cases.

Capability revocation: cutting the authority

Quarantine stops an agent from talking; capability revocation stops it from acting, by stripping the authority it holds. This is where the design of the underlying trust system pays off directly. If agents act under scoped, short-lived capabilities — unforgeable tokens that grant a specific right, minted by a broker — then revocation has two clean mechanisms. The first is active revocation: the broker publishes that a specific capability is no longer valid, and enforcement points reject it immediately. The second, quieter mechanism is expiry: because capabilities are short-lived, simply refusing to renew an agent's tokens cuts its authority within the token lifetime, with no explicit revocation needed. Short lifetimes make revocation partly automatic — the compromise window is bounded by the token's remaining life even if active revocation is slow.

The security value of revocation is that it removes the ability to do harm rather than merely the opportunity. A quarantined agent that somehow reaches a tool still cannot use it if its capability is revoked; the authority is simply gone. This is why revocation and quarantine compose — quarantine cuts the pathways, revocation cuts the powers, and together they leave a compromised agent both isolated and disarmed. The failure mode to guard against is revocation latency: if the mesh caches capabilities or checks them lazily, a revoked token may still be honored for a window. The mitigation is the same short-lifetime discipline plus enforcement points that check revocation status on every consequential action, so the gap between deciding to revoke and the revocation taking effect is as small as the mesh can make it. Revocation you cannot apply promptly is a control in name only.

Safe rollback: undoing the harm

Quarantine and revocation stop future harm; rollback addresses harm already done. Safe rollback restores the system to a known-good state that predates the compromise — reverting the data an agent corrupted, undoing the actions it took, discarding the outputs it produced. Its feasibility depends entirely on a property that must be designed in advance: recoverability. If an agent's consequential actions are captured as a log of reversible operations, or the affected state is versioned and checkpointed, rollback is a mechanical restore. If they are not, rollback is impossible, and the harm is permanent regardless of how fast you contained the agent. The lesson is that rollback is not primarily a response-time capability; it is a design-time investment in making agent actions undoable.

The hard boundary of rollback is the external side effect. Internal state — a database record, a file, an agent's memory — is recoverable if versioned. But an action with an effect outside the system's control — an email sent, a payment made, a message posted, a third-party API called — often cannot be truly undone; you can send a correction, but you cannot un-send the original. This asymmetry is why the reversibility axis of response design maps so directly onto containment: actions with external side effects belong in the human-confirm quadrant precisely because rollback cannot save you if they were wrong. The practical discipline is to make internal actions cheaply reversible through checkpointing and to gate external side effects behind stricter, slower, human-in-the-loop controls, so that the actions a responder can take autonomously are exactly the ones it can undo.

Composing the primitives: least disruption

The three primitives are rarely used alone; real containment composes them, and the principle governing the composition is least disruption — always the smallest, most reversible combination that is sufficient to stop the harm. A confident verdict about an actively-exfiltrating agent might warrant hard quarantine plus revocation plus rollback of its recent actions. A weaker signal might warrant only a soft throttle while investigation continues. The anti-pattern is reaching for maximum containment reflexively, because maximum containment maximizes disruption, and at machine speed a responder biased toward drastic action becomes a self-inflicted denial of service — the very failure mode that makes teams afraid to automate response at all.

Least disruption is operationalized as a ladder of escalating combinations, applied only as far as the evidence justifies. Start with the least-disruptive sufficient action; escalate only if it proves insufficient. This composes cleanly with the reversibility-and-confidence framework: the responder selects the containment combination whose disruption matches the verdict's confidence and whose reversibility matches its own authority to act autonomously. And every applied primitive is logged and, where reversible, automatically lifted if the verdict is later overturned — so containment is not a one-way ratchet toward more disruption but a controlled, reversible response that can relax as understanding improves. The goal is a responder that stops real harm decisively and un-does false containments just as decisively.

Limits and honest caveats

The primitives are only as good as the substrate they run on, and a rigorous treatment must say so. Capability revocation presumes agents act under revocable, short-lived capabilities; in a system where agents hold long-lived ambient credentials, there is nothing clean to revoke, and containment degrades to blunter measures. Safe rollback presumes recoverability was designed in — versioned state and captured reversible operations; retrofitting it onto a system that overwrites state in place is expensive and often incomplete. Quarantine presumes a policy mesh that can actually stop routing an agent's calls; a system with direct, unmediated agent-to-agent connections has no chokepoint at which to isolate. In each case, the containment primitive is downstream of an architectural choice made long before the incident.

There is also a residual the primitives cannot close. They contain an agent; they do not by themselves determine that the agent should be contained — that verdict comes from investigation, and a wrong verdict drives a false containment no matter how clean the primitives are. Reversibility limits the cost of that error but does not prevent it. And the external-side-effect boundary is a genuine hard limit: no rollback primitive can un-send a real-world action, so the only defense there is prevention — gating those actions so tightly that a compromised agent never reaches them autonomously. The honest summary is that these primitives make containment fast, graduated, and mostly reversible, which is exactly what an autonomous responder needs, but they are a lever, not a guarantee: their power depends on the trust and recoverability architecture beneath them, and their safe use depends on the investigation and reversibility discipline above them.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

containment:
  low_confidence:
    apply: [throttle]                 # soft quarantine only
    reversible: true
  medium_confidence:
    apply: [isolate, revoke_capability]
    reversible: true
  high_confidence_active_harm:
    apply: [isolate, revoke_capability, rollback_internal]
    reversible: true
  external_side_effect:
    apply: [block_action]
    route: human_confirm              # rollback cannot undo it
principle: smallest_sufficient_reversible_action
on_verdict_overturned: auto_lift_reversible_primitives

agent = mock_agent(state=ACTIVE)

# quarantine then release restores routing
quarantine(agent, level=ISOLATE); assert agent.state == ISOLATED
release(agent);                    assert agent.state == ACTIVE
# revoke then re-grant restores authority
revoke(agent.capability);          assert not agent.capability.valid
regrant(agent.capability);         assert agent.capability.valid
# internal rollback restores a checkpoint
corrupt(agent.state); rollback(agent, to=checkpoint)
assert agent.state == checkpoint
# an external side effect must be gated, not rolled back
assert contain(action="send_email") == HUMAN_CONFIRM

Glossary

Containment

The incident-response phase that limits the damage a confirmed threat can do while eradication and recovery proceed.

Quarantine

Isolating an agent from further interaction — stopping the mesh from routing its calls — without destroying its state.

Soft vs hard quarantine

A reversible throttle or step-up on a weaker signal, versus full isolation on a confident verdict.

Capability revocation

Stripping an agent's authority by invalidating its scoped tokens, either actively or by refusing to renew short-lived ones.

Revocation latency

The window during which a revoked capability may still be honored by cached or lazily-checked enforcement points.

Safe rollback

Restoring the system to a known-good state that predates the compromise, feasible only if recoverability was designed in.

Recoverability

The design property — versioned state, captured reversible operations — that makes an agent's actions undoable.

Least disruption

The principle of always applying the smallest, most reversible containment combination sufficient to stop the harm.

References

1. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide (2012)
2. NIST SP 800-53 Rev. 5, Security and Privacy Controls (Incident Response family)
3. NIST SP 800-207, Zero Trust Architecture (2020)
4. IETF RFC 8693, OAuth 2.0 Token Exchange (2020)
5. OWASP Agentic Security Initiative, Agentic AI Threats and Mitigations (2025)
6. OWASP Top 10 for LLM Applications (2025)
7. MITRE ATLAS (Adversarial Threat Landscape for AI Systems)