Hold, release, terminate
Pause, release or stop an agent for good
Hold a risky agent, then release it or terminate it. Releasing gives authority back, so it needs approval at least as strong as the stop.
Capability 07 · Agent Containment
Stop a risky agent at its next step
Hold, release, terminate or quarantine an agent or AI process. Every gate it must pass, from the model gateway to a coding assistant on a laptop, refuses its next step, and every refusal lands on the containment ledger.
ContainmentWho is held, who is waiting to approve, and what every gate did.
Live
3Agents held or frozen
3Moves awaiting approval
14Next steps refused today
Decided once, refused at every gate
People, partners and lifecycle events start a containment move. Cortx decides it once and every gate the agent must pass enforces it.
Who starts a move
SOC analysts and agent ownersStop, quarantine or plan a move
Detection partnersAlerts from your XDR, MDR or SOAR
ApproversOpen pool, named, InfoSec or CISO
Lifecycle eventsAuthority expired, owner deprovisioned
Agent Containment
Where it takes effect
Model gatewayRefuses the next model call
MCP gatewayRefuses the next tool call
Agent runtimeStops the run, cuts a streaming answer
LaptopsClaude Code, Cursor and MCP tools deny, ask or freeze
SandboxesFreeze and thaw
A stop is only real
at the agent's next step.
Containment is not a flag on the agent. It is the answer every gate gives at the agent's next step, and the evidence that it gave it. An agent marked stopped that never asks again is not stopped.
Where the next step is checked
Model callsmodel gateway
Tool callsMCP gateway
Streaming answerscut at the next chunk
Agent runsagent runtime
Laptop tool usecoding assistants
AI processesfrozen between acts
Four steps take a containment move from the signal to the agent's next step. Select a step to jump to it.
01 · Decide
Cortx turns an analyst action, a partner alert, a policy verdict or a lifecycle event, such as expired authority or a departed owner, into a block, an interrupt, a device action or a quarantine plan.
02 · Approve
Restrictive moves wait for a second person: an open pool, a named checker and approver, M-of-N by action class, or InfoSec plus CISO for a fleet stop. Pre-authorized moves are the exception, and the record says so.
03 · Propagate
A signed interrupt is pushed to the model gateway, MCP gateway and agent runtime, with the signed policy snapshot as a backstop. Laptops get a wake-up and pull a signed action.
04 · Refuse
Each gate refuses the agent's next model or tool call, cuts a streaming answer at the next chunk, or freezes the process. A tool call already running is not interrupted.
Four kinds of hold, never confused
Each has different speed, reversibility and approvers, so Cortx names which one it means.
- 1 Call parked for approval
- 2 Agent paused or stopped
- 3 Process frozen
- 4 User permission prompt
Acks, refusals and device results land on the containment ledger with timestamps, so time to contain is read from records, never estimated.
Fast enough to matter.
Careful enough to undo.
On the laptop
Coding assistants check before they act
Claude Code, Cursor and MCP tools on laptops check a signed policy before each tool use and can deny, ask or freeze. The managed policy wins over anything set locally.
Named approvers
A second person, matched to the move
Containment plans, gateway holds and fleet stops wait for the right approvers: a named checker, M-of-N by action class, or InfoSec plus CISO. Quarantine release takes two InfoSec approvers by default.
Containment your SOC
can sign off on
How a stop reaches every gate, what it preserves, and where a second person is not required.
Push to be fast, pull to be sure
The interrupt is pushed to every gate for speed. The signed policy snapshot and device policy still hold the stop if the push is down.
Preserve before you destroy
Quarantine freezes and hashes first. Destroying anything is a separate, explicit choice the approvers see, and revoked credentials and legal holds are never undone by a rollback.
A reason and a code on every refusal
Each containment refusal carries a stable code and lands on the ledger, so the agent, the user and the auditor read the same reason.
When no second person is needed
Urgent interrupts and partner alerts can run without a second approver only where your tenant has pre-authorized them, and the record says so. On a laptop, a coding assistant's prompt is the user's own permission, not an approval.
See a stop land.
We'll hold a running agent, show each gate refuse its next step, and read the time to contain from the ledger.