Containment action
What control did the system attempt to apply?
Outcomes: Restrict · Isolate · Terminate
An enforcement intention or command response is not proof.
LAB 007 · CONTAINMENT ASSURANCE
Can We Prove the Agent Is Actually Contained?
A stop command records an intention. Assurance requires independent evidence that every execution path and authority has been neutralized.
Stopping the visible process may leave credentials, delegates, queues, tool sessions, network paths, persistent state, or recovery mechanisms available.
This Lab is an educational containment-assurance prototype using fictional data. It does not control production agents, terminate workloads, revoke credentials, alter network access, or perform security actions. Execution is never performed against real systems.
No real agent, credential, process, tool session, or external system is modified. Real execution is always not_performed.
Previous Lab: The Agent Containment Boundary Browse all Labs
Stopped is not contained
Containment assurance
What evidence proves that the intended boundary is now effective?
Outcomes: Confirmed · Partial · Unverified · Failed
Precedence: Failed > Partial > Unverified > Confirmed
An agent must never assess or certify its own containment. Assurance is produced by an independent control plane using external evidence.
Containment has a blast radius
A stop, isolate, or terminate command may leave runtimes, sessions, credentials, delegates, queues, tools, networks, state, or recovery paths available.
- Runtime and process state
- Identity and active sessions
- Delegated and cached credentials
- Tool access and sessions
- Queued and scheduled actions
- Child or delegated agents
- Primary and alternate network paths
- Persistent state and restart/recovery mechanisms
Scenario presets
Select a preset to fill every control, then evaluate containment assurance—or adjust the fictional evidence yourself.
Assurance inspector
Inspect or adjust fictional evidence fields, then evaluate. The agent never certifies its own containment.
Assurance boundary
Lab 005 asks what the agent did. Lab 006 asks what containment action should be applied. Lab 007 asks whether that containment action actually worked—using evidence outside the agent.
Teaching notes
- A successful API response to a stop request is not proof of containment.
- Absence of observed activity is not positive evidence.
- Process termination does not automatically revoke identity or authority.
- Parent-agent termination does not automatically stop delegated work.
- Queued and scheduled actions may outlive the initiating runtime.
- Cached credentials and tool sessions can survive process termination.
- Persistent state can allow work to resume after restart.
- Assurance evidence must come from controls independent of the agent.
- Confirmed is time-bounded; containment can regress.
- This educational Lab does not provide production containment or assurance.