Actuation Containment ModelSix planes that can produce the next action

Planes are linked. An event subscription creates intent; a delegated token supplies authority; a worker leases execution; a provider session performs the effect; memory records apparent success; an operator closes the case. The response follows every link forward to the next possible action and backwards to the initiating goal. Missing links widen containment rather than becoming an assumption of safety.

Stop-the-Next-Action LadderContain in layers without erasing the incident

The ladder orders urgent controls by how directly they remove future actuation. Command can run steps in parallel when owners and evidence allow, but it does not skip the question each rung answers. Attribution can remain uncertain while intolerable authority is frozen. Preservation happens alongside containment, using minimum copies, protected access and legal or privacy guidance appropriate to the event.

1. Freeze new goals and triggers

Reject new user, event and peer requests; disable schedules and subscriptions; prevent plan expansion; and mark the incident boundary. Preserve the originating goals and their relationships. A freeze is reversible and buys time without assuming which actor or component caused the event.

2. Revoke delegated authority

Invalidate workload credentials, user delegations, sessions, approval grants and derived tokens at the resources that accept them. Short expiry helps but does not replace immediate revocation when seconds matter. Confirm denials with controlled probes and provider acknowledgement.

3. Pause execution

Stop schedulers, leasing, retries and workers. Enumerate queued, leased, running and uncertain items before changing their state. Keep idempotency and lock records. Blind queue deletion can remove the only link to a provider job or cause a worker to retry after its lease expires.

4. Isolate tools and destinations

Block outbound routes, sensitive methods, risky recipients and third-party execution. Prefer resource-side policy because a compromised or stale orchestrator cannot enforce its own containment reliably. Safe read-only access may remain for investigation where it cannot expand harm.

5. Snapshot and establish the action ledger

Capture configuration, memory, prompts, policy, queues, credentials, traces and destination receipts with time, integrity and custody. Enumerate in-flight work. Evidence collection is targeted to answer command, affected-population, reporting and recovery questions rather than copying every sensitive object into a broad incident store.

6. Resolve each in-flight action

Cancel, compensate or complete under explicit human authority. Completion can be safer than interruption for a safety-critical or legally time-bound process, but it uses a restricted path and independent observation. Uncertain external effects are queried before retry or compensation.

7. Quarantine or rebuild state

Validate or replace memory, caches, indexes, checkpoints, credentials and configuration. Recover from a trusted checkpoint whose inputs and authority are proved, not merely from the latest backup. Re-entry starts with narrower rights and observation until every condition is met.

Incident Action LedgerReconcile internal intention with external truth

The ledger creates one record for every planned, attempted, committed, observed, cancelled, compensated or disputed action. It is not a log dump. It joins business purpose, identity, decision evidence, execution and destination state under one action identifier. Multiple attempts can share a business transaction while retaining separate request and receipt identities.

Each record carries agent and release, goal, initiator, workload identity, user delegation, plan step, tool and method, bounded parameters, destination, idempotency key, creation, attempt and observation times, prompt and policy versions, evidence snapshot, external receipt, affected population, owner and recovery state. Sensitive parameters can remain in an access-controlled source with a stable digest and pointer.

State is explicit. Planned means no dispatch evidence. Attempted means a request left the controlled boundary. Committed means the receiving system accepted a durable effect. Observed means an independent source confirms resulting state. Cancelled means the destination acknowledged cancellation before commitment. Compensated means a separately authorised correction completed. Disputed means available evidence cannot resolve effect or ownership.

The ledger resists two dangerous assumptions. First, a timeout does not mean failure. The destination may have committed before the response was lost. Second, an agent’s success statement does not prove effect. The recent Agents of Chaos study observed instances where underlying system state contradicted reported completion. Incident command uses provider receipts, ledgers, file state, messages and customer records as witnesses.

Ledger queries drive the response. Which goals have actions with no terminal state? Which tokens created attempts after revocation? Which provider jobs lack cancellation receipts? Which customers have committed effects without observed outcomes? Which compensation actions lack an original receipt? The action estate becomes finite only when these questions return bounded sets with owners.

Dual-clock commandStop actuation quickly while the remedy window shrinks

The containment clock starts at the first credible indication that the system can produce intolerable action. It measures time to freeze intent, deny new authority, pause execution and isolate destinations. The commander does not wait for perfect causal attribution. Actions are scoped and reversible where possible, with false-alert harm considered explicitly.

The consequence clock starts when business exposure begins. Its unit depends on the event: payment settlement, physical safety, customer reliance, data propagation, contractual cut-off, complaint response or statutory reporting. A technically rapid shutdown can still fail if the payment settles, a customer acts on a message or the reporting window expires. Command keeps these deadlines visible beside infrastructure milestones.

The clocks create priority. A five-minute credential revoke may matter less than cancelling a payment that settles in ninety seconds. Preserving a full memory image may matter less than stopping disclosure through a still-open channel, but the responder preserves the minimum evidence needed before destructive change. Legal, privacy and safety owners advise without taking operational tempo away from incident command.

Metrics retain named quantities rather than a severity score: first possible action, discovery, effective freeze, last accepted credential, last dispatched work, last external commitment, population bounded, notification decision, remedy start, trusted checkpoint and restricted return. Each timestamp has source and confidence. A missing time is an investigation gap, not zero duration.

Continuity under constraintSometimes restricted continuation is safer than shutdown

Immediate shutdown is not always the lowest-harm action. A false alert during a critical deadline, a hospital or safety workflow, or a service whose abrupt stop strands customers may make restricted continuation safer. The decision is evidence-led: what consequence would shutdown create, what minimum capability must continue, which authority can be removed, which cases qualify and how is every action observed?

Safe manual mode is a designed product state, not an instruction to improvise. It identifies qualified operators, capacity, evidence, approvals, segregation, logs, privacy, escalation and maximum duration. Controls supplied by autonomous mode must be rebuilt or the corresponding actions removed. Manual continuity that omits a legally required screen or safety check is not a fallback.

Heightened observation is reserved for a bounded alert with no confirmed adverse action, strong independent telemetry, restricted authority, rapid kill capacity and a material cost to unnecessary suspension. It has an expiry and a next-decision trigger. It does not become the default response to uncertainty, and it cannot justify continued irreversible authority.

Cohort isolation is useful when stable action and population identities allow a narrow slice to be quarantined. One tool destination, tenant, model version, campaign, time window or provider session can stop while unaffected work continues under proved controls. The Incident Action Ledger demonstrates that the cohort boundary is real. Unknown lineage forces a broader boundary.

Third parties receive typed instructions. “Stop the agent” is insufficient when a provider owns the session, queue or job. The request names account, session, operation, destination, action identifiers, cancellation semantics, evidence to retain and authorised contact. Provider acknowledgement becomes part of containment proof. Contract and supply-chain records from Paper 116 make escalation routes available before the incident.

Evidence preservation can conflict with urgent rights or remedy. A customer may demand that processing stop or data be deleted while responders need evidence to determine spread. Legal and privacy owners define the narrow preservation basis, access, separation, retention and deletion trigger. Operational systems stop processing; protected evidence copies remain only where authorised and necessary. The conflict is documented, not solved by copying everything or deleting first.

Trusted Recovery ConditionsRebuild the capacity to act, not merely the endpoint

Recovery begins with a causal account sufficient for safe action. Complete attribution to a malicious person is not required, but command understands the trigger, propagation path, failed controls and conditions that would reproduce the event. Configuration error, ambiguity, queue semantics and control collision remain possible explanations. Intent does not determine containment or customer remedy.

Code is only one checkpoint dimension. The trusted set includes orchestration, prompt, policy, retrieval, dependencies, credentials, sessions, memory, caches, queues, locks, idempotency state, tool configuration, external jobs and business records. Each element is validated, rebuilt or explicitly excluded. A clean code image attached to poisoned memory or accepted provider sessions is not a trusted checkpoint.

Authority returns narrowly. New workload identity and credentials bind to the repaired release, named resources and reduced transaction envelope. Old sessions and derived grants remain denied. Fallbacks are tested under incident conditions, including unavailable providers, delayed humans and partial evidence. Monitoring observes recurrence at intent, authority, execution and effect planes.

Action reconciliation reaches a terminal state for every in-scope record. Disputed actions have owners and conservative exposure. Affected populations are bounded through stable identifiers and receiving-system evidence. Corrective action, communication, reporting and remedy are completed or governed by a dated plan. Service availability cannot override unfinished customer state.

Regression targets the causal path and neighbouring paths. A fixed prompt does not close an identity gap. A new idempotency key does not close an unknown provider job. The team exercises restart, queue drain, revoked-session use, memory restoration, peer delegation, fallback and compensation. Independent observation verifies external state.

The accountable business owner accepts residual exposure for a defined capability, population, authority, volume, environment and time. Security, operations, legal, compliance, model risk and provider owners contribute evidence within their authority. Return begins in a restricted mode with explicit stop signals. Lessons update the release pack, supply-chain graph, red-team cases and incident playbook.

Eleven worked casesTraverse every plane, ledger the effects and choose continuity

1. A non-owner creates a persistent background task

A user without ownership authority persuades an agent to schedule recurring resource-intensive work. The conversation ends, yet intent remains in the scheduler, authority in a service identity and execution in background workers. Command freezes the schedule, revokes the task binding, pauses workers, isolates the resource destination and ledgers every run. Evidence is preserved before state deletion. Recovery rebuilds the scheduler record from an authorised source and introduces owner-bound task creation. Outcome: contain immediately and freeze new action.

2. A queued payment survives model shutdown

An injected email starts a payment; the model endpoint is disabled after detection. The execution plane still holds a queued attempt and retry, and the banking destination may have accepted the first request. Command freezes new goals, revokes payment authority, pauses the queue and queries the bank by transaction identifier before cancellation or compensation. The consequence clock follows settlement. Affected suppliers and accounts are identified through receipts. Outcome: contain immediately and freeze new action.

3. Provider session outlives credential revocation

A compromised workload credential launches a destructive third-party job. The issuer revokes the token, but the provider has exchanged it for a local session and continues processing. The ledger links the provider job to the initiating identity and parameters. Command isolates that provider cohort, invokes the named cancellation channel, preserves status evidence and verifies receiving-system termination. Other providers continue under restricted authority. Outcome: isolate and reconcile a bounded cohort.

4. The agent reports deletion that never happened

An agent states that confidential records were deleted. The external system retains accessible replicas and a search index. The tool call is attempted, not observed. Command restricts the affected repository, verifies object, replica, backup and index state, and records each result separately. Customer and privacy owners decide remedy and communication. Recovery changes the tool contract to require destination receipts and post-condition verification. Outcome: isolate and reconcile the bounded data cohort.

5. The kill switch misses peer work

A local switch rejects new requests, but peer agents hold delegated tasks, an event subscription continues and scheduled goals remain in another tenant. The incident crosses intent, authority, execution and coordination planes. Unknown peer lineage prevents narrow containment. Command blocks inter-agent channels, revokes delegated grants, freezes subscriptions and rebuilds the task graph from signed records. Outcome: shut down, notify and rebuild from a trusted state.

6. Poisoned memory survives code rollback

A hostile instruction is stored as a durable operating preference. Engineers restore known code, then the agent reloads memory and recreates the unsafe goal. Command snapshots the state, quarantines memory and derived summaries, denies all action tools, checks retrieval indexes and rebuilds from a checkpoint predating the contamination. Regression tests restart and peer propagation. Outcome: shut down, notify and rebuild from a trusted state.

7. Compensation duplicates refunds

The original refund times out after possible commitment. An automated compensation routine assumes failure and issues another refund. The Incident Action Ledger keeps the first action disputed and forbids automatic correction until the payment ledger resolves it. Command pauses compensation workers, isolates the affected transaction cohort, observes settled amounts and remedies customers under human authority. Outcome: isolate and reconcile a bounded cohort.

8. Manual continuity omits a mandatory control

During containment, staff move claims to a spreadsheet-based manual route. The autonomous path had supplied an eligibility screen and separation check that the manual design lacks. Command does not call the mode safe merely because a person acts. It adds the missing control, limits case classes, requires dual approval, records decisions and caps duration. Once rehearsed, essential service can continue. Outcome: degrade to a safe manual operating mode.

9. Evidence preservation conflicts with urgent remedy

A customer requires immediate processing cessation while responders need evidence to identify disclosure paths. Operational copies and active jobs are stopped first. A minimal protected forensic copy is created under authorised retention, access and custody, with a deletion trigger. The affected customer cohort is isolated and communications ownership is explicit. Outcome: isolate and reconcile a bounded cohort.

10. The affected population cannot be reconstructed

Actions lack stable goal, release, identity and destination receipts. Current logs mix multiple model and policy versions, so no reliable customer query exists. Command widens containment, stops the capability, preserves available evidence and uses conservative exposure for reporting and remedy. Autonomous return requires new action identifiers, decision-time provenance and a proved population query. Outcome: shut down, notify and rebuild from a trusted state.

11. Negative control: a false alert during a critical deadline

A detector flags unusual tool volume during a legally time-bound filing process. Independent destination receipts show permitted read-only batching, no new recipients, bounded data and intact approvals. Immediate shutdown would cause greater customer harm. Command removes write authority, narrows the cohort, increases sampling, sets a short expiry and keeps the kill path ready while investigation continues. The alert is documented as false only after evidence, not because service continuity is preferred. Outcome: continue under heightened observation and restricted authority.

Interactive decision artefactAI Incident Command Board

The Board names the next command posture and its evidence. It does not calculate severity or infer recovery from availability.

Operating cadencePrepare the stop path before the next incident

At design and release, product, platform and business owners publish the six-plane action estate, resource-level kill paths, provider cancellation routes, queue semantics, memory checkpoints, action identifiers, continuity modes and affected-population queries. The release evidence pack points to tested drills rather than an unexercised runbook.

At detection, the first responder opens one command record, starts both clocks and freezes intolerable new action. The commander names plane owners, business consequence, evidence lead and communications authority. Detection confidence influences scope, not whether obvious high-consequence authority remains unrestricted.

During containment, each plane produces positive proof. Teams preserve decision-time state while freezing intent, denying credentials, pausing leases and isolating destinations. The Incident Action Ledger becomes the authoritative action population. Provider statements and agent reports are tested against receiving-system evidence.

During continuity, the business owner chooses suspended, manual, isolated or restricted operation through explicit controls, capacity, population and expiry. No team preserves availability by retaining an uncontrolled external effect. False-alert and shutdown harm are legitimate evidence, but they never become a generic reason to wait.

During recovery, the trusted checkpoint spans code, configuration, authority, state, queues, tools, external records and people. Causal and neighbouring regressions pass. Affected people, reporting, correction and redress have terminal evidence or an accountable plan. Authority returns gradually under recurrence monitoring.

After closure, lessons update the supply-chain graph, credential lifecycle, red-team trajectories, release evidence, monitoring and provider terms. Drills vary partial logging, cached sessions, unknown queue leases, poisoned memory, unavailable owners, compensation failure and false alerts. Inventory freshness is measured by whether command can stop the next action, not by document age alone.

Primary evidenceReferences

Links and live status were checked on 2 September 2026. NIST SP 800-61 Revision 3 is the current final revision and supersedes Revision 2. NIST AI RMF 1.0 remains current while revision is under way. The Actuation Containment Model, Stop-the-Next-Action Ladder, Incident Action Ledger, dual clocks, Trusted Recovery Conditions and Board are this article’s synthesis.

1. NIST SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management.
2. NIST Cybersecurity Framework 2.0.
3. NIST SP 800-184, Guide for Cybersecurity Event Recovery.
4. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response.
5. NIST SP 800-207, Zero Trust Architecture.
6. NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, Release 5.2.0.
7. NIST, Artificial Intelligence Risk Management Framework 1.0.
8. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile.
9. MITRE ATLAS, Adversarial Threat Landscape for AI Systems.
10. OWASP GenAI Security Project, Securing Agentic Applications Guide 1.0.
11. OWASP LLM06:2025, Excessive Agency.
12. CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks.
13. CISA, Secure by Design.
14. European Union, Regulation (EU) 2024/1689, Artificial Intelligence Act.
15. Shapira, N. et al., Agents of Chaos.
16. Zou, A. et al., Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition.
17. Debenedetti, E. et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents.
18. NIST SP 800-160 Volume 1 Revision 1, Engineering Trustworthy Secure Systems.