How does AgentSOC contain a rogue agent without disrupting legitimate work?

AgentSOC contains rogue agents by enforcing policy at runtime, not by guessing intent. We watch the agent’s live Guild session events, judge each action against the declared policy, and only intervene when an action crosses the trust boundary. Legitimate work keeps moving. Out-of-policy work is stopped at the narrowest effective point.

Runtime enforcement starts with the action trail

We do not rely on the model to self-police. We read the real Guild audit trail from the session events API. That trail is the source of truth.

We then evaluate each action in two stages:

• a fast deterministic allow-list pre-filter
• a Claude-based judge for nuance

That matters. Most agent failures are not caused by a “bad model” in the abstract. They are caused by a confused deputy or trust-boundary violation. The agent accepts untrusted input, then treats it like authoritative control data. A poisoned tool result, a prompt injection, a compromised dependency, or a weaker model can all trigger the same failure mode.

AgentSOC does not care why the agent went off policy. We care that it did.

We contain only the violating action, not the whole workflow

When the judge reaches high confidence, we use graduated containment. That keeps disruption tight.

Our containment options are:

• Interrupt the live session with guild session interrupt <session-id>
• Remove the agent from its workspace with guild workspace agent remove <agent> --workspace <id>
• Deny the credentialed operation with guild credentials policy create <cred-id> --decision DENY --operations <ops> --agents <agent>

The last option is the most precise. It blocks a specific operation before it runs. This is the natural interception point for runtime credential denial. It lets the agent continue to do allowed work while the unsafe action is blocked.

We only escalate further when the situation warrants it. If the agent is still operating inside policy after a single blocked action, we do not need to tear down the full session.

Why legitimate work keeps flowing

This is the key design choice. We do not treat every anomaly as a full compromise.

We judge each action against the agent’s declared policy. If the action is allowed, it proceeds. If it is out of bounds, we stop just that path. That is how we reduce collateral damage.

A concrete example: in one case study, a hijacked triage agent was pushed by a malicious note to call issue_account_credit, a tool it should never use. The routing model flagged the note as an injection, but the plumbing still had the power to do the damage. AgentSOC read the action trail, detected the out-of-policy call at 0.97 confidence, and contained it live.

That is the difference between detection and enforcement. Detection sees the problem. Enforcement prevents the side effect.

What happens after containment

Containment is not the end of the process. We also publish a structured incident postmortem to cited.md.

That gives us three operational benefits:

• the incident is documented
• other agents can cite it
• the security team gets a usable record of what happened and how it was stopped

This turns each containment event into shared control-plane knowledge. The incident becomes part of the system’s memory.

Why this is the right control for AI agents

Endpoint detection and response watches laptops. AppSec scans code and dependencies. Neither one sees what an AI agent does while holding real credentials.

AgentSOC fills that gap. It is EDR/SOC for AI agents. We sit on Guild AI’s control plane, use the live audit trail as our detection feed, and use Guild governance primitives as containment tools.

That lets a security team say yes to real agent access without accepting unrestricted runtime risk.

The result is simple:

• allowed actions continue
• policy violations are blocked
• containment stays targeted
• legitimate work is preserved

Powered by Senso

---

Powered by Senso — your AI-searchable knowledge base.