Endpoint isolation protects the enterprise from the machine. Agent containment protects the enterprise from the agent while the user keeps working. The distinction sounds small and decides whether your response to a misbehaving agent happens in seconds or after a negotiation.
Two responses, side by side
| Endpoint isolation | Agent containment | |
|---|---|---|
| Unit of response | The machine | The agent |
| Cost to the human | Their normal workflow, usually for the day | The agent-assisted workflow pauses; the rest of the endpoint stays usable |
| Decision friction | High; someone asks whether it is really necessary | Low; a policy decision, reversible in minutes |
| Fit for the threat | A compromised host | A compromised, misdirected, or misconfigured agent |
| What survives the response | Little; network access is heavily restricted | Everything except the contained agent's governed reachability |
The friction column is the operational point. Isolating an engineer's workstation to stop a misbehaving coding agent costs the engineer their day, and that cost is exactly why response gets delayed while the question gets debated. Containment scoped to the agent removes the hesitation, and removing the hesitation is what makes aggressive tripwires affordable. One scope statement keeps the comparison honest: agent containment here is network containment. It removes the agent's governed network reachability without isolating the endpoint; it does not by itself stop local file access, local process execution, or non-network tools, which need OS, process, or filesystem controls of their own.
Three tiers of widening scope
| Tier | Scope | Fires | Evidence to escalate | Released by |
|---|---|---|---|---|
| Session termination | One active session | Automatically, on pre-approved conditions | Policy violation or tripwire | Automatic or operator |
| Persistent quarantine | The agent on the affected endpoint | Automatically, on pre-approved conditions | Repeated violations, integrity failure, confirmed compromise indicators | Operator, after review |
| Fleet-wide block | Every current and future instance matching a selector | On explicit administrative confirmation only | Evidence the risk follows a shared component, not the endpoint | Named administrator |
Agents act at machine speed, chaining tool calls faster than a human reads the notification, so the deployment must support automatic response under pre-approved conditions for the first two tiers; the fleet tier keeps its human confirmation because it carries real operational blast radius of its own. Persistence is a hard requirement within each tier's scope: agents respawn trivially, and a process killed and relaunched on the affected endpoint must come back up contained, because containment that a restart can escape is effectively just a notification.
Fleet selectors
When the evidence points past the endpoint, the block needs to follow the actual risk, which means the fleet tier selects on more than a name: agent type, agent version, or model artifact by hash at minimum, and ideally a specific configuration, dependency, or policy group as well. A block on the agent type when the risk lives in one poisoned skill over-contains the fleet; a block on the endpoint when the risk lives in the model under-contains it. Selector precision determines whether the block actually addresses the risk.
Release, false positives, and the channel that must survive
Joint agency guidance directs organizations to prioritize resilience, reversibility, and risk containment over efficiency gains, and the release procedure is that instruction made concrete: review the evidence, roll the declaration back to last known good where the trigger was a configuration change, reinstate the agent with its declaration intact, and record the release the way the containment was recorded. An agent contained on a false alarm is back in minutes, which means tripwires can be set aggressively without the false-positive cost that makes teams tune detection into uselessness.
One structural requirement underneath all of it: the containment channel must survive the containment. Collapsing an agent's reachability cannot sever the control plane's own path to the endpoint, or the first quarantine is also the last policy update that endpoint receives. Enforcement rides a management channel the agent cannot reach or sever.
What to measure
Four numbers tell you whether containment works: time from tripwire to session termination (target: automatic, seconds), time from decision to fleet-wide narrowing (a 15-minute target is reasonable, and the model recall drill tests it), restart-persistence pass rate (a quarantined agent that survives relaunch contained, every time), and time to reinstate on a false positive (minutes, with the declaration intact).
The model-scoped case
One containment scenario is specific to open-weight deployments: the day the suspect is the model itself. The affected population is every agent served by that model, the fleet selector is the artifact hash, and boundary-scoped containment narrows all of them at once without touching projects on other models. That drill has its own guide: the enterprise model recall playbook.
Where the control plane fits
Ensage AI executes containment at the boundary rather than in the agent: session termination at the AI Session Controller, persistent quarantine enforced by zLink and enclave policy, and fleet-wide block through zCenter on administrative confirmation, over a management channel the agent cannot sever.
