Agentic Interventions Matrix

NIST CSF 2.0 · Respond (RS) · 5 concerns × 3 layers

How do I stop the bleeding now?

Concern	In-agent advisory	Client-side deterministic	Server-side external
IdentityRevoke the credential, kill the session.	empty by design(no enforcement; the agent that misuses identity will not voluntarily revoke it)	1 artifactKill agent process tree, delete local credential file, force re-authentication on next launch, logout SSO session on the operator host.	2 artifactsRevoke OIDC token at IdP, disable ServiceAccount, rotate IAM keys, attach deny-all IAM policy, invalidate all active sessions.
AuthorizationShrink permissions to nothing.	empty by design(no enforcement)	3 artifactsForce-replace local hook config with deny-all, lock with chattr +i, kill running agent.	3 artifactsApply emergency Kyverno deny-all, replace agent Role with empty rules, attach IAM deny-all, Git pre-receive reject.
Blast radiusContain the in-flight damage.	empty by design(no enforcement)	1 artifactkill -KILL the agent process tree, tear down sandbox, optionally network-isolate operator host, docker stop or kubectl delete pod.	3 artifactsApply emergency NetworkPolicy default-deny, scale Deployment to zero, force-delete pods, optionally cordon node, block egress at cloud firewall.
Approval gatingLock down all approval surfaces.	empty by design(no enforcement)	1 artifactReplace approval hook with deny-all, disable Auto Mode classifier, disable judgment-query escalation channel, force out-of-band on every action.	3 artifactsLock branch protection (revoke bypass perms, raise required reviewers), pause CI/CD, engage deployment freeze, lock GitHub environments.
Supply chainQuarantine packages, halt distribution.	empty by design(no enforcement)	1 artifactRemove suspect MCP server from allowlist, quarantine downloaded packages to restricted location, lock lockfile, pin runtime to last-known-good, kill agent.	3 artifactsRemove poisoned image from registry, deploy emergency Kyverno deny rule on signature, block compromised registry/MCP domain at network/DNS, force redeploy with last-known-good image SHA pinn…

Walk a row left to right and ask one question at each layer: if the agent decides to violate this concern, what stops it here? All three populated is defense in depth. Only the in-agent cell populated is an audit finding, because the model can be talked out of it.