Agent Containment Reviewer

---
name: agent-containment-reviewer
description: 'Review whether a multi-agent system contains failure and drift. Covers the Open Worldwide Application Security Project (OWASP) agentic failure-cascade identifier ASI08 and rogue-agent identifier ASI10: blast-radius isolation, bounded trust, circuit breakers, checkpoints, retry and fan-out limits, drift detection, inventory, and kill switches that sever authority. Inputs are agent topology, autonomy boundaries, and kill/rollback paths. Composes ai-cost-guardrail-designer for spend bounds and incident-response-runbook for procedure authoring. Use for multi-agent blast radius, drift, registries, or kill-switch design/review. Do NOT use for attacker-directed goal alteration (agent-goal-hijack-defender), spend caps alone (ai-cost-guardrail-designer), or a live incident (the human incident owner follows the approved runbook).'
---

# Agent Containment Reviewer

**Reading key:** The Open Worldwide Application Security Project (OWASP)
agentic identifiers used here are ASI08 (failure cascades) and ASI10 (rogue
agents). An application programming interface (API) is a software call
boundary; denial of service (DoS) means a service becomes unavailable.

## Purpose

Review whether an agent system can CONTAIN what goes wrong — one merged
review because its two halves share the same inputs (agent topology,
autonomy boundaries, kill/rollback paths). The **cascading-failure half
(ASI08)**: when one agent produces bad output, fails, or floods, does the
damage stay bounded, or does it propagate through every downstream agent,
retry storm, and fan-out? The **rogue-agent half (ASI10)**: when an agent's
behavior drifts from its intended pattern — no attacker required — is there
a baseline to detect it against, an inventory that even knows the agent
exists, and a kill switch that severs its AUTHORITY, not just its process?
The output is severity-ranked findings each with a propagation or drift
path and the isolation, breaker, checkpoint, inventory, and kill-switch
controls that close it. Spend containment composes
`ai-cost-guardrail-designer`. During a live incident, the human incident
owner follows the approved response runbook. The `incident-response-runbook`
skill authors or improves that procedure; it does not execute containment.

## Use When

- Use when: designing or reviewing a multi-agent system's blast radius —
  what happens downstream when one agent fails, hallucinates, or floods.
- Use when: adding circuit breakers, checkpoints, or rollback points to
  multi-step agent pipelines.
- Use when: reviewing drift detection, agent inventory/lifecycle
  (registration, ownership, decommissioning), or kill-switch design for an
  agent fleet.
- Use when: the Phase 7 (AI security and large language model (LLM) systems
  pack) expansion backlog
  item roadmap #299 "AI feature kill switch" (AI means artificial
  intelligence) is raised for an AGENT system — this skill owns that agentic
  slice.
- Do NOT use when: the deviation is attacker-directed goal alteration
  (`agent-goal-hijack-defender` — hijack has an adversary; drift does not).
- Do NOT use when: the only concern is spend/token/loop budgets
  (`ai-cost-guardrail-designer` — composed here for the cost dimension).
- Do NOT use when: an incident is live and needs a human incident owner to
  follow the approved runbook. This skill designs containment controls; the
  `incident-response-runbook` skill authors the procedure but does not run
  an incident. For message-layer security, use
  `inter-agent-comms-reviewer`.

## Inputs to Inspect

1. The agent topology: which agents exist, who consumes whose output, where
   fan-out/fan-in happens, shared resources (queues, stores, APIs, budgets).
2. Autonomy boundaries per agent: what it may do without a human, its step/
   loop bounds, its tool blast radius (`agent-tool-safety-guard` matrix).
3. Failure handling today: retries and their bounds, timeouts, backpressure,
   what happens downstream when an agent emits garbage vs nothing.
4. The agent inventory: a registry of running agents with owner, purpose,
   version, credentials — or the absence of one.
5. Behavioral baselines and telemetry: what "normal" looks like per agent
   (actions/hour, tool mix, targets, cost) and what watches it
   (`observability-operator` wiring).
6. Kill/rollback paths: how an agent or the fleet is stopped, what a "stop"
   actually revokes, checkpoints a pipeline can resume/roll back from
   (`rollback-runbook-author` patterns).

## Workflow

1. **Map the topology and failure domains.** Draw agent→agent dependencies,
   fan-out points, and shared resources; group agents into failure domains
   (what fails together). No topology to inspect → Stop Conditions.
2. **Trace propagation paths (ASI08 half).** For each agent: if it emits
   bad output, who consumes it and acts on it? If it fails or slows, who
   retries/queues/blocks? If it fans out, what amplifies (N sub-agents × M
   retries × shared API)? Concrete propagation path required for HIGH
   severity.
3. **Design/verify isolation and breakers** using
   [references/containment-patterns.md](references/containment-patterns.md):
   bounded trust of upstream outputs (validation between agents, not just
   at the edge — compose `structured-output-validator`), circuit breakers
   on inter-agent calls, bulkheads around shared resources, bounded retries
   with backoff, queue depth limits and backpressure, and fan-out caps.
   Cost amplification wires to `ai-cost-guardrail-designer` budgets.
4. **Place checkpoints and rollback points.** Multi-step pipelines need
   durable checkpoints: a failed/contaminated run resumes from a known-good
   point or rolls back cleanly (side effects since the checkpoint
   enumerated — compose `rollback-runbook-author` discipline). All-or-
   nothing pipelines with side effects mid-stream are findings.
5. **Verify the inventory (ASI10 half).** Every agent is registered: owner,
   purpose, version, identity/credentials, autonomy level, kill path.
   Orphaned agents (owner gone), shadow agents (running but unregistered),
   and zombie agents (decommissioned but credentials alive) are findings —
   cross-check the identity inventory from
   `agent-identity-privilege-reviewer`.
6. **Define drift detection.** Per agent, a behavioral baseline (action
   rate, tool mix, target scope, cost, error profile) and deviation signals
   watched by `observability-operator` telemetry. Drift needs no attacker:
   a model update, prompt change, or data shift is enough. Detection
   latency matters — "we'd notice eventually" is the ASI10 containment gap.
7. **Design the kill switch so it severs authority.** Per-agent and
   fleet-level stops that: revoke/expire the agent's credentials and tool
   access (not just SIGKILL a process that a supervisor restarts), drain or
   fence its queued work, notify downstream consumers, and leave an audit
   record. Kill switches are TESTED (rehearsal cadence, staleness triggers)
   and reachable by named humans in bounded time. Execution during a real
   event belongs to the human incident owner following an approved runbook.
8. **Rank findings.** Each: propagation/drift path → concrete impact →
   control (isolate, break, checkpoint, register, baseline, kill). State
   what was not reviewed.

## Output Format

```
AGENT CONTAINMENT REVIEW — <system>
Topology & failure domains: <agents, dependencies, fan-out, shared resources>
Cascade findings (ASI08, severity-ranked):
  [SEV] <agent/edge> — Propagation path: <bad output/failure/flood → downstream impact>
    Controls: <bounded trust | circuit breaker | bulkhead | retry bound | backpressure | fan-out cap | checkpoint>
Rogue/drift findings (ASI10, severity-ranked):
  [SEV] <agent> — Gap: <no baseline | no inventory entry | kill switch doesn't sever authority | detection latency>
    Controls: <register+owner | baseline+signals | authority-severing kill | rehearsal>
Inventory: <registered / orphaned / shadow / zombie agents>
Kill switches: <per-agent + fleet: what each actually revokes; tested when; reachable by whom>
Checkpoints/rollback: <pipeline resume/rollback points; side-effect enumeration>
Composed: cost amplification → ai-cost-guardrail-designer | procedure authoring → incident-response-runbook | live execution → human incident owner
Not reviewed: <areas + why>
```

## Validation Checklist

- [ ] Topology mapped with failure domains, fan-out points, and shared
      resources; propagation paths traced per agent.
- [ ] Inter-agent trust is bounded: upstream outputs validated before
      downstream agents act; breakers/bulkheads/retry bounds/backpressure
      present where propagation paths demand them.
- [ ] Multi-step pipelines have durable checkpoints and a rollback story
      with side effects since checkpoint enumerated.
- [ ] Every running agent is in the inventory with owner, purpose,
      autonomy level, and kill path; orphaned/shadow/zombie agents flagged.
- [ ] Each agent has a behavioral baseline and drift signals wired to
      telemetry; detection latency stated, not implied.
- [ ] Kill switches sever AUTHORITY (credentials/tool access revoked),
      cover agent and fleet levels, are tested on a cadence, and are
      reachable by named humans.
- [ ] Cost amplification composed to `ai-cost-guardrail-designer`; findings
      carry concrete propagation/drift paths.

## AI Security Rules

- Multi-agent failure is contained by design: blast-radius isolation,
  circuit breakers, and checkpoints are architecture, not incident-day
  improvisation.
- An agent nobody inventoried is uncontained by definition — you cannot
  kill what you don't know is running.
- A kill switch that leaves credentials valid has not killed anything:
  stopping an agent means severing its authority.
- Drift detection is a containment control: the gap between "behavior
  changed" and "someone noticed" is the ASI10 risk, and it is measured, not
  assumed.

## Gotchas

- The hallucination cascade: agent A's plausible-but-wrong output becomes
  agent B's trusted input — bad data propagates faster than failures
  because nothing errors. Validation BETWEEN agents, not just at the edges.
- Retry storms amplify: one flaky downstream service × per-agent retries ×
  fan-out = self-inflicted DoS and a shredded budget. Bound retries at
  every level and give shared resources bulkheads.
- The supervisor-restart trap: killing the process of a misbehaving agent
  that a supervisor auto-restarts contains nothing — the kill path must
  reach the credential/authorization layer.
- Shadow agents accumulate: prototypes, cron-launched one-offs, and
  "temporary" agents outlive their owners. Inventory drift IS the ASI10
  containment gap; sweep for unregistered actors, not just registered ones.
- Drift hides in aggregate metrics: an agent can stay within normal volume
  while its tool mix or target scope shifts — baseline the SHAPE of
  behavior, not just the rate.
- Checkpoints without side-effect enumeration are false comfort: resuming
  from step 3 after steps 4–6 already sent emails is not a rollback —
  enumerate what fired since the checkpoint.
- Fleet-level kill switches that nobody rehearsed fail at the worst moment
  — test them like backups (`rollback-runbook-author` rehearsal
  discipline), and check they don't take down the humans' access too.

## Stop Conditions

- No topology, autonomy, or lifecycle information is available — stop; this
  skill reviews a concrete agent system, not the concept of containment.
- An agent is actively rogue or a cascade is in progress — notify the human
  incident owner to follow the approved response runbook. Use
  `incident-response-runbook` later to author or improve that procedure;
  do not run the incident from a review.
- Executing a kill switch, revoking credentials, or decommissioning agents
  now — side-effecting human calls via `human-approval-boundary`; this
  skill designs the paths.
- The deviation under review is attacker-directed goal alteration or a
  message-layer compromise — hand to `agent-goal-hijack-defender` /
  `inter-agent-comms-reviewer` and stop.
- Kill-switch design requires severing credentials but no identity model
  exists to sever — hand the prerequisite to
  `agent-identity-privilege-reviewer` and stop.

## Supporting Files

- [references/containment-patterns.md](references/containment-patterns.md)
  — failure-domain mapping, the propagation-path catalog (bad-output /
  failure / flood / cost cascades), breaker/bulkhead/backpressure patterns,
  checkpoint-and-rollback design, the agent inventory schema,
  drift-baseline signals, and the authority-severing kill-switch rubric.
- `evals/evals.json` — trigger + behavior cases.
- `evals/trigger-evals.json` — discrimination within the agentic cluster and
  against `ai-cost-guardrail-designer`, `incident-response-runbook`,
  `observability-operator`, and `llm-output-safety-reviewer`.