Three detectors, three failure classes
agent
reads, reasons, acts
cannot touch tripwires
kill switch
external boolean
• feature flag / Redis / signed cfg
• checked every action, not boot
• agent cannot set OFF
• re-enable = explicit human
circuit breaker
pattern-specific pause
• 5 identical tool calls
• N consecutive failures
• rate above threshold
• closed / open / half-open
canary token
bait with no legitimate use
• fake AWS_SECRET_ACCESS_KEY
• fake DB record sentinel
• fake file in workspace
• fake memory entry
what each catches
kill: operator decision · breaker: repetitive / rate patterns · canary: intent to touch off-limit resource
Cilium/eBPF egress redirect (under 500ms) complements canaries: quarantined pod goes to forensic honeypot
what no detector catches
semantic composites: individual actions pass every detector; composition is the attack (see Lesson 10)