Evidence of an incident nobody stopped is worth little. Excubitor checks every tool call an agent makes, stops a run that loops or races, freezes an agent on one person's word, and refuses requests to hosts nobody allowed. Every stop is a signed record that names the rule or the person.
{
"type": "alert",
"agent": "excubitor.containment",
"severity": "HIGH",
"payload": {
"decision": "contained",
"target": "run",
"rule": "runaway_loop",
"subject": "run-7f3a",
"calls": 25,
"window": "10 min"
},
"evidence": {
"chain": "sha256-chain/2",
"prev": "9c41…e2"
}
}
A run that calls the same tool 25 times in ten minutes, or makes 120 calls, is stopped and its next call refused. An agent that sends 120 calls to one destination in ten minutes, or whose identity is flagged three times in an hour, is contained. Thresholds are settings your team reads and changes.
Anyone signed in can freeze an agent at once. Only an administrator, or a person you name, can release it, with a note. Both are signed.
If the check itself cannot run, the agent keeps running and the gap is recorded. You may choose to stop instead.
Hosted agents and your own agents, from any framework, check the contained list before a tool runs. A contained run or agent gets a refusal instead of a result.
While an agent acts, a request made from Python to a host you did not allow is refused and recorded. That covers direct API calls, not only tool servers.
Which tools and which models each agent may use. Anything else is refused, recorded with the policy's fingerprint, and the policy in force is itself a record.
Rules, the contained list, Freeze and Release all run on your own database. Nothing is sent out, and release is limited to the people you name.
Every item names the release that carries it. Releases are signed, and each lists the commands to check them before you install.
Containment rules, Freeze and Release in the console.
The enforcer in the package, outbound request checks, self-hosted and air-gapped containment, per-agent tool and model policies.
Containment reaches an agent sandbox: a contained agent's sandbox is stopped, and started again on release.
Circuit breakers: an agent is contained on a burst of calls to one destination, or when the identity it acts for is flagged three times in an hour. The same rules in the hosted service.
No standing vendor access, ever. Managed with evidence, never on faith.