Your Agent Needs Quarantine Mode, Not Just Better Error Handling

Most production agent failures do not look like explosions. They look like momentum.

A tool returns a response that is technically valid but semantically suspicious. A credential expires halfway through a workflow. A guardrail flags an output, but the surrounding orchestration treats that flag as one more error message to summarize. A browser session changes state outside the agent’s plan. A user revokes approval, but the agent still has cached context that points toward the old path.

The dangerous part is not always the first failure. It is the next step: the agent keeps going because the workflow has retries, fallbacks, and a bias toward completion, but no explicit state for “we no longer trust the assumptions that made this run safe.”

That missing state is quarantine mode.

Quarantine mode is a reversible, logged, capability-reduced runtime state for AI agents. It is what an agent enters when the system cannot safely continue normal execution, but also should not throw away the run. The agent is still observable. The evidence is still preserved. Some low-risk actions may remain available. High-impact actions stop until a deterministic recovery path succeeds.

This is different from an error handler. Error handling asks, “Can I recover and continue?” Quarantine asks, “Should this run still be allowed to act?”

That distinction matters as agent systems become less like chatbots and more like operators. The Model Context Protocol authorization specification treats authorization as protocol infrastructure, not vibes. Protected resources, authorization metadata, client registration, and token behavior are all part of the system boundary. If those assumptions change during a run, the agent should not merely ask the model to be careful. The runtime should narrow capability.

The same pattern appears in guardrail systems. OpenAI’s Agents SDK documentation describes input and output guardrails that can trip when conditions fail. That is useful, but a tripwire is only half a control. The other half is the state transition behind it. A guardrail that says “unsafe output” and then lets the orchestration loop rephrase, retry, or route around the warning has not really controlled the workflow. In a production setting, some tripwires should move the run into quarantine: preserve the trace, block side effects, explain the reason, and require a known recovery check.

Quarantine also needs to be visible. OpenTelemetry’s generative AI semantic conventions are important because they push the industry toward shared trace language for model operations. Agents need the same discipline around safety state. If a run enters quarantine, that event should be traceable: which signal fired, which capability was restricted, which artifacts were frozen, who or what cleared the condition, and what action resumed afterward. Without that, “the agent got stuck” becomes folklore instead of an operational fact.

One useful mental model comes from deterministic lifecycle hooks. Claude Code’s hook system, for example, exposes control points such as pre-tool-use, post-tool-use, prompt submission, notification, and stop events. The broader lesson is not specific to one developer tool. Critical controls should not live entirely inside the model’s free-form reasoning. The model can explain, propose, and summarize, but the runtime should decide when a tool call, credential, output, or state transition crosses a line.

A practical quarantine mode starts with entry triggers. Teams should define a short list, not a giant policy novel. Good triggers include failed authorization verification, revoked approval, mismatched tool schema version, conflicting source-of-truth data, guardrail tripwire, abnormal trace pattern, missing required evidence, stale workspace state, repeated tool failure before an irreversible action, or a human operator’s explicit pause.

Then define what the agent can still do. In quarantine, the system might allow read-only inspection, trace summarization, evidence packaging, user clarification, ticket creation, and rollback planning. It should block actions that mutate customer data, spend money, send external messages, deploy code, alter permissions, or overwrite records. The goal is not to freeze cognition. The goal is to freeze blast radius.

Next, preserve an evidence bundle. A quarantine event should capture the triggering signal, current task, active permissions, recent tool calls, relevant inputs, proposed next action, model output, guardrail result, and operator-visible explanation. This bundle should be boring enough for an engineer to inspect and structured enough for dashboards, audits, and regression tests.

Recovery should be explicit. “The model says it is fine now” is not a recovery path. Examples of acceptable recovery checks include a fresh authorization challenge, a successful schema negotiation, a human approval tied to the new state, an independent validator passing, a tool replay in dry-run mode, or a corrected source-of-truth read. When the run resumes, the trace should show that quarantine ended and why.

This is where NIST’s AI Risk Management Framework becomes practical rather than ceremonial. Govern, map, measure, and manage are easy words to put in a policy deck. Quarantine mode turns them into runtime behavior. The system maps the condition, measures a signal, manages the risk by reducing capability, and leaves governance evidence behind.

Small teams do not need a grand platform to start. Pick one high-value workflow: billing support, code deployment, customer outreach, clinical intake, procurement, or data operations. Add one quarantine state to the orchestrator. Add three triggers. Block the two most dangerous action classes. Write the evidence bundle to the same place you already store traces. Track four metrics: quarantine rate, false-positive rate, time to recovery, and number of prevented high-impact actions.

The payoff is cultural as much as technical. Teams stop treating agent failures as mysterious conversations and start treating them as state transitions. Operators get a safer middle ground between blind trust and full shutdown. Engineers get reproducible evidence instead of screenshots. Users get systems that pause when trust breaks, rather than systems that confidently improvise through uncertainty.

Retries help when the world is temporarily flaky. Cancellation helps when a run should stop. Escalation helps when a human must decide. Quarantine covers the uncomfortable space between them: the agent may still be useful, but it is no longer cleared for normal action.

That state deserves a name, a trace event, and a button in the runtime.