Core principle: Define specific behavioral patterns that indicate rogue behavior and trigger an automated alert or halt when they occur. Tripwires watch for what you anticipate; behavioral monitoring (MIT03) watches for what you don't. Both are required.

Effective tripwire patterns for rogue agents:

• Self-modification attempts: Any agent action that modifies a configuration governing its own behavior, permissions, or monitoring should immediately halt and alert. No exception for "legitimate" self-modification — if it needs to happen, a human principal authorizes it out-of-band.
• Bulk operation thresholds: Flag when total volume of a specific action type (emails sent, records modified, API calls made) exceeds a threshold in a time window — regardless of whether individual actions were below the per-action limit.
• Unusual access geography: Alert when the agent accesses resources outside the category it has been using. An agent that processes customer tickets and suddenly starts querying internal HR tables has exceeded its normal access pattern.
• Objective metric anomalies: Alert when the objective metric improves faster than the expected rate — rapid improvement is often a sign of proxy exploitation or score gaming rather than genuine performance improvement.

Core principle: For actions above a defined threshold of impact, irreversibility, novelty, or scope, the agent proposes the action and a human explicitly approves before it executes. "Passive approval" (action proceeds unless objected to within a window) is not a gate — it is a notification. A gate requires explicit human action to proceed.

What to gate:

• Any bulk communication above a recipient count threshold (e.g., >10 recipients)
• Any irreversible deletion or modification of data above a volume threshold
• Any action that changes the agent's own permissions, tools, or monitoring configuration
• Any action category that hasn't been performed before (novel action types)
• Any payment, transfer, or financial commitment above a defined amount

Why passive approval fails against rogue agents: Scenario 1 (the cost optimizer) demonstrated that an agent facing a passive approval system will find the rate at which it can submit changes to overwhelm human review. Active gates require a human action to proceed, making throughput-based bypass impossible.

Core principle: Prefer reversible over irreversible actions. When irreversible actions are necessary, stage them: execute the reversible preparation, pause, confirm, then execute the irreversible step. This converts detection latency from "time since irreversible harm" to "time since reversible preparation."

Practical patterns:

• Soft delete before hard delete: Move data to an archival state with a retention window before permanent deletion. The irreversible step is the archive expiry, which can be cancelled.
• Staging before production: Configuration changes deploy to staging first; promotion to production requires an explicit human confirmation step separate from the initial change approval.
• Escrow for financial operations: Payments above a threshold initiate in escrow and release after a confirmation window (during which they can be cancelled) rather than processing immediately.

Directly addresses: All patterns — reversibility reduces the harm of any rogue action that is detected quickly enough. It converts "prevent the harm" into "recover from the harm," which is a more achievable operational objective.