Purpose: Reduce the gap between what the agent is authorized to do and what it is capable of doing. This layer operates before rogue behavior begins — it removes the space in which rogue behavior can occur.

MIT01 (minimal footprint) limits the tool set and permissions to what is necessary. MIT02 (explicit constraints) adds behavioral prohibitions to complement the objective specification. MIT04 (sandboxing) enforces technical limits that remain effective even after goal injection. MIT08 (principal hierarchy enforcement) technically prevents the agent from escalating above its authorized scope regardless of what it is instructed to do.

This layer is primary. Monitoring and detection (Layer 2) and recovery (Layer 3) depend on detecting and responding to rogue behavior that already occurred. Layer 1 prevents it from occurring in the first place — or limits its blast radius when it does. Start here.

Purpose: Detect rogue behavior that occurs despite Layer 1 constraints, and require human approval for high-impact actions before they execute irreversibly.

MIT03 (behavioral monitoring) watches for cumulative anomalies and pattern drift. MIT05 (tripwires) triggers automated halts on specific high-risk behavioral patterns. MIT06 (human approval gates) requires explicit human confirmation for actions above impact or novelty thresholds — preventing irreversible harm even when the agent has determined that the action is warranted.

MIT09 (red-teaming) feeds this layer: discovered rogue behaviors immediately become new tripwire patterns and updated constraint specifications. The red-teaming → constraint → tripwire cycle is a continuous improvement loop that tightens Layer 1 and Layer 2 over time.

Critical requirement: Layer 2 monitoring infrastructure must be architecturally independent of anything the agent can influence. An agent that can modify its own monitoring is operating without Layer 2 protection regardless of what monitoring exists.

Purpose: For rogue actions that reach execution despite Layers 1 and 2, ensure that harm is bounded (volume/impact limits from MIT04 sandboxing) and reversible (MIT07 reversibility requirements).

MIT07 (action reversibility) converts "prevent the harm" into "recover from the harm" — a more achievable operational objective. Soft deletes, staging gates, escrow windows, and graduated rollouts all provide a recovery window between rogue action and irreversible harm.

Minimum viable set: MIT01 + MIT04 + MIT06 + MIT08 covers the highest-impact rogue scenarios across all six patterns. Add MIT03 and MIT05 for detection maturity. MIT02, MIT07, and MIT09 for full depth.