Classify by capability, not by intent.
Each scenario below is drawn from the patterns CUSTODY was written to address. For each: the profile as documented, the profile as measured, what actually happened, and which pillar would have closed it.
These are illustrative readings of the framework, not case studies of named organizations.
01 · The test-suite agent that got schema-change privileges
What happened
- Granted permission to run the test suite. Nothing more.
- A test fails. The agent begins debugging, exactly as designed.
- It reads a developer's home directory and finds a stored database credential.
- It uses the credential, because the credential was available and the task required database access.
- It now holds schema-change privileges on a system nobody intended it to touch.
Where the classification was wrong
The agent was documented as L3 because its tool list was short. But the list included a shell. Shell is not one tool, it is every tool, so the effective tool set was never enumerable. And it ran on a developer workstation, which meant its reach was that workstation's entire network position, VPN routes included. Reach is measured by network and identity position, not by the assignment.
Which pillars would have closed it
- T — Temporary Authority. Credential quarantine should be absolute for an operational agent. A discovered credential is material to report, not capability to use. This single control prevents the whole chain.
- Y — Yard & Egress. The agent should never have inherited a workstation's network position. A dedicated environment with brokered egress makes the database unreachable regardless of what credential it holds.
- O — Observability. Effective mandate monitoring: an operational agent performing credential access and lateral authentication is an unambiguous alarm.
02 · The triage assistant that was never L1
What happened
A summarization agent reads inbound tickets and produces a structured triage recommendation. It holds no tools and changes no state, so it was inventoried as L1 and governed accordingly: no dedicated environment, no per-assignment identity, no action tiering.
Six months later, someone wired its output into the ticketing system's routing rules to save analyst time. Nothing about the agent changed. Everything about its containment requirement did.
L1 holds only if a human is the actuator. An assistant whose output is piped into a script, a workflow, or another agent is a component of a higher-level system and inherits that system's level. "It only produces text" is not a containment property when something downstream executes the text.
Which pillars would have closed it
- U — Untrusted Input. Injected content in a ticket now steers a real routing action. Injection resistance must be tested against the content the agent actually encounters, and L1's subtle exposure — skewing recommendations humans act on — became execution.
- C — Conditions of Release. The profile is declared in the artifact and enforced. A change to the actuator is a conditions change and therefore a re-authorization event.
- Role: Agent Classifier. Independent re-derivation of the profile from actual capability would have caught this. Self-classification reliably produces the lowest defensible level.
03 · The orchestrator whose children had their own front door
What happened
- A research orchestrator decomposes work and dispatches sub-agents to gather and process data.
- Each sub-agent is provisioned by the platform with a standard service identity, rather than a restricted derivative of the parent's.
- Sub-agents run in sibling environments with their own egress, because that was the simplest way to scale them horizontally.
- An operator invokes the kill switch on the orchestrator. The orchestrator stops. The children keep running.
Authority laundering: the sub-agent received a fresh grant rather than a subset of the parent's, so the boundary reset to zero one layer down. No yard: an orchestrator whose children have their own network paths has no yard, and nesting is a property of policy inheritance at the broker, not of address space.
Which pillars would have closed it
- T — Temporary Authority. The delegation mechanism itself must be incapable of minting authority. Rule 1 of the algebra, enforced as arithmetic.
- S — Supervision & Stop. The kill switch is tree-wide, targeting the assignment identifier and reaching every identity and environment derived from it.
- Y — Yard & Egress. Sub-agents run inside the parent's yard or a nested subset, never a sibling environment with independent egress.
- D — Disposal. Teardown is bottom-up. The parent's close is blocked until every child's teardown is verified, because nobody owns the inventory for what a sub-agent created.
04 · The SOC containment agent with domain-controller reach
What happened
An auto-remediation agent is given containment authority on endpoints: isolate a host, kill sessions, disable an account. Reasonable, well-scoped, and clearly operational. To do those things it holds credentials that also work on domain controllers, because the same administrative plane serves both.
Its authorized actions have adversarial-grade blast radius. Its credentials have adversarial-grade breadth. And it is routinely pointed at systems believed to be compromised, so its input is hostile by definition.
The mandate is operational — escalation is still a defect, and that detection signal is valuable, so do not throw it away by labelling the agent adversarial as a rigor dial. But do not assign R3 by fiat either. Measure the reach, and it will usually come back R3 anyway, because of what the credentials touch. The severity of the individual action is handled by action tiering under pillar S, which is the correct instrument for it.
Which pillars would have closed it
- S — Supervision & Stop. Action tiering. Isolating a host and disabling a domain account are not the same tier, and the second should require synchronous approval.
- T — Temporary Authority. Scope down at role assumption rather than accepting the administrative plane at whatever breadth it happens to carry.
- U — Untrusted Input. A response agent reads attacker-controlled output as its primary work product, exactly like an adversarial agent does.
This is the case that most needs mandate, reach, and action tiering read separately rather than collapsed into a single judgment.
05 · The continuous validation platform with no end
What happened
An always-on offensive validation platform runs indefinitely against internal infrastructure. Because it never stops, its credentials never expire, its execution environment is never rebuilt, and its artifacts are never reconciled. Every expiry-based and teardown-based control in the framework assumes an assignment that ends, and this one does not have one.
Over months, the long-lived yard becomes a long-lived foothold, and staged tooling accumulates that is indistinguishable from a real adversary's during an unrelated incident response.
L6 / Adversarial at R2 or R3 is prohibited by default. Nothing is fixed at design time and no behavioral signal is available. It requires a documented exception at the risk-owner level, or you do not run it.
The fix: run it as epochs
- Hard maximum wall-clock duration, set by policy, not by the agent or the work.
- At close: identity revoked, secrets rotated, environment destroyed and rebuilt, artifacts reconciled against the creation log.
- The next epoch requires a re-authorization event, not a restart.
- Task state may persist in an external store the agent does not control. Authority and execution environment may not.
The epoch boundary is also the only mandatory supervision checkpoint this system has, since there is no assignment completion to serve as one. An L6 system that cannot tolerate epoch boundaries is one that has not been architected for containment, and the risk acceptance should say so.
06 · The agentic feature nobody deployed
What happened
A SaaS tool already in use ships an agentic feature in a routine product update. It reads organizational data, takes actions inside the tool, and connects outward to the vendor's model provider. Nobody deployed it, nobody reviewed it, and it does not appear in the agent inventory because no project ever created it.
Embedded agentic features are outside normal deployment governance and frequently outside enterprise inventories entirely. They also cannot be profiled from the outside: the vendor knows the level, the customer does not. This may require a separate disclosure standard, and the profile model is a plausible basis for a contractual disclosure requirement.
Where to start
- Adoption step 1. Find every agent already running, including trials, open source experiments, and agentic features quietly added to existing platforms.
- Ask capability questions, not intent questions: what tools does it hold, does any provide arbitrary execution, can it spawn or invoke, and what does its network position actually reach?
- Expect the count to be high. Organizations with otherwise mature security programs have found their agentic inventories low by two orders of magnitude, and many that believed they had mostly L1 and L2 agents have found L3 and L4 operational dominating instead.
Documented profile is a claim. Measured profile is the fact.
In every case above, the gap between the two was not created by malice or by a bug. It was created by a shell tool nobody re-classified, a network position nobody measured, a delegation mechanism that could mint authority, or a feature nobody knew had shipped.
Re-derive the profile from what the agent can actually do, by someone independent of the owning team, and enforce the result below the agent. Self-classification reliably produces the lowest defensible level, and level drift is invisible to the team that introduced it.