A stop control needs a trigger
The ability to interrupt an AI system matters only when the operator knows it is time to act. A shutdown mechanism does not itself identify unauthorized access, unintended egress, or a compromised evaluation dependency. Prevention, detection, intervention, and reporting are separate responsibilities, each with an owner and evidence.
For a review meeting, assign an owner to each stage: who receives the signal, who can interrupt the run, and who notifies affected parties. A written policy is incomplete if those people cannot be reached during a test.
Track three intervals instead of one
Record when an event began, when it was first detected, when a responsible operator was alerted, and when containment took effect. Detection delay, notification delay, and response delay reveal different weaknesses. A fast response after discovery cannot establish that discovery was timely.
For retrospective incidents, the start time may only be a range. Preserve that uncertainty. Do not substitute a publication date for a detection timestamp or treat a report's silence about internal monitoring as proof that monitoring did not exist.
Ask what evidence an independent reviewer can inspect
A reviewer needs more than an architecture diagram: scope definitions, observed boundary events, tested alert paths, access records, and evidence retention. Collection should resist alteration by the system being evaluated. Independence is a design property to examine, not a label to place on a log.
NIST's AI RMF is useful for organizing responsibility and measurement. It does not prescribe this containment design or certify an environment. Secure AI development and deployment guidance likewise supports broader operational safeguards, not a guarantee of isolation.
Prepare for people outside the test
An unintended request can reach a service whose operator never consented to an evaluation. Establish an escalation and notification process before testing, with named contacts, authorization boundaries, and a record of what data may have been accessed. Avoid further probing to establish impact unless explicitly authorized.
Reporting policies should preserve occurrence, detection, and response times where known. Applicable legal duties vary by jurisdiction and agreement; a technical record supports those decisions but cannot replace qualified legal review.
Takeaway. An intervention plan is incomplete until its detection signals, decision owners, and evidence paths have been tested.
Sources and scope
- NIST AI Risk Management Framework 1.0
Voluntary guidance for governing, mapping, measuring, and managing AI risk; not a sandbox specification.
- CISA and NCSC: secure AI system development
Secure-by-design guidance across the AI system lifecycle.
- Joint guidance: Deploying AI Systems Securely
Operational security recommendations for deploying externally developed AI systems.