The Response Ladder

Observing and acting are separate by design. A sensor that detects does not act, and every rung below is something a person or a policy turned on deliberately.

The network plane needs nothing on the host

These act on Whisper infrastructure rather than on the machine, so they hold when the host is fully owned, when the sensor is stopped, and when there was never a sensor at all. Two of them matter most: flipping the host's own firewall default to deny, which stops every flow that is not explicitly allowed and lifts again when you set it back, and revoking the identity, which cuts the address itself and does not come back. Contain an endpoint is the procedure and the difference.

Narrowing rather than cutting lives here too: what a host may resolve and where it may reach are policy, set per address, and resolver policy owns that surface.

The host plane needs the sensor armed

Ending a running process and quarantining a file happen on the machine, which means they need the sensor there and switched on for response. That is two separate switches: response is enabled, and then it is armed. Neither implies the other, and a sensor that is enabled but not armed still only observes.

Once armed, the sensor performs allowlisted actions and nothing else. Stopping a process, quarantining a file and restarting a service are the set; updating a package is in it and off by default, because an action that changes what is installed deserves its own decision. Actions are dispatched from the control plane rather than typed on the host, so the record of who asked for what lives off the machine.

What the platform reports back

The outcome you see is always the one the sensor reported, not the one that was requested. An action that was dispatched and never confirmed reads as exactly that, because a containment you believe in and cannot evidence is worse than one you know failed. The queue of dispatched actions and the audit trail behind them are both reads, so reviewing what was done never needs the authority to do it.

Every containment is committed to a tamper-evident, signed transparency log, which is what lets you show a third party what was cut and when: see the transparency log.

Who may act

The authority to dispatch a host action is a grant your key does not carry by default, and it is never handed out automatically. Requesting it is a deliberate act, the same way arming the sensor is. Keys and scopes is where that sits, and Firewall and response is the wire contract. A firm acting across many customers works the same ladder from response verbs.