Freeze the one session, not everything
Containment here is deliberately narrow. The session went off-pattern, so the session is what stops:
- Close the workflow. The session works inside a Zambo workflow. Closing it with workflow_close ends that job at a known point: no later call joins its record, and the work routed through that workflow stops there.
- Fix the record. workflow_seal fixes the closed record at its end state, so the snapshot you review later is the same snapshot anyone else recomputes. The record of the incident cannot quietly grow a few extra calls afterward.
- Leave everything else alone. Other sessions, other workflows, and your other AIs are untouched. A runaway session is a reason to freeze one job, not to shut down the whole operation and lose the work that was behaving.
That is the difference between a kill switch and containment. The kill switch answers "how do I stop it all." Containment answers "how do I stop this one, keep the rest, and prove what happened." For the stop itself, with proof it landed, see the kill switch proof guide.
The forensic pack: prove what it did before you stopped it
Once the workflow is closed, the session's story is already written, and it was written call by call as the work happened. The pack you hand yourself, your client, or your future self at 2 a.m. has three parts:
- Every call, in order. Each tool call the session made carries its own receipt: what was called, what went in, what came back, and when. The chain reads as a timeline, not a summary the agent wrote about itself.
- The attempts, not just the successes. A rejected call still mints a receipt. The call that hit the spend limit, the call refused for a bad argument, the call that failed: each one is in the record, so the pack shows what the agent tried to do, not only what it managed to do.
- A record anyone can recheck. Each receipt can be checked at zambo.dev/verify with no account: an agent receipt is a record of one ai agent tool call that anyone can check: it keeps the exact saved bytes and their sha-256 digest, and it proves the result was not changed since it was saved, not that it was right. The pack proves what was saved was not altered after the fact. It never claims the agent's work was correct, and neither should you.
The fences that were already up
Containment works because the session was fenced before it misbehaved. Three fences, all on the same connection:
- Screen what goes in. prompt_shield screens the inputs a session works from, so an injected instruction buried in a page, a file, or a message is flagged before it becomes an action you never authorized.
- Cap what can go out. spend_limit_set puts a ceiling on what a session can spend, and spend_limit_status tells you where it stands. An off-pattern session burns into the cap and stops mattering financially long before it becomes a bill. The setup is in the agent spending limit guide.
- One place to close. Because the work routes through one MCP endpoint, there is one workflow record to close and one receipt chain to read. Nothing about the incident lives only inside the agent's own runtime. The wider checklist is the MCP server security checklist.
Run the next session covered, end to end
Everything on this page is live today, and it all runs on the one connection your agent already uses:
- Fences up front. prompt_shield screens the inputs a session works from, and spend limits cap what it can spend, so every session starts its run inside boundaries you chose.
- A clean freeze point. workflow_close ends the job at a known point and workflow_seal fixes the record at its end state, so the one session stops and every other session keeps running.
- The complete record to judge it by. Every call mints a receipt, rejected calls included, and anyone can check the chain. You judge the run from the record itself.
Zambo covers the calls routed through it: the work your agent does through the MCP endpoint.
Run your next session covered end to end: add Zambo to your AI and the fences, the freeze point, and the paper trail are on from the first call. Start with 20 free calls per day; the Day Pass is $0.99 for 24 hours of full use, and the Zambo Pass is $29 for 30 days.
Set it up before you need it
- Route the agent through the one endpoint. Connect the AI to https://zambo.dev/mcp so its calls pass the fences and mint receipts. Start at zambo.dev/add: 20 free calls per day, no install.
- Set the spend limit at the start of the run, not after the first surprise. A cap set while everyone is calm is the cap that holds.
- Shield the inputs the session will read, especially anything it pulls from the open web or from other people.
- Close workflows per task. A workflow per job gives every freeze a clean edge: one task, one record, one place to stop.
Beyond the free tier, the Day Pass is $0.99 for 24 hours of full use; the Zambo Pass is $29 for 30 days, one payment, or $290 for 365 days, and $19 for 30 days for $ZAMBO holders.
Frequently asked questions
What should I do when my AI agent does something I did not authorize?
Close the workflow the session is working in, so the job ends at a known point and no later call joins its record. Then fix the record with workflow_seal and read the session back from its receipts: every call in order, including the rejected ones. You freeze the one session; the rest of your work keeps running.
Can Zambo detect a rogue session and stop it automatically?
The containment is yours to trigger, and it lands in one move: prompt_shield screens what the session reads, spend_limit_set caps what it can spend, and when a session goes off-pattern you close its workflow. workflow_close ends the job at a known point, workflow_seal fixes the record at its end state, and the receipts show everything the session did before the freeze.
What can I prove about what my agent did before I stopped it?
Everything the session called through Zambo, in order. Each call has a receipt anyone can check, and rejected calls mint receipts too, so attempts are in the record alongside successes. The receipts prove the saved record was not changed since it was saved. They do not prove any single result was right.
Does this cover agents that do not run through Zambo?
Zambo covers the calls routed through it: the work an agent does through its MCP endpoint. Route a session through Zambo and it runs inside the fences, under the spend cap, and on the receipt record from its first call, with the same freeze point ready whenever you need it.
What is an agent receipt?
An agent receipt is a record of one ai agent tool call that anyone can check: it keeps the exact saved bytes and their sha-256 digest, and it proves the result was not changed since it was saved, not that it was right.