The LLM agent with read-only investigation credentials outputs a structured containment proposal citing the immutable log event IDs. A deterministic policy engine and a human SOC analyst sign the approval before the privileged execution service runs the containment command.