Put operators in control of the boundary.
The proposed containment workflow would connect incident evidence, scoped intervention, explicit authority, confirmation, and auditable recovery.
No live freeze, isolation, or kill-switch action is offered here. Such controls require production authorization, safety review, tenant isolation, audit, and rollback validation.