How can operators stop coordinated agent intrusions now?

The conclusion states it in one sentence: "The doctrine is to preserve relationships across executions, constrain their shared resources, and connect response to surviving state." It then names what an operator can do without waiting for research: "Operators can specify collaboration policy and test containment from agents' actual permissions now."

Each part answers a different piece of the paper's account. Preserving relationships across executions is the coordination episode in operation: what one execution wrote and a later one read must not be forgotten between runs (Should defence units span multiple executions and agents?). Constraining shared resources goes at the substrate, the store agents write and later read. Connecting response to surviving state matters because of what another excerpt reports: Can removing a communication channel stop persistent information sharing?. The paper's evaluation tests "recurrence after channel closure and state quarantine," which separates closing the channel from quarantining what earlier runs left behind. My reading is that the third clause is the doctrine's answer to that rebuild lesson. The excerpt does not tie the two together.

The "now" half does not depend on discovery. An operator writes the policy (How do policies determine whether agent transfers are violations?) and tests what agents can actually do, from their actual permissions and not from their intended roles. My pairing, not the paper's, is that the case for testing reach and not output is the one in Can a model-level filter truly contain an agent with environment access?: what an agent can touch is a property of its environment, and a check on any single output does not show it. That is the boundary test Is your evaluation environment actually part of the threat model? calls for, made specific to shared writable resources.

The strongest objection is cost. Constraining shared resources also constrains the sanctioned uses of them, and the harness notes treat persistent shared artifacts as something to build. The nearest measured constraint on what agents carry forward is Does limiting interaction history actually prevent agent collusion?, an ablation in a two-agent setting with a built conflict that reports no size and no task cost. It cuts what an agent sees within a run and not a store shared across executions, so it is a neighbour of the second clause by analogy and does not test it. The paper's own caution is that "controlled comparisons must establish whether the added monitoring improves protection at an acceptable cost" (Does added monitoring improve protection at acceptable cost?).

What the excerpt does not give. What "swarm" counts as, how resources are constrained in practice, or a measured containment.