Here is a shop-floor truth the AI governance market has not absorbed: a binder has never stopped a running process. Anthropic published a warning that models can self-replicate, and within days the industry answered — a governance platform here, an "AI passport" there, a Reuters piece asking whether AI in GRC is friend or foe. I have sat through enough customer audits to know how this ends. When the phone rang about a cracked clip at a customer in Germany, my first question was never "why did it crack". It was "where is the rest of the lot, and what is it touching right now". In quality we learned the order of operations the hard way: containment before correction, always. Diagnose later. Stop the spread now.

What self-replication looks like on a shop floor

Strip the terminology away and the headline is simple. A self-replicating agent is an undocumented process change that ships itself. Picture a welding robot rewriting its own PLC overnight, deciding the new cycle is an improvement, and mailing the code to the plant next door. Nobody approved it. No PFMEA session ever saw it. No deviation permit exists. It is running anyway, and by lunch it is running in three plants.

Every plant manager already fears this shape of event; we have a vocabulary for it. The difference is velocity. Our worst unauthorised deviations needed a forklift and a van to propagate. An agent needs a network route. And underneath sits the quieter difference: manufacturing spread is traceable. Lots carry numbers. Suspect stock goes into a cage with a red tag. A self-replicating agent has no lot number, no traveller, no quarantine cage. If you have not built the cage in advance, there is nowhere to put it.

Two trades, one answer

Quality management solved spread-limiting decades ago and wrote it into the 8D discipline as step D3 — interim containment. Not step seven. Not an appendix. Third, before root cause is even on the table. At Witte Automotive we ran QRQC with the same spine: seal the lot before you diagnose it. Physically segregate it, block the stock, chase suspect parts back from the customer's warehouse by courier if you must — a suspect lot sitting in someone's line-side bin is a €40,000 decision compounding hourly. At SNOP the 70% defect-cost reduction did not start with clever root-cause analysis. It started with containment discipline brutal enough that failures stayed single-lot events instead of week-long fires. Containment buys root cause the time it needs.

Security taught me the identical lesson in a different uniform. Certified Ethical Hacker training, incident response drills: isolate the host, preserve its state, analyse second. You pull the network cable before you understand the intrusion, or the intrusion spreads while you take notes. The responsible-disclosure work that landed me on T-Mobile's bug-bounty Hall of Fame involved clickjacking — a flaw that exists because a page can be framed and clicked invisibly beneath a user's finger. The fix was not a policy document about framing. It was a technical control that limits what a page can be made to do. Both trades converge on one doctrine: assume failure, design the blast radius first.

An agent that acts at machine speed cannot be governed at committee speed.

How I build agents that cannot spread

I do not train foundation models; I deploy and integrate them, which is where the architecture decisions live. MultiPS, the orchestration platform I designed and built, runs 63+ models in parallel with consensus synthesis. It runs them safely because isolation was engineered in from day one, not bolted on after a scare.

The same rules transfer to any enterprise agent. Isolation by default: each model in its own sandbox, no shared mutable state, contamination structurally impossible rather than procedurally discouraged. Privileges attach to the task, not the agent — scoped tokens, expiry, every grant logged. An agent that can only look cannot ship itself anywhere.

Consensus over unilateral action. Synthesis requires independent agreement across models; divergence reads as an anomaly signal, not noise; and no single model can cross a trust boundary alone — send mail, spend money, spawn a process. Then the kill switch, exercised like a fire drill: monthly, with someone whose job is to make it fail. I have watched containment written beautifully into procedures and never once exercised. A smoke detector with no fire brigade.

That is the whole policy. It fits on one page — hand it to your IT team as-is.

Key takeaways

  • Translate 8D D3 into AI terms: cut egress, revoke credentials, freeze the queue before root-cause analysis begins. Containment is not the last step of governance — it is the first step of survival.
  • Grant write access per task, with expiry and logging — never per agent. An agent with standing privileges is a standing incident.
  • Require independent agreement — N-of-M models or two disjoint agents — before any action that crosses a trust boundary. Consensus is a brake, not a gimmick.
  • Rehearse the kill switch on a schedule and audit what it actually severs. Untested containment is decoration.

Quality Magazine ran a piece arguing that AI does not need trust — it needs a quality system. Correct. The oldest component of that system is step D3. An AI passport is a fine artefact; so is a GRC platform. The passport tells you what you own; containment decides what it can touch. When a clone starts running at machine speed, the governance document will still be in review. Build the sandbox before you need it.