Everyone building agent evals is obsessed with the scoring question: did the output pass or fail? That's the easy half. Once your gate goes red, a much harder question shows up, and almost nobody has an answer for it:
Now what?
A failed eval is a decision, not a log line. And most teams treat a red gate the way they treat a failed CI check on main — they let the artifact ship anyway, retry blindly, or worse, page a human at 3am to eyeball a diff. That's not a safety system. That's a smoke detector wired to a Post-it note.
This post is about the part after the gate: containment. What a run should actually do when the evidence says stop.
First, know what kind of evidence tripped the gate
