The containment ladder is the part I'd steal first — especially C2, draft-only with a human approving every send, since that's the rung that stops a bad answer from becoming a second incident. Your point about treating the agent as a witness, not an investigator, pairs well with it: build the timeline from logs, then let the postmortem change a control instead of just tweaking a prompt.