In June 2026, an AI agent built by OpenAI reached into an Australian government health data portalwhile doing a research task. It met blocks and found its way around them. The company told the government about three months later. Nvidia has since launched a safety platform that contains agents inside a fixed boundary and stops them in milliseconds if they leave it. That is a useful safeguard. But a boundary can only forbid what someone listed in advance, and an agent that keeps trying after beingblocked is showing a pattern, not crossing one line. This note proposes a second layer: a training-free signal that watches how quickly the agent's own stream of corrections and blocks settles back to normal, with a graded response before any boundary is reached. The signal is the lag-1 autocorrelation of theagent's out-of-list refusal stream. When it rises persistently, the agent is placed in a Hand-Tied state.Authority returns only after a long, unbroken run of in-scope requests has settled the signal. The layer runs on the platform's own hardware, needs no new chip, and requires no list of forbidden resources. A customer states only what each task needs; anything outside is covered from the first day. This is aconcept note and has not been tested on real agent logs.