An automated responder can quarantine workloads. What safeguards should be included?

1. No logs to make the response invisible.
2. Narrow authorization, tested conditions, bounded actions, evidence, and an approved recovery path.
3. A rule to interpret every missing metric as a confirmed compromise.
4. Unlimited tenancy-wide deletion for every ambiguous alert.