Why it counts
An agent incident runs at machine speed. A wrong decision repeats hundreds of times before a person finishes reading the alert. Advisory mode is the containment move that fits that speed. The agent keeps recommending while a human approves each action. The business keeps running.
Where teams get it wrong
The first instinct is a full shutdown. That stops the damage and the business at the same time, and most companies can't afford it. The second instinct is debugging. Contain first and understand later.
One example
In the book Agentic AI + Zero Trust, a healthcare leader we call Cam watched her diagnostic agent mark 847 patients wrongly in three hours. Her biggest regret was waiting to speak until she understood the problem. Teams that can shift an agent to advisory mode in under five minutes keep that hour short.