A housing authority limits automated deep forensic pulls to machines that are already isolated. What gating practice does that enforce?

A housing authority that limits automated deep forensic pulls to machines that are already isolated is gating heavy forensic automation behind containment so deep pulls run only on already isolated municipal hosts. Deep collection—full disk, broad artifact packs, intrusive agents—can alert adversaries, load fragile systems, or scoop tenant-adjacent data from still-live production endpoints. Requiring isolation first reduces lateral risk, stabilizes the investigative target, and aligns forensics with a containment decision already made for that host. Why the other options fail by concept: Gating containment automation behind forensics so isolation runs only after deep pulls finish on flagged municipal hosts inverts the required order, keeping the host connected during heavy collection which is noisy and risks lateral movement on housing systems that serve residents. Gating heavy forensic automation behind triage so deep pulls run only after quick snapshots finish on municipal hosts mistakes triage completion for containment, allowing a noisy deep pull on a still-connected host that has not been isolated. Gating heavy forensic automation behind manual review so deep pulls run only after analyst approval on municipal hosts describes a human-approval gate rather than a containment gate, missing the isolation-confirmed state that enforces when deep pulls may run. Exam caveat: some triage telemetry may be needed pre-isolation to decide containment; distinguish lightweight triage from deep forensic packages and gate only the heavy path. Operational check: in the housing-authority SOAR flow, make deep forensic actions depend on an isolation-confirmed state, and alert if a deep pull is requested on a still-connected production host.