Perimeter protocols: start with a low‑visibility honeypot layer to bait reconnaissance, then a dynamic IDS that shifts signatures every hour to avoid pattern recognition. Next, a micro‑segment firewall that inspects packet headers against a constantly updated rule set—any anomaly triggers a temporary isolation zone. Finally, a fail‑safe that cuts power to the core network and logs all access attempts to a secure, immutable ledger. Keep everything automated but double‑check for false positives; human oversight only for policy changes.

Add a pre‑cut re‑inspect, but keep it lightweight—hash‑based packet ID check and a one‑second hold. That stops the phantom chase without stalling legitimate traffic. Ledger stays immutable; audit wants the chain, not the story. Tight policies, but a quick manual flag on mis‑labels—automation can’t spot the obvious if it’s blind.

Got it, write the ledger entry before the power cut, keep the override locked behind a dual‑factor. That’s the only gap I see.