关门捉贼
When you have a small, weak enemy cornered, seal every exit before you close in. Cut off escape and reinforcement first, then finish the matter completely — a foe let slip becomes tomorrow's trouble.
The principle
A small, weakened enemy that escapes doesn't stay small — it regroups, learns from the defeat, and returns harder to catch. So before you strike, close the doors: block the escape routes, cut the lines by which help or supply could arrive, and only then move in to finish it decisively. The stratagem is specifically for a weak, isolated foe. The classic caution is its mirror image: a large or desperate enemy should NOT be sealed in, because total encirclement turns them suicidal — there you leave a gap. Reading which case you face is the whole judgement.
Historical origin
Applied today
When you move to win a contested account or close out a weakened competitor, cover the exits first: lock the key channels, tie up the switching options, remove the easy escape — a half-won displacement just lets them recover.
When you finally tackle a recurring problem, close its escape routes at the same time. Fix the bug and its whole class; end the dispute and the loophole that let it restart — or it simply comes back.
In practice
Invented scenarios showing this stratagem at work — illustrations, not reports of real events.
Revoke first, read after
An agent with database and mail access began sending correction notices to customers after misreading a schema change. The instinct was to pull the logs and understand it. The on-call engineer revoked its credentials first and read afterwards. In a similar episode a quarter earlier, forty careful minutes of diagnosis had run alongside another two hundred notices going out.
Use it Revoke an agent's credentials before you investigate it — your understanding can wait and the agent will not.
Count it after you close it
Margin had drifted for a year and an analyst was asked to establish why. She asked first for the ad-hoc discount permission to be revoked, then began. An earlier review had run the other way round: the analysis took two months, and by the time it reported, the practice it described had spread to two more regions.
Use it Close the leak before you measure it — anything still running will outrun the report that describes it.
Close it before you clean it
The instinct was to start removing malicious files immediately. The responder instead pulled the machine off the network first, then began. An earlier incident at the same company had gone the other way: cleanup started while the connection was live, the intruder noticed, and access was re-established through a second path before anyone had finished.
Use it Cut off the escape route before you begin eradication, or you teach the intruder to move.
The door was already shut
The workstation was encrypted within minutes of the click, which surprised nobody. What surprised the operator was that everything reachable from it amounted to one department's project folder. Two years of unglamorous segmentation work meant the intrusion finished roughly where it had started, and the recovery was a morning's work rather than a quarter's.
Use it Build containment before you need it — segmentation decides whether an incident costs you a morning or a quarter.
Freeze first, argue later
The instinct was to work through the statement first and establish which charges were genuine. A neighbour who had been through it recommended the opposite order: block the card, then reconcile at leisure. Her own case had gone the other way round, and three further charges had appeared during the two careful evenings she spent building her list.
Use it Close the exposure before you investigate it — reconciliation keeps perfectly well, an open payment channel does not.