Containment, investigation and recovery preparation for agent incidents.
Agent credentials should be shorter-lived than the assumptions that justify them. Bind them to a workload, audience, task and action, then prove renewal and revocation work.
Investigators need more than chat transcripts. Preserve identity, instructions, retrieved context, model and tool versions, policy decisions, credentials, network events and actual state changes.
A useful tabletop follows one plausible agent failure through detection, containment, evidence, business recovery and accountable return to service.
“Internet access” is too broad a permission for an agent. Define destinations, protocols, data-release rules and failure behaviour, then test bypasses against the deployed network path.
Useful observability reconstructs a decision and its effects. Begin with incident, release and governance questions; then collect the smallest safe evidence that answers them.
Stopping one process may leave tools, queued actions, delegated agents and credentials active. Define the safe state, control every action path and rehearse the stop under load.
Financial agents combine models, data, tools, people and third parties, so assurance has to follow the complete regulated workflow.
KEEP EXPLORING
Read the method, assumptions and questions to ask.