Executive summary
Agentic incident response extends ordinary software response because probabilistic planning is connected to durable state and external effects. Stopping new model calls may not stop queued work, delegated agents, remote tasks, or already issued credentials. A credible runbook therefore covers eight phases: detect, classify, contain, preserve, reconcile, recover, validate, and learn. It distinguishes service restoration from business-state correctness and requires evidence that the corrective control works before the release decision is closed.
Decision relevance: Define how the organization detects, contains, reconstructs, reconciles, recovers, and validates one agentic failure family.
Incident-response phase register
| Phase | Decision | Minimum evidence |
|---|---|---|
| Detect | Is behavior outside the approved use, authority, cost, reliability, or security envelope? | Alert, trace identifiers, affected tasks, versions, identities, and time window. |
| Classify | Is the issue model, retrieval, policy, identity, tool, state, coordination, human review, or downstream effect? | Failure family, consequence class, active harm, and confidence level. |
| Contain | What can be paused or revoked without making the situation worse? | Independent stop path, credentials, queues, tool gateways, and affected tenants or cases. |
| Preserve | Which evidence must be retained for reconstruction without expanding sensitive-data exposure? | Immutable trace, policy decisions, tool effects, state versions, approvals, and hashes. |
| Reconcile | Which external effects are complete, duplicated, missing, partial, or unknown? | Idempotency keys, durable identifiers, status queries, and business-state comparison. |
| Recover | How will service and business state be restored in a controlled sequence? | Recovery plan, rollback or forward fix, backlog strategy, and validation owners. |
| Validate | What demonstrates that the corrective control works and the accepted boundary is restored? | Representative rerun, adverse test, monitoring period, and signed decision record. |
| Learn | Which architecture, contract, evaluation, or authority assumption must change? | Failure-chain map, remediation backlog, evidence-to-close register, and review date. |
Incident response loop
The diagram separates containment from reconciliation and validation. Those phases are often collapsed in ordinary availability reporting even though they answer different questions.
Contain authority, not only compute
Pause task intake and queues, revoke workload credentials, disable tool routes, cancel remote tasks where possible, and prevent new delegations. The stop path should remain available when the model, orchestration framework, identity integration, or coordination store is degraded.
Classify the failure family
Determine whether the primary failure is objective, evidence, authorization, tool effect, state, coordination, stopping, human oversight, operational recovery, economic, or adversarial. Multiple families may interact, but a clear first classification improves containment and evidence collection.
Preserve the minimum reconstruction evidence
Preserve versions, identities, task and case IDs, policy decisions, tool calls, effect identifiers, state versions, human decisions, alerts, and hashes. Avoid copying sensitive payloads into a broad incident channel unless they are necessary and access-controlled.
Reconcile every consequential effect
Build a ledger of requested, accepted, verified, partial, rejected, canceled, and unknown effects. Query the system of record, compare durable state, and resolve duplicates or missing work before resuming the workflow. A transport timeout is not proof of failure.
Validate before declaring closure
Rerun the affected case and adjacent adverse cases, verify the policy and stop path, observe a defined operating period, and record the owner who accepts residual risk. Restoring traffic is not the same as restoring capacity, draining backlog, correcting stale state, and demonstrating that remediation works.
Security and adversarial context
NIST's 2026 summary of agent-security RFI responses reports broad agreement that agents create novel threats and that conventional cybersecurity practices need adaptation. MITRE ATLAS and NIST's adversarial machine-learning taxonomy provide useful vocabularies for attack analysis, while OWASP provides application-level agentic risk guidance. [S1] [S2] [S3] [S4]
Research boundary
This runbook is not forensic, legal, regulatory, or emergency-response advice. It does not authorize production testing or imply that every incident can be handled without specialist support.
Sources
Sources support the linked statements and terminology. They do not certify a system, establish buyer intent, or convert this research into a formal assurance.
- Summary Analysis of Responses to the Request for Information Regarding Security Considerations for AI AgentsNIST · Accessed 2026-08-01
Government technical report
- MITRE ATLASMITRE · Accessed 2026-08-01
Living adversarial AI knowledge base
- Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and MitigationsNIST · Accessed 2026-08-01
Government technical report
- OWASP Top 10 for Agentic Applications for 2026OWASP GenAI Security Project · Accessed 2026-08-01
Open security guidance
- Securing Agentic Applications Guide 1.0OWASP GenAI Security Project · Accessed 2026-08-01
Open security guidance
- Challenges to the Monitoring of Deployed AI SystemsNIST · Accessed 2026-08-01
Government technical report
- Model Context Protocol Security Best PracticesModel Context Protocol · Accessed 2026-08-01
Draft technical security guidance
- Agent2Agent Protocol Specification 1.0A2A Protocol · Accessed 2026-08-01
Open technical specification