Incident response

The levers for a misbehaving agent already exist in its governance profile. Lower its trust tier and the same controls resolve harder: retrievals are masked, sensitive actions require approval or are denied. Pin its business function to shut a lane it drifted into.

Mode can be pinned per operation, so you can enforce the agent's actions while its retrievals stay observed, or hold everything behind approval while you investigate. Nothing redeploys and nothing ships; the agent's next call is already evaluated under the new state.

Pull an agent's control bundle and every call it proposes is denied until a bundle is back in place: withdrawing authorization is itself a stop. An evaluation failure resolves the same way.

The per-class no-coverage default belongs to the same posture: during an incident, the question of what happens to an action nobody wrote a rule for already has an answer you chose in advance.

Every decision the agent triggered during the incident is already a signed, timestamped receipt: the retrievals and their per-document outcomes, the actions attempted, the denials, the approvals and who granted them. Reconstruction means reading them in order, with no scattered logs to correlate after the fact.

Because the records verify independently, the timeline holds up in the post-mortem and in front of anyone who distrusts the operator.

The path the incident took becomes the next control. The gaps the event exposed arrive with covering controls drafted from the actual traffic, and you can test each draft against the agent's recent activity before enabling it.

Then tighten the no-coverage default for the operation class involved. The end state is that a replay of the incident dead-ends at a deny, and you can run that replay to prove it.