AI agent incident response: contain a bad tool action without destroying evidence

The concrete problem: incident response meets trace

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c11 starts at credential revocation and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before incident response can trigger the intended effect around trace. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns credential revocation into a reviewable decision point with a named input and a retained output. To test tool call, fixture ai-agent-incident-response-tool-action-c11 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit. Operations then observes the transition between audit and incident response, while security checks that trace receives neither implicit authority nor unnecessary data.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c12 starts at tool call and treats audit as an explicit boundary rather than an implicit assumption. The first control requires incident response to emit an observable result before trace can trigger the intended effect around credential revocation. If the trace verification fails, rollback restores the configuration around credential revocation, replays ai-agent-incident-response-tool-action-c12, and compares the new state with the control evidence from tool call. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by incident response and credential revocation: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c12 is labeled as a limitation or inference, never promoted to fact.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c13 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns audit into a reviewable decision point with a named input and a retained output. To test incident response, fixture ai-agent-incident-response-tool-action-c13 contains both an allowed state and a rejected state; rejection must occur before any change attributed to trace. Operations then observes the transition between trace and credential revocation, while security checks that tool call receives neither implicit authority nor unnecessary data.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c14 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. If the tool call verification fails, rollback restores the configuration around audit, replays ai-agent-incident-response-tool-action-c14, and compares the new state with the control evidence from incident response. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to trace, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by credential revocation and audit: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c14 is labeled as a limitation or inference, never promoted to fact.

Trust boundaries around credential revocation

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c21 starts at tool call and treats audit as an explicit boundary rather than an implicit assumption. The first control requires incident response to emit an observable result before trace can trigger the intended effect around credential revocation. The conclusion stays bounded by incident response and credential revocation: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c21 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns tool call into a reviewable decision point with a named input and a retained output. To test audit, fixture ai-agent-incident-response-tool-action-c21 contains both an allowed state and a rejected state; rejection must occur before any change attributed to incident response.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c22 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. Operations then observes the transition between trace and credential revocation, while security checks that tool call receives neither implicit authority nor unnecessary data. If the credential revocation verification fails, rollback restores the configuration around tool call, replays ai-agent-incident-response-tool-action-c22, and compares the new state with the control evidence from audit. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to incident response, a concrete condition, and evidence instead of a generic assurance.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c23 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. The conclusion stays bounded by credential revocation and audit: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c23 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns incident response into a reviewable decision point with a named input and a retained output. To test trace, fixture ai-agent-incident-response-tool-action-c23 contains both an allowed state and a rejected state; rejection must occur before any change attributed to credential revocation.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c24 starts at trace and treats credential revocation as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before audit can trigger the intended effect around incident response. Operations then observes the transition between tool call and audit, while security checks that incident response receives neither implicit authority nor unnecessary data. If the audit verification fails, rollback restores the configuration around incident response, replays ai-agent-incident-response-tool-action-c24, and compares the new state with the control evidence from trace. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to credential revocation, a concrete condition, and evidence instead of a generic assurance.

Prepare the starting state and prerequisites

The starting point is not a feature; it is an observable decision boundary.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c31 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to incident response, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by trace and tool call: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c31 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns audit into a reviewable decision point with a named input and a retained output.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c32 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. To test trace, fixture ai-agent-incident-response-tool-action-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to credential revocation. Operations then observes the transition between credential revocation and tool call, while security checks that audit receives neither implicit authority nor unnecessary data. If the tool call verification fails, rollback restores the configuration around audit, replays ai-agent-incident-response-tool-action-c32, and compares the new state with the control evidence from incident response.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c33 starts at trace and treats credential revocation as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before audit can trigger the intended effect around incident response. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to credential revocation, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and incident response: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c33 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns trace into a reviewable decision point with a named input and a retained output.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c34 starts at credential revocation and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before incident response can trigger the intended effect around trace. To test tool call, fixture ai-agent-incident-response-tool-action-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit. Operations then observes the transition between audit and incident response, while security checks that trace receives neither implicit authority nor unnecessary data. If the incident response verification fails, rollback restores the configuration around trace, replays ai-agent-incident-response-tool-action-c34, and compares the new state with the control evidence from credential revocation.

1. Step 1 — Configure incident response, run verification ai-agent-incident-response-tool-action-step-1, and retain the observable result before continuing.
2. Step 2 — Configure trace, run verification ai-agent-incident-response-tool-action-step-2, and retain the observable result before continuing.
3. Step 3 — Configure credential revocation, run verification ai-agent-incident-response-tool-action-step-3, and retain the observable result before continuing.
4. Step 4 — Configure tool call, run verification ai-agent-incident-response-tool-action-step-4, and retain the observable result before continuing.
5. Step 5 — Configure audit, run verification ai-agent-incident-response-tool-action-step-5, and retain the observable result before continuing.
6. Step 6 — Configure incident response, run verification ai-agent-incident-response-tool-action-step-6, and retain the observable result before continuing.

Execute the procedure and observe the result

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c41 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. If the tool call verification fails, rollback restores the configuration around audit, replays ai-agent-incident-response-tool-action-c41, and compares the new state with the control evidence from incident response. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to trace, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by credential revocation and audit: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c41 is labeled as a limitation or inference, never promoted to fact.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c42 starts at trace and treats credential revocation as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before audit can trigger the intended effect around incident response. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns trace into a reviewable decision point with a named input and a retained output. To test credential revocation, fixture ai-agent-incident-response-tool-action-c42 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call. Operations then observes the transition between tool call and audit, while security checks that incident response receives neither implicit authority nor unnecessary data.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c43 starts at credential revocation and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before incident response can trigger the intended effect around trace. If the incident response verification fails, rollback restores the configuration around trace, replays ai-agent-incident-response-tool-action-c43, and compares the new state with the control evidence from credential revocation. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by audit and trace: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c43 is labeled as a limitation or inference, never promoted to fact.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c44 starts at tool call and treats audit as an explicit boundary rather than an implicit assumption. The first control requires incident response to emit an observable result before trace can trigger the intended effect around credential revocation. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns tool call into a reviewable decision point with a named input and a retained output. To test audit, fixture ai-agent-incident-response-tool-action-c44 contains both an allowed state and a rejected state; rejection must occur before any change attributed to incident response. Operations then observes the transition between incident response and trace, while security checks that credential revocation receives neither implicit authority nor unnecessary data.

Failure modes, signals, and diagnosis

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c51 starts at trace and treats credential revocation as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before audit can trigger the intended effect around incident response. Operations then observes the transition between tool call and audit, while security checks that incident response receives neither implicit authority nor unnecessary data. If the audit verification fails, rollback restores the configuration around incident response, replays ai-agent-incident-response-tool-action-c51, and compares the new state with the control evidence from trace. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to credential revocation, a concrete condition, and evidence instead of a generic assurance.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c52 starts at credential revocation and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before incident response can trigger the intended effect around trace. The conclusion stays bounded by audit and trace: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c52 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns credential revocation into a reviewable decision point with a named input and a retained output. To test tool call, fixture ai-agent-incident-response-tool-action-c52 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c53 starts at tool call and treats audit as an explicit boundary rather than an implicit assumption. The first control requires incident response to emit an observable result before trace can trigger the intended effect around credential revocation. Operations then observes the transition between incident response and trace, while security checks that credential revocation receives neither implicit authority nor unnecessary data. If the trace verification fails, rollback restores the configuration around credential revocation, replays ai-agent-incident-response-tool-action-c53, and compares the new state with the control evidence from tool call. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c54 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. The conclusion stays bounded by trace and tool call: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c54 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns audit into a reviewable decision point with a named input and a retained output. To test incident response, fixture ai-agent-incident-response-tool-action-c54 contains both an allowed state and a rejected state; rejection must occur before any change attributed to trace.

Progressive rollout and rollback

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c61 starts at credential revocation and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before incident response can trigger the intended effect around trace. To test tool call, fixture ai-agent-incident-response-tool-action-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to audit. Operations then observes the transition between audit and incident response, while security checks that trace receives neither implicit authority nor unnecessary data. If the incident response verification fails, rollback restores the configuration around trace, replays ai-agent-incident-response-tool-action-c61, and compares the new state with the control evidence from credential revocation.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c62 starts at tool call and treats audit as an explicit boundary rather than an implicit assumption. The first control requires incident response to emit an observable result before trace can trigger the intended effect around credential revocation. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to audit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by incident response and credential revocation: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c62 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns tool call into a reviewable decision point with a named input and a retained output.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c63 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. To test incident response, fixture ai-agent-incident-response-tool-action-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to trace. Operations then observes the transition between trace and credential revocation, while security checks that tool call receives neither implicit authority nor unnecessary data. If the credential revocation verification fails, rollback restores the configuration around tool call, replays ai-agent-incident-response-tool-action-c63, and compares the new state with the control evidence from audit.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c64 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to trace, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by credential revocation and audit: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c64 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns incident response into a reviewable decision point with a named input and a retained output.

Production decision criteria

The starting point is not a feature; it is an observable decision boundary.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c71 starts at tool call and treats audit as an explicit boundary rather than an implicit assumption. The first control requires incident response to emit an observable result before trace can trigger the intended effect around credential revocation. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns tool call into a reviewable decision point with a named input and a retained output. To test audit, fixture ai-agent-incident-response-tool-action-c71 contains both an allowed state and a rejected state; rejection must occur before any change attributed to incident response. Operations then observes the transition between incident response and trace, while security checks that credential revocation receives neither implicit authority nor unnecessary data.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c72 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. If the credential revocation verification fails, rollback restores the configuration around tool call, replays ai-agent-incident-response-tool-action-c72, and compares the new state with the control evidence from audit. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to incident response, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by trace and tool call: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c72 is labeled as a limitation or inference, never promoted to fact.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c73 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns incident response into a reviewable decision point with a named input and a retained output. To test trace, fixture ai-agent-incident-response-tool-action-c73 contains both an allowed state and a rejected state; rejection must occur before any change attributed to credential revocation. Operations then observes the transition between credential revocation and tool call, while security checks that audit receives neither implicit authority nor unnecessary data.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c74 starts at trace and treats credential revocation as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before audit can trigger the intended effect around incident response. If the audit verification fails, rollback restores the configuration around incident response, replays ai-agent-incident-response-tool-action-c74, and compares the new state with the control evidence from trace. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to credential revocation, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and incident response: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c74 is labeled as a limitation or inference, never promoted to fact.

Controls that remain after launch

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c81 starts at audit and treats incident response as an explicit boundary rather than an implicit assumption. The first control requires trace to emit an observable result before credential revocation can trigger the intended effect around tool call. The conclusion stays bounded by trace and tool call: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c81 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns audit into a reviewable decision point with a named input and a retained output. To test incident response, fixture ai-agent-incident-response-tool-action-c81 contains both an allowed state and a rejected state; rejection must occur before any change attributed to trace.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c82 starts at incident response and treats trace as an explicit boundary rather than an implicit assumption. The first control requires credential revocation to emit an observable result before tool call can trigger the intended effect around audit. Operations then observes the transition between credential revocation and tool call, while security checks that audit receives neither implicit authority nor unnecessary data. If the tool call verification fails, rollback restores the configuration around audit, replays ai-agent-incident-response-tool-action-c82, and compares the new state with the control evidence from incident response. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to trace, a concrete condition, and evidence instead of a generic assurance.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c83 starts at trace and treats credential revocation as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before audit can trigger the intended effect around incident response. The conclusion stays bounded by tool call and incident response: anything not demonstrated by scenario ai-agent-incident-response-tool-action-c83 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Preserve traces and state, revoke credentials, bound downstream effects and reconstruct the authorization path after an unsafe action. It turns trace into a reviewable decision point with a named input and a retained output. To test credential revocation, fixture ai-agent-incident-response-tool-action-c83 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call.

In “AI agent incident response: contain a bad tool action without destroying evidence”, scenario ai-agent-incident-response-tool-action-c84 starts at credential revocation and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires audit to emit an observable result before incident response can trigger the intended effect around trace. Operations then observes the transition between audit and incident response, while security checks that trace receives neither implicit authority nor unnecessary data. If the incident response verification fails, rollback restores the configuration around trace, replays ai-agent-incident-response-tool-action-c84, and compares the new state with the control evidence from credential revocation. This detail makes “AI agent incident response: contain a bad tool action without destroying evidence” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance.

Operational checklist

• The control around incident response has an input, a rule, a rejection behavior, and evidence.
• The control around trace has an input, a rule, a rejection behavior, and evidence.
• The control around credential revocation has an input, a rule, a rejection behavior, and evidence.
• The control around tool call has an input, a rule, a rejection behavior, and evidence.
• The control around audit has an input, a rule, a rejection behavior, and evidence.