Contain first, then use the record to find every action the problem touched. Handling an AI agent incident means pausing the affected capability, scoping the impact from the decision record, putting affected customers right, assessing whether the incident must be reported, fixing the cause, and re-certifying before depth is restored. A named incident lead runs it.
What counts as an agent incident, and who owns the response?
An agent incident is any event where an agent's action caused or could have caused harm: a wrong payment, a misleading message to customers, personal data disclosed, a bound that failed to stop an action, or manipulated input that changed what the agent did. Some look nothing like system incidents. Every component worked; the agent simply did the wrong thing at scale.
The agent operations lead, or whoever is on duty, is incident lead. The process owner decides on customer remediation and restart. Security leads where manipulation or data exposure is involved. Compliance and the data protection officer assess reporting. The discipline is introduced in what is AI incident response?
What are the steps, and who decides at each?
- Person, anyone: reports the incident, or an alert raises it. The incident lead opens a record.
- Person, incident lead: grades severity by harm, scale and whether the problem is ongoing.
- Person, incident lead: contains. Pause the affected capability, suspend the agent, or revoke access, depending on severity. Containment needs no approval.
- Agent, depth 1: scopes the impact. A separate, read-only agent queries the decision record for all actions by the affected capability, in the affected period, using the affected source, and lists them.
- Person, process owner: decides remediation: which customers are contacted, what is corrected, refunded or reversed.
- Person, compliance and DPO: assess reporting obligations, such as data protection breach rules or, for EU financial entities, ICT incident reporting under DORA; see DORA incident reporting when an AI agent fails.
- Person, incident lead, with the process owner: finds the cause: which bound should have stopped the action, and what changed in the brief, sources, limits, model or inputs.
- Person, process owner: approves the fix through change control.
- Agent, depth 1: is re-tested on the cases that failed and a fresh set of past cases.
- Person, process owner, with risk: decides restart and the depth to restart at.
- Person, incident lead: runs the post-incident review and closes the record.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Report | Nothing | none | Opening the record |
| Grade | Nothing | none | Severity |
| Contain | Nothing | none | Pausing or suspending |
| Scope | Lists affected actions from the record | 1 | Checking completeness |
| Remediate | Nothing | none | Customer remediation |
| Reporting | Nothing | none | Regulatory assessment |
| Cause | Nothing | none | Root cause |
| Fix | Nothing | none | Approving the change |
| Re-test | Answers failed and fresh cases | 1 | Judging results |
| Restart | Nothing | none | Restart and depth |
| Review | Nothing | none | Lessons and actions |
Which decisions does a named person keep?
Severity, containment, remediation, reporting, the fix and the restart. The agent under investigation plays no part in any of them. The scoping agent only retrieves, under its own read-only identity. Investigation methods are covered in how do you investigate an AI agent incident?
What record does the method produce?
One incident record per incident: the report, severity and its reasons, containment actions and times, the list of affected actions with record identifiers, remediation decisions per customer, the reporting assessment and any reports made, the root cause, the change reference for the fix, re-test results, the restart decision and the review findings. The AI agent incident report template gives the structure.
Which controls make the response work?
A decision record you can query. Without it, scoping means guessing. With it, you can list every action the faulty capability took in the period.
Containment without permission. The incident lead pauses first and explains afterwards.
Restart through evidence. The agent returns only after re-testing, often at a lower depth than before.
Separate investigating tools. The agent that caused the incident does not help investigate it.
Related agents checked. Other agents using the same source, brief section or model version may carry the same fault. The scoping step should list them, and the incident lead decides whether to pause them too.
What should you measure?
Time from detection to containment, time to scope impact, customers affected and remediated, repeat incidents with the same cause, and actions from reviews closed on time. Track incidents by bound: if most involve one bound, such as sources, that is where controls are weakest.
Where does it usually go wrong?
Treating it as an outage. Teams check whether the system is up, see that it is, and close the incident. The question is what the agent did, not whether it ran.
Scoping by memory. Without a queryable record, teams estimate impact from complaints. Customers who did not complain are missed.
Rushed restart. Pressure from the backlog brings the agent back before the cause is known.
Blame without learning. The review names a person and stops. A good post-incident review asks why the bounds let it happen.
Where Pryme fits
In Pryme, every verdict is filed in an append-only record with the capability, sources, provenance and bound that decided, so scoping an incident is a query. A certification run that clears no depth drops the agent to depth 1 the same day, and depth returns only with fresh evidence. The deployment cycle is in deploying an AI agent: train, shadow, certify, widen.
Questions people ask
Should customers be told an AI agent made the mistake?
Tell them what went wrong, what you are doing about it and how to reach a person. Whether to say an agent was involved depends on the case, but do not hide it if they ask.
Is a refused action an incident?
Usually not, because the bound worked and nothing happened. Repeated attempts, attempts at withheld actions or signs of manipulation can still warrant an incident record.
Who decides whether to report to a regulator?
Compliance and the data protection officer assess it against the rules that apply, and the accountable executive decides. Record the assessment even when the answer is not to report.