Contain it, preserve the record, then work back along the chain. Lower the agent's depth or suspend the capability involved, freeze the relevant records, and rebuild each step from request to outcome. The question is which link failed: a bound set wrong, a source that lied, the model misreading, a person approving without looking, or a system outside the agent.
How is an agent incident different from a system incident?
A system incident usually has a technical cause: a server failed, a release broke something. An agent incident often has no technical fault at all. Every component may have worked as designed, and the agent still did something harmful because a limit was too generous, a document was forged, or an approver clicked through.
That changes the investigation. You are not only looking for what broke. You are looking for which decision allowed the outcome, and who or what made it. Our guide on how to handle an AI agent incident covers the response; this article focuses on the investigation.
What are the steps, and who acts?
- Incident lead: contains. Suspend the capability involved or drop the agent to read-only. Do not delete or change anything else yet. Evidence: the containment action and time.
- Incident lead: preserves. Freeze the agent's record for the period, the versions of its brief, limits and sources, and the target systems' logs. Evidence: the preserved set, with a hash or equivalent.
- Investigator: defines the outcome. What harm occurred, to whom, and when it was noticed. Evidence: the outcome statement.
- Investigator: rebuilds the chain. For each action involved, from the record: the request, the facts and their provenance, the bounds checked, the verdict, the approver. Evidence: a timeline.
- Investigator: finds the failed link. Use the table below. Evidence: the cause analysis.
- Process owner: decides remediation. Fix the link, not only the symptom. Evidence: the change records.
- Compliance: decides on reporting. Whether the incident triggers notification to a regulator, customers or a data protection authority. Evidence: the reporting decision and its reasoning.
- Incident lead: closes. With a written report; an AI agent incident report template gives the structure. Evidence: the report, signed.
Which link failed?
| Link | What it looks like | Typical fix |
|---|---|---|
| Bound set wrong | Every action was allowed, and the rule allowed something it shouldn't | Change the limit or scope through change control |
| Source | The agent relied on a fact that was false or stale | Change provenance rules; restrict what weak sources can support |
| Model | The agent misread something clear | Retest; lower depth until it passes |
| Approver | A held action was approved without proper review | Review approval design, queue sizes, training |
| Outside the agent | Another system or a person acted | Route that action through governance |
| Missing record | The chain cannot be rebuilt | Treat as its own serious finding |
Most incidents involve more than one. A forged invoice (source) passes because the limit allowed external documents to support payment (bound) and the approver saw only a summary (approver).
Are there reporting duties?
Possibly. For EU financial entities, DORA includes ICT incident reporting. NIS2 sets incident reporting for essential and important entities in the EU. If personal data was affected, data protection breach rules may apply under GDPR or UK GDPR. Whether any of these is triggered depends on the facts and your sector. Our explainer on what AI incident response is covers how these fit together.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A worked example
Take an online lender whose agent approved a top-up loan for a customer who had told the lender, weeks earlier, that she had lost her job. The complaint arrives through the ombudsman route.
The investigator suspends top-up drafting and preserves the record. The chain shows the agent drafted the top-up, the affordability check passed on income data from the application two years earlier, and an underwriter approved it in under a minute. The customer's message about losing her job sat in the complaints system, which the agent's sources did not include.
Three links failed: the source set was incomplete, the bound allowed income data of any age, and the approval was too fast to be real. The lender adds the complaints system as a source, requires income data under six months old, and reviews underwriter queues.
Which controls make investigation possible?
- An append-only record that cannot be changed after the event.
- Versions of every bound and source, so you can see what applied then.
- Fast containment by named people.
- Clear ownership of the reporting decision.
The topic guide, agent governance is a bound, not a model, explains why the record of verdicts is what an investigation depends on.
Questions people ask
Can the agent investigate itself?
It can assemble the timeline from the record. It should not judge its own cause analysis, and it should not have write access to the record it is assembling.
Should the agent stay suspended until the investigation ends?
The capability involved should, until the failed link is fixed and the agent retested. Unrelated capabilities can resume if the investigation shows they were not involved.
Who should lead the investigation?
Someone independent of the team that built and runs the agent, usually from risk or operations, with the process owner as a key witness.