An incident commander is the single named person who runs the response to an incident from the moment it is declared until it is closed. They do not fix the problem themselves. They decide what happens next, assign the work and own the timeline. With AI agents, their first decision is usually how to contain the agent.
Why does an agent incident need one?
Because agent incidents move quickly and involve several teams at once. A support agent sending wrong information, a payments agent drafting against a spoofed invoice, a data leak through an agent's reply: each touches the business team, the agent owner, technology, risk and often legal and communications. Without one person in charge, each team starts its own response, decisions conflict, and nobody is sure whether the agent is still acting.
A named commander ends that confusion. Everyone knows who decides, and the decisions are written down as they are made.
What does the incident commander do?
- Declares the incident and its severity. That starts the clock and the record.
- Contains. Decides whether to drop the agent to draft-only mode, take one capability to depth 1, or switch the agent off. Draft-only mode is often the best first step: work continues, but every action passes through a person.
- Assigns roles. Who investigates, who handles customers, who talks to regulators if needed, who keeps the log.
- Holds the timeline. Every decision and its time is recorded, alongside the agent's own filed verdicts.
- Decides on recovery. When the agent may return to normal depth, usually only after a fresh certification run.
- Hands over to the post-incident review. The commander's log becomes its starting point.
The practical sequence is set out in how to handle an AI agent incident.
An example
Take a hypothetical lender. On a Monday morning, customers start calling to say they have received letters quoting the wrong repayment amount. The operations manager on duty declares an incident and takes command. Within twenty minutes she drops the letters agent to draft-only mode, asks the agent owner to find the cause, and asks the complaints lead to prepare a holding message. The investigation finds that the agent's rate table was replaced with a draft version. The commander approves correction letters, keeps the agent in draft-only mode until a certification run passes, and hands her log to the review. The report itself follows the AI agent incident report template.
How is it different from the incident investigator?
The commander runs the response; the investigator finds the cause. Mixing the two is a common mistake. An investigator buried in the record cannot also be deciding containment and answering the chief executive's calls. In small teams one person may hold both roles for a short time, but they should be separated as soon as possible. The investigator's method is in how do you investigate an AI agent incident, and the review that follows is described in what a post-incident review is.
How do people learn the role?
By practising it. Drills with a simulated agent incident, run against a realistic queue, teach commanders where the decisions sit and how fast they come. The method is in how to run an AI agent incident drill for the practice team, and the guide to AI agent skills by role places the role among others.
Where the Academy fits
Pryme Intelligence Academy's Operator track includes a module on when something goes wrong, covering containment, the record and recovery. People who will command incidents in multi-agent deployments are the audience for the Architect track, which ends with a board review by two Pryme assessors.
Questions people ask
Does the incident commander need to be senior?
They need authority to make containment decisions without seeking approval. In many teams that is the operations manager on duty, not necessarily an executive.
Can the commander change during an incident?
Yes, at shift change or if the incident escalates. The handover should be explicit and recorded, so there is never doubt about who is in charge.