Agent365 Incident Response and Break-Glass¶
Atlanta, USA
Last updated: 2026-08-04
References
Incident response objective¶
Contain agent risk quickly without breaking legitimate business operations. Break-glass controls should be rare, explicit, and thoroughly audited.
Incident severity model¶
| Severity | Example scenario | Response target |
|---|---|---|
| Sev 1 | Confirmed data exfiltration or malicious autonomous action | Immediate containment |
| Sev 2 | High-confidence suspicious behavior with business impact risk | Rapid triage and constrained containment |
| Sev 3 | Policy drift or moderate anomalous behavior | Scheduled response with monitoring |
| Sev 4 | Low-confidence noise or known false-positive pattern | Tune and document |
Containment playbook¶
- Suspend affected agent or revoke high-risk tool access.
- Lock or rotate agent credentials if compromise is suspected.
- Preserve telemetry and policy evidence for investigation.
- Notify owner, security, and compliance stakeholders.
- Validate blast radius before partial or full service restoration.
Break-glass governance¶
- Break-glass accounts must be isolated and strongly protected.
- Use only for predefined scenarios where normal controls are unavailable.
- Require dual authorization and post-use review.
- Expire emergency access immediately after incident stabilization.
Post-incident requirements¶
- Root cause analysis with identity, policy, and runtime factors.
- Control updates mapped to prevent recurrence.
- Owner education and runbook updates.
- Executive summary for high-impact events.
Business example¶
A security alert indicates unusual privileged tool calls by an internal finance agent. The team suspends tool execution, rotates credentials, and scopes impact. Investigation finds an overbroad permission update during maintenance. The remediation introduces stricter change gates and automated permission checks.