INCIDENT RESPONSE FOR AGENTS

LEARNING GOALS By the end of this chapter you will be able to define an incident and describe how agent incidents are detected and sorted by severity. You will be able to explain how to contain harmful or runaway behavior quickly. You will know how blameless postmortems and feedback loops stop the same failure from happening twice. WHAT AN INCIDENT IS An incident is an unplanned event that harms, or could harm, the service, its users, or the business. For agents, incidents include a sudden spike in errors, an agent sending wrong or harmful messages, a runaway loop burning money, leaking private data, or taking an unauthorized action. Incident response is the organized way of handling such events. Think of a fire department. It does not hope fires will not happen. It has trained people, clear roles, practiced steps, and later it studies each fire to improve prevention. A strong incident response process has the same pieces: detect, triage, contain, resolve, learn, and prevent.