INCIDENT RESPONSE FOR AGENTS

DETECTING AND TRIAGING AGENT INCIDENTS Detection means noticing that something is wrong. Sources include automatic alerts from the monitoring you learned about in Chapter 59, user complaints, internal reports, and regular reviews. The best detection is automatic and fast. Observability tools from Part Seven, which record traces of agent runs, let responders see what the agent did. Triage means quickly sorting incidents by seriousness so the most urgent get attention first. The word comes from emergency medicine, where doctors must decide who needs help first. Severity levels often look like this. Low severity: limited effect, no harm to users, can wait for normal working hours. Medium severity: noticeable harm or degraded service for some users, needs prompt attention. High severity: widespread impact, money at risk, safety or privacy concerns, needs an immediate all-hands response. Questions that guide triage include how many users are affected, what the potential harm is, whether it is getting worse, whether sensitive data or money is involved, and whether a workaround exists. Name an incident commander for serious events, which is a single person who coordinates the response so that everyone does not work at cross purposes. Keep a running timeline of what was seen and what was done, because memory fades quickly during a stressful event.