INCIDENT RESPONSE FOR AGENTS

CHAPTER SUMMARY Incident response moves through detect, triage, contain, resolve, learn, and prevent. Triage ranks severity so urgent problems come first. Containment stops the harm before the cause is fully known, using tools such as kill switches, budget limits, tool disabling, and rollback. Blameless postmortems examine the system, not the person, and produce owned action items. Feedback loops, especially turning incidents into regression tests, stop failures from returning. KEY TERMS REVIEW Incident: an unplanned event causing or risking harm. Triage: sorting by seriousness. Severity: how serious an incident is. Incident commander: person coordinating a response. Containment: stopping damage from spreading. Kill switch: control that instantly stops an agent. Blameless postmortem: learning review focused on the system. Root cause: the underlying reason for a failure. Regression test: a test ensuring an old bug does not return. Feedback loop: feeding lessons back into the system.