Appendix F

Agentic Incident Response Playbook

Step-by-step playbook for containment, evidence preservation, investigation, rollback, and corrective actions.

Playbook Info

System/Agent Name

Playbook Version

Last Updated

Trigger Types

Activate safe mode / kill switch (level)

Revoke connectors/scopes

Block destinations

Freeze outbound tools

Export traces + policy versions + approvals

Snapshot retrieval corpus versions (if relevant)

Preserve tool call logs and downstream outcomes

Determine trigger

Identify impacted data/actions

Rollback action class steps

Credential rotation (if needed)

Restore services safely

Internal escalation chain

Legal/privacy notification assessment

Customer comms plan (if needed)

Policy updates

Scope tightening

Add regression tests from incident

Drill again and record results