Short answer: an AI agent incident runbook needs severity levels with response targets, a tested kill switch with named owners, and one short runbook per failure type, each following the same steps: detect, contain, assess, fix, recover and learn. Keep it next to your on-call docs and rehearse it before you need it.
What to include
- Severity levels. For example: SEV1 for data exposure, an unauthorized external action or a safety issue; SEV2 for wrong outputs reaching users at scale or runaway cost; SEV3 for degraded quality or isolated errors. Give each a response target.
- Kill switch. Where it is, what it disables (the agent, a tool permission, a credential) and who may use it.
- Owners and channels. Who is on call, where the incident is discussed, and when legal, privacy or security must be brought in.
- Evidence to pull. Run logs, prompts, retrieved content, tool calls and outputs for the affected window.
Runbooks agents need
| Incident | First containment step |
|---|---|
| Prompt injection: the agent followed malicious instructions | Disable the agent or the affected tool permission; revoke tokens it used. |
| Sensitive data in outputs or logs | Stop the agent; restrict access to the logs and outputs involved; involve privacy or legal. |
| Runaway cost or loop | Stop the run; cap spend and step counts. |
| Quality regression after a model, prompt or tool change | Roll back to the last known-good version. |
| Unauthorized external action (sent, posted, paid, deleted) | Revoke the permission; reverse the action where possible; notify affected parties per your policy. |
After the incident
Run a blameless postmortem within a fixed window, add the case to your regression tests, and require human approval for the action type involved until the fix is proven.
The Incident Runbooks template ($29) has severity levels, a kill-switch section, six runbooks and a postmortem template, ready to adapt.
FAQ
What is a kill switch for an AI agent?
A documented, tested way to stop an agent or revoke its tool permissions immediately, with named people allowed to use it.
Which incidents are specific to AI agents?
Prompt injection, sensitive data in outputs or logs, runaway cost or loops, quality regressions after a model or prompt change, and unauthorized external actions such as sending, posting, paying or deleting.
How soon should a postmortem happen?
Set a fixed window in your runbook, for example within five business days, and add each incident as a regression test.