Agent incident response
Agent incident response is the coordinated work of detecting, investigating, containing, and recovering from harmful or unauthorized activity involving an agent. It includes the agent's identity and tool paths, but also the runtime, affected data, and external systems.
NIST's incident response guidance places preparation, detection, response, and recovery within cybersecurity risk management.
Explore Dome: Dome Platform · Docs: Security tutorial.
Find out what happened and whether it is still happening
Suppose an alert reports an unusual burst of document-export requests. Start with what the records show: which agent made the requests, when it made them, where they were sent, whether they were allowed, and what happened next.
A burst of export requests doesn't by itself confirm data disclosure. Check which requests completed, preserve the original records, and label anything still unconfirmed.
The first question is whether harmful activity may still be occurring. If it is, containment may need to proceed while the investigation remains incomplete. Record why you chose that action and which services it is likely to affect.
Audit trails and observability explain which records can help establish what happened.
Explore Dome: Audit · Docs: Audit events.
Contain the affected part of the system
Containment depends on what is exposed: an agent identity, a backend credential, a tool connection, or the running process.
| Confirmed or suspected exposure | Containment to consider |
|---|---|
| Compromised agent identity | Suspend its governed access and investigate credentials |
| Exposed backend secret | Replace or revoke the downstream credential |
| Dangerous tool behavior | Disable the affected connection or operation |
| Compromised running process | Isolate or stop the runtime |
| Already-accepted external write | Reconcile the business state and plan recovery |
Choose the actions that contain the incident while preserving unaffected services where possible. A broader compromise may require several teams to act together.
Dome's lifecycle controls can withdraw an agent's access through governed paths. They do not terminate an unrelated process or undo a request already accepted by another service. Involve credential and runtime owners when containment requires changes to their systems.
Before assuming that suspending a parent identity also blocks its child identities, check which changes carry through to them and how long that takes.
Explore Dome: Agent Registry · Docs: Agent lifecycle.
Verify the fix before restoring access
Agent recovery means restoring service after addressing the cause of the incident. Record the fix, such as replacing an exposed credential or narrowing a permission. Before restoring access, test both the failure that prompted containment and the legitimate work the agent should still perform.
Check any operation whose outcome is unclear. A timeout can leave the application without a result even when a backend accepted the operation. If you retry without checking, you may make the same change twice.
Record the affected interval, retained evidence, containment actions, remaining uncertainty, and the owner approving recovery. Follow-up work should address the cause or detection gap rather than merely re-enable the same configuration.
Keep a short response checklist: name the person responsible for each affected identity, connection, runtime, credential, and business system, and the action they need to take. Record what must be checked before service resumes. For planned retirement, see agent lifecycle management.
Explore Dome: Authorization · Docs: Security tutorial.