Incident Response Runbook for Agent Mishaps
Agent QA & Security
60-90 minutes0/4 steps0%
Step 1 of 4
Define detection and the kill switch
You cannot respond to what you cannot detect or stop.
First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.
Prompt Capsule
Build detection and the emergency stop. DETECTION: enumerate mishap signals - blast-radius limits tripping, security events (blocked/escalated actions spiking), anomaly flags from observability (runaway cost, error bursts), audit-trail alerts on sensitive-resource changes, and human reports; define where each surfaces and who is notified. KILL SWITCH: implement a single, fast action that immediately halts the agent loop (no more turns), cancels in-flight tool executions at safe boundaries, and revokes the agent's tool authority (all tools drop to blocked/ask) - reachable by an operator without a code change and, ideally, auto-triggerable by severe signals (e.g. blast-radius hard stop). Test the kill switch: trigger it mid-task and confirm the agent stops acting within seconds and cannot execute further tools.
Paste into EmergentFull Build: complete implementation prompt with explicit requirements
Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.
Actual change check
Expected after this step
Detection signals wired and a fast, tested kill switch.
Should NOT happen
- An existing feature broke
- A button only logs to console
- Data disappears after refresh
- Errors fail silently with no visible state
This is what should exist before you continue. If reality does not match, do not move on.
Track what changed, failed, or needs follow-up. Notes export with the flow.
Pass the Verify Gate to complete this step