The protocol must survive panic
Incident plans often fail their first usability test: nobody can remember them when the system behaves strangely. Autonomous agents add speed, delegation, and opaque intermediate reasoning to that familiar problem. A responder may not know which tool acted, whether a subagent is still running, or which side effect is reversible. The control language must be simple enough to recall and precise enough to coordinate engineers, operators, policy owners, and executives.
The proposed protocol uses four verbs: pause, inspect, decide, resume. They are intentionally ordinary. Each verb names a distinct operational state and produces evidence for the next one. The protocol does not claim that four words solve agent safety, nor is it a formal standard. It is a compact spine for an AI agent incident response plan, designed to prevent the most dangerous reflex: letting the agent continue while the team argues about what it is doing.
Pause: stop the future from getting larger
Pause means the system accepts no new consequential work and tries to contain actions already in motion. Revoke temporary credentials. Hold outbound messages. Stop new tool calls. Signal subagents. Freeze queues where doing so will not create a worse hazard. Record when the request was issued, when each component acknowledged it, and which external effects could not be stopped. The state should be reported as a matrix, not a green badge.
This is where permission design becomes incident design. OWASP’s excessive-agency guidance recommends minimizing functionality, permissions, and autonomy while enforcing authorization downstream. Those controls make a pause credible because the agent cannot simply route around the orchestration layer. If the same unrestricted credential remains valid in every tool, a front-end pause is cosmetic. The first verb therefore tests architecture: can the organization actually bound the system it deployed?
Inspect: separate the trace from the story
Inspect means reconstructing what happened from independent records. Capture the goal, plan versions, messages, tool calls, credentials used, files changed, transactions initiated, policy decisions, costs, external responses, and current state. Preserve timestamps and correlation identifiers. Ask the agent for an explanation, but label that explanation as one artifact in the investigation. A plausible narrative is not a substitute for an event trail.
The inspection view should answer three questions quickly: What is known? What is inferred? What is still moving? It should also identify missing telemetry instead of smoothing it away. NIST’s Generative AI Profile is built around identifying risks and selecting risk-management actions, not promising perfect certainty. In an incident, the same discipline applies. The purpose of inspection is not to manufacture confidence. It is to give the decision owner the clearest bounded uncertainty available.
Resume: start from the world that exists now
Resume is not unpause. It is a controlled redeployment. Revalidate credentials, prices, customer instructions, file versions, policy status, and the availability of downstream services. Invalidate stale plans. Prevent idempotency failures and duplicated side effects. Start with the narrowest permission and scope required to complete the authorized step. Log the new execution as a child of the incident decision so investigators can distinguish pre-pause behavior from post-decision recovery.
The system should be able to resume partially. One subagent may stay contained while another performs a recovery action. One customer case may return to automation while a related batch remains quarantined. Anthropic’s work on trustworthy agents discusses tiered permissions and human control; its autonomy research emphasizes monitoring actual deployments as sessions lengthen. A mature resume state operationalizes both ideas: authority is graduated, and the recovery itself remains observable.
Every resumed action should carry an incident context token that downstream systems can record. That lets a payment service, message queue, or file store distinguish normal execution from supervised recovery and apply stricter limits. It also makes later review possible without stitching together unrelated logs by hand. The token is not a security guarantee by itself; it is a thread that preserves accountability as the recovery crosses system boundaries.
Rehearse the verbs before the verbs matter
Run tabletop exercises with scenarios that expose seams: an agent emails the wrong audience, creates duplicate payments, modifies production data, or delegates to a tool that does not acknowledge pause. Do not grade the team on whether the fictional agent behaved. Grade the organization on acknowledgement time, containment completeness, evidence quality, decision ownership, and recovery integrity. Every missing identifier, unclear role, or irreversible side effect becomes backlog for the control system.
Then publish the protocol inside the product. Operators should see the current verb, owner, and next allowed transition. Executives should see aggregate failure and recovery patterns. Customers affected by an incident should receive an accountable explanation, not anthropomorphic excuses. The four verbs are valuable because they create a shared grammar. When an agent incident moves faster than the meeting about it, shared grammar is not branding. It is response time.
