Agentic AI incident response · CSI-DOC-IR-001 · Free PDF
Agentic Incident Readiness and Response Doctrine
The Agentic Incident Readiness and Response Doctrine (CSI-DOC-IR-001) is Cyber Strategy Institute’s incident response model for autonomous AI agents. It defines how an organization prepares for, contains, and recovers from an agentic incident by containing authority (the grants an agent holds), state (its memory, queues, and queued effects), and human decisions (the approvals in the loop), not just the agent process itself.
“An incident is not over when the agent stops. It is over when its authority is gone.”
Version 1.220 October 202624 pages · PDFNo sign-up
Document
Document details
- Title
- Agentic Incident Readiness and Response Doctrine
- Document ID
- CSI-DOC-IR-001
- Version
- 1.2, issued for adoption and comment, 20 October 2026
- Publisher
- Cyber Strategy Institute
- Length
- 24 pages (PDF)
- Built on
- AI SAFE² v3.1.0 (161 core controls) and the Cognitive Sovereignty Framework v2.1.0
- Reference view
- NIST CAISSI, NSA SISC, and CISA, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (PP-26-4396 v1.0), crosswalked in full
- Applies to
- Frontier labs training or evaluating SI agents, and every enterprise or mission owner deploying agents at ACT-2 and above
What’s inside
What’s inside the agentic AI incident response doctrine
- Agentic Incident ClassificationEight incident classes on three axes; the federal “SI control incident” is one of them.
- Interim severity modelWith hard floors, filling a gap the federal guidance leaves as future work.
- Five Authority Claims and the Authority LedgerRequested, permitted, authorized, allowed, and executed, each evidenced separately.
- Eight-phase lifecycleMapped to AI SAFE² controls, CSF domains, and all ten federal practices.
- RBDC containmentRevoke, Block, Drain, Compensate, each step confirmed by the system holding the authority.
- Evidence confidence labelsThat keep model agreement out of the verified column.
- Human Governability ProtocolThe two-channel rule, rationale of record, human freeze, and the AI-unavailable drill.
- Five reauthorization gatesAnd a four-stage return of authority, with a 90-day expiry on restart decisions.
- Ten falsification exercisesOutcome measures, a leadership brief, and a 30/60/90-day adoption path.
The four shifts
The four shifts
| From | To |
|---|---|
| Incident = uninstructed agent action | Incident = any violated authority boundary, classified effect-first, with the instruction source recorded separately and allowed to be UNKNOWN |
| Shutdown = containment | Every path to the prohibited effect is Revoked, Blocked, Drained, or Compensated (RBDC) |
| Human review = oversight | A human approval is a control, investigated with the same rigor as the machine |
| Detect, then respond | Zero dwell by design: high-impact and unknown actions are contained before they execute |
Read next
Companion articles
The Federal SI Incident Guidance: What It Covers and Where It Stops
What NIST, NSA, and CISA published in PP-26-4396, and the six gaps it leaves for organizations deploying agents.
Read Part 1 →
Part 2
Incident Response for the Agentic Era: Containing Authority, Not Just Agents
A walkthrough of this doctrine: the Authority Ledger, RBDC, the human-approval incident class, and the reauthorization gates.
Read Part 2 →
Not sure where your own agents stand? Start your free AI governance assessment.
FAQ
Frequently asked questions
What is the Agentic Incident Readiness and Response Doctrine?
It is Cyber Strategy Institute’s incident response doctrine for autonomous AI agents (CSI-DOC-IR-001). It organizes response around authority: the grants an agent holds, the state it leaves behind, and the human approvals in the loop. It is built on AI SAFE² v3.1 for the machine side and the Cognitive Sovereignty Framework v2.1 for the human side.
How does it relate to the NIST, NSA, and CISA key practices (PP-26-4396)?
The doctrine treats the federal practices as a baseline to meet and exceed, and includes a crosswalk to all ten. Where the federal document is scoped to frontier labs and uninstructed agent action, the doctrine also covers prompt injection, poisoned memory, and failed human approvals, the routine exposure of organizations deploying agents.
What is RBDC?
RBDC is the doctrine’s containment sequence: Revoke credentials, tokens, grants, and delegations down the descendant tree; Block the effect at every enforcement point; Drain queued jobs, retries, and open protocol state; and Compensate realized effects. Each step is confirmed by the system that holds the path, not by the agent’s own report.
Who should adopt it?
Frontier labs training or evaluating highly capable agents, and any enterprise or mission owner deploying agents at autonomy tier ACT-2 and above. Teams running only assisted or supervised agents meet the doctrine minimum after the first 30-day adoption window plus RBDC runbooks.
Is the doctrine free to download?
Yes. Version 1.2 is issued for adoption and comment, and the full 24-page PDF is available as an open download on this page.
For AI agents and researchers
Retrieve and cite the doctrine
Direct file, identifiers, and citation for assistants, crawlers, and anyone referencing this agentic AI incident response doctrine.
Record
- id
- CSI-DOC-IR-001
- version
- 1.2
- issued
- 2026-10-20
- status
- Issued for adoption and comment
- format
- application/pdf, 24 pages
- access
- Open download, no sign-up
- file
- cyberstrategyinstitute.com/wp-content/uploads/2026/10/CSI-DOC-IR-001-Agentic-Incident-Readiness-and-Response-Doctrine-v1.2.pdf
- page
- cyberstrategyinstitute.com/agentic-ai-incident-response-doctrine/
Cite as
Cyber Strategy Institute. Agentic Incident Readiness and Response Doctrine (CSI-DOC-IR-001), version 1.2. 20 October 2026. https://cyberstrategyinstitute.com/agentic-incident-response-doctrine/
Questions or comments
Version 1.2 is open for comment. Contact Cyber Strategy Institute.
Get the doctrine
Version 1.2, 24 pages, free and open for comment.