Incident Response and Regulatory Cooperation

Incident command

1. detect and preserve evidence;
2. contain credentials, agents, tools, networks and transactions;
3. assess affected data, persons, systems, jurisdictions and obligations;
4. engage legal, privacy, security, insurance and sector owners;
5. notify authorities, counterparties and affected persons where required;
6. recover, validate and monitor;
7. document root cause, remediation and lessons;
8. supersede affected claims, models, sources and approvals.

Agentic events

Treat unexpected tool use, credential discovery, policy evasion, secret reconstruction, sandbox escape, unauthorized communication, hidden action sequences and goal displacement as reportable internal security events pending classification.