The first-15-minutes discipline. Asked in order by the incident commander.

Part of the AI IR Overlay™ framework. See CONTENT_MAP.md for the full repository map.

The Six Triage Questions

Use these on your initial bridge call. If you can answer all six in 15 minutes, you are already ahead of most teams.

When an AI agent incident is suspected, the first-hour decisions determine whether you contain harm or destroy evidence. These six questions are designed to be asked in order by the incident commander.

1. What tools can the agent call?

List enabled tools and integrations. Separate read from write.

If the answer takes more than 60 seconds to produce, you have an inventory problem, not an incident problem.

2. What systems can it write to?

Enumerate every system where action can be observed by a customer, partner, regulator, auditor, or board:

3. What identity does it run as?

The identity determines what audit logs to pull and which downstream systems will attribute the action.

4. Does it have memory? What is the scope?

Memory scope determines blast radius across tenants and users.

5. What is the least disruptive safe mode?

Before you reach for the off switch, walk the Kill-Switch Modes:

The wrong choice here costs revenue. The wrong choice on the other side destroys evidence.

6. What is your evidence plan before you rotate keys?

Capture prompt/response logs, tool-call logs, and configuration state before rotating credentials, redeploying, or cleaning corpora.

See the Minimum Evidence Set.

Where each answer routes

Each question’s answer points the Incident Commander to the playbook that handles the corresponding response surface. Walk the questions in order; navigate to the indicated playbook(s) when the answer surfaces an issue.

Question If the answer reveals… Go to
Q1 (tools) Risky tool tiering or overly-permissive write tools Playbook 04: Tool Design Is Containment
Q2 (write targets) Output-leakage or unauthorized writes to external systems Playbook 09: Leakage Without a Breach
Q3 (identity) Credential compromise or shared/delegated token misuse Playbook 07: Secrets and Tokens; also Playbook 12: Insider Threat 3.0 if user-attributable
Q4 (memory) Cross-tenant or cross-user memory bleed; regulated data in memory Primary: Playbook 23: AI Logging and Privacy. Secondary: Playbook 12: Insider Threat 3.0 if user-attributable memory misuse; Playbook 03: RAG / Knowledge-Base Forensics if the retrieval-memory boundary is the issue
Q5 (safe mode) Need to select the right Kill-Switch Mode and variant Kill-Switch Modes (use the Variant Selector quick reference at the top of the Mode Variants section)
Q6 (evidence) Need to capture Type A through F evidence before rotation Primary: Playbook 02: Evidence Lives in New Places; Minimum Evidence Set; Playbook 15: Records, Retention, and Proving What Happened. Secondary: Playbook 23: AI Logging and Privacy (privacy-discipline twin of PB15; together they form the capture / retain / prove triad)

After Q5: if the selected Mode is M3 or higher, OR any condition trigger applies (customer data, external recipients, regulated data, financial actions, customer-facing trust impact, public attention), convene the Materiality and Disclosure call within 1 hour. The call is CISO + General Counsel + Incident Commander; the incident response continues in parallel.

Printable Card

A single-page printable version of these six questions, designed to live on a SOC wall: triage/six-questions-card.md.

Source: AI IR Overlay newsletter and framework synthesis, by Jacob Ideji. https://www.linkedin.com/in/jacobideji/