Responding to agent compromise with retained evidence

Keep one incident identity across the response

An incident can affect a session, a key, a role and a pending external action at the same time. Separate logs without a shared incident reference make it difficult to determine whether all affected boundaries were addressed.

The compromise and forensics reference connects credibility, quarantine, recovery, revocation and preservation under one identity. Its lifecycle distinguishes healthy, suspicious, restricted and isolated states before recovery or expulsion.

Restriction should reach the affected execution paths

The documented revocation model coordinates sessions, keys, roles, mandates and effects. For a deployment exercise, identify every path on which the suspected principal could still act.

In an illustrative connector incident, pausing a visible agent session may leave a background worker holding a stale operation. Inspect that worker's effect boundary as well. An interface showing “isolated” is not sufficient evidence that all consequential paths honored the restriction.

Recovery is a new authority state

The compromise reference requires new epoch and credential generation with attenuated authority. Old credentials cannot serve as the recovery mechanism merely because the original process can start again.

The membership lifecycle provides related context for changes in peer eligibility. Keep the incident recovery decision linked to the new state so later evidence can distinguish work performed before restriction from work admitted afterward.

Preserve evidence without spreading sensitive content

The forensic model includes content-addressed evidence, hash-linked custody records, signed manifests and retention controls. These mechanisms identify and preserve records; the application still needs a deliberate policy for access and payload handling.

Use the audit guidance to avoid copying secrets or private mission content into broad coordination logs. Retain the evidence necessary to explain the incident while keeping its original access boundary visible.

Run a bounded response exercise

1. Create a synthetic incident against a development principal.
2. Follow restriction across the relevant sessions and effects.
3. Attempt continuation using stale credentials or mandates.
4. Inspect the preserved evidence and custody relationships.
5. Recover only through the configured new-state transition.

The threat model identifies compromised adapters and stale authority among the concerns to evaluate. An exercise demonstrates the tested response path; it does not certify every possible compromise scenario.