Post-Incident Review Template for AI Agents

Every AI agent safety incident provides information that, if captured correctly, prevents future incidents. A post-incident review (PIR) is the mechanism for extracting that information. This template ensures consistency and completeness across reviews.

Incident Summary

• Incident ID: [unique identifier]
• Date detected: [timestamp]
• Date resolved: [timestamp]
• Duration: [time from detection to resolution]
• Severity: [Critical / High / Medium / Low]
• Agent: [agent identifier and version]
• Policy version: [policy hash or version at time of incident]

Timeline

Construct a minute-by-minute timeline from audit trail receipts and monitoring logs.

| Time | Event | Source | |------|-------|--------| | | First anomalous action detected | Sentinel alert | | | Incident confirmed by on-call engineer | Manual verification | | | Agent placed in shadow mode | Kill switch activated | | | Root cause identified | Audit trail analysis | | | Fix deployed | Policy update | | | Agent restored to full operation | Manual approval |

Root Cause Analysis

Answer these questions:

• What was the immediate cause? (e.g., missing policy rule, prompt injection, misconfiguration)
• What was the underlying cause? (e.g., incomplete policy review, untested edge case, missing content scanning rule)
• What was the contributing cause? (e.g., no shadow mode period, insufficient red teaming, monitoring gap)

Impact Assessment

• What actions did the agent take that it should not have?
• What data was exposed or modified?
• How many users or systems were affected?
• What is the estimated cost (financial, reputational, regulatory)?

What Went Well

• Which controls worked as designed?
• How effective was the detection? How long between the incident and detection?
• What aspects of the response were smooth?

What Needs Improvement

• Which controls failed or were absent?
• What would have prevented this incident?
• What would have reduced the time to detection or resolution?

Action Items

| Action | Owner | Due Date | Status | |--------|-------|----------|--------| | | | | |

Every action item must have an owner and a due date. Track completion in your project management system. Review open action items from previous PIRs at the start of each new review to ensure follow-through.