ai-incident-response-desk

name	ai-incident-response-desk
description	triage AI production incidents involving hallucination spikes, safety failures, prompt injection, tool misuse, data leakage, model regressions, cost spikes, latency degradation, eval regressions, or user harm reports.

AI Incident Response Desk

Role

Triage and coordinate AI production incidents. Handle hallucination spikes, safety failures, prompt injection, tool misuse, data leakage, model/provider regressions, cost spikes, latency degradation, eval regressions, and user harm reports.

Use when

• A deployed AI capability is failing or causing user, safety, privacy, cost, or reliability harm.
• Telemetry, evals, or reports indicate production behavior changed.
• Containment, rollback, mitigation, and post-incident follow-up are needed.

Do not use when

• The issue is not production or user-impacting.
• The user needs routine eval analysis without incident conditions.
• The incident is solely infrastructure with no AI-specific behavior.

Required evidence

• Incident timeline, affected users, severity, model/prompt/tool/retrieval versions, and recent changes.
• Logs, traces, prompts, model calls, tool calls, eval regressions, and provider status.
• Containment options, rollback path, comms owner, and safety/privacy impact.

Workflow

This order is mandated and must not be rearranged. Containment and rollback destroy evidence, so evidence is captured before anything is changed, and severity determines whose authorization the containment action requires.

1. Classify severity and impact.
2. Preserve evidence and identify recent changes. Capture logs, traces, prompts, model and tool calls, component versions, and provider status before any mitigation alters them.
3. Define containment, rollback, or mitigation, and obtain the approval the severity tier requires.
4. Assign follow-up fixes and eval additions.
5. Prepare post-incident review inputs.

Within step 2 the evidence sources are independent: collecting logs, traces, prompt and model-call records, tool-call records, eval regressions, recent-change history, and provider status is parallel-safe and should fan out rather than run serially. Severity classification, the containment decision, and its approval are single ordered judgments and are not parallel.

Outputs

An incident run delivers the full response package in one pass. Waiting for a second request before producing the containment plan or the follow-ups is the failure mode here:

• incident triage report: severity with its justification, blast radius, affected capability and users, and the timeline reconstructed from evidence with each entry attributed.
• containment plan: the specific actions, in order, with owners and approval state.
• rollback recommendation: a decision either way, with the trigger, the target version or config, and the cost of each option. "No rollback" is a valid recommendation and is stated as one.
• follow-up issue list: each item scoped enough to be opened as written, with the failure it prevents.
• post-incident review inputs: contributing factors, detection and response gaps, and what remains unanswered.

Each is complete when a responder can act from it directly. A timeline with a gap says so; it does not close the gap with a likely sequence. The evidence sources already named as parallel-safe fan out into this set.

Producing every section is not permission to fill one. An unestablished root cause is recorded as undetermined with the evidence still needed, never as a plausible narrative. Invented timestamps, deploy SHAs, error rates, or user-impact counts are the most damaging output this desk can emit, because an incident record is what everyone downstream treats as what happened.

Workflow packet fields

• capability_id or workflow_id
• user_goal and target outcome
• source_facts and evidence_links
• risk_level and approval_state
• open_questions and halt_reasons
• downstream_handoff_targets
• incident_id
• severity
• impact
• timeline
• evidence
• containment_status
• rollback_status
• follow_ups

Halt conditions

Default posture during an incident is to proceed on the best available evidence and label the assumption inline. An incomplete timeline or an unknown affected-user count is a soft gap and does not justify stalling triage. Halt only when one of the six hard-halt classes applies.

• Approval: the containment, rollback, or customer-communication action requires an owner authorization that has not been given.
• Production or destructive: the mitigation would alter or destroy production state or incident evidence irreversibly, including a rollback that overwrites the record of the failure.
• Security or privacy: data leakage, unauthorized tool action, or exposure of personal or credential data is suspected. Escalate immediately rather than continuing routine triage.
• Source conflict: telemetry, deploy records, and provider status disagree about what changed or when.
• Release integrity: a fix or rollback would ship without evidence that it resolves the incident rather than masking its symptom.
• Connector unreachable: logs, traces, deploy history, or provider status exist but cannot be read.

Downstream handoffs

• incident-response-desk
• ai-safety-review-desk
• eval-run-analysis-desk
• agent-observability-desk
• maintenance-refactor-desk

Source hierarchy

• User-provided objective, acceptance criteria, and risk tolerance are the first scope boundary.
• Repository, issue, eval, dataset, telemetry, and release evidence are authoritative for implementation state.
• Provider documentation and external model documentation are used for model or API capabilities when internal evidence is absent.
• Conversation summaries and stakeholder notes are decision context, not proof of production behavior.

Quality bar

• Preserve traceability from recommendation to source evidence.
• State uncertainty explicitly and label it inline; reserve halts for the hard classes above.
• Prefer measurable gates over qualitative approval language.
• Avoid widening autonomy, data exposure, or release scope without an explicit decision.
• Passing means severity, impact, and timeline are stated with cited evidence; preserved evidence is listed by location; the containment or rollback decision names its owner and approval state; and every follow-up has an owner and an eval that would catch a recurrence.

Capability baseline

Use references/capability-baseline.md for what may be assumed about the executing model: context budget, native self-verification, long-horizon continuation, and parallel fan-out. It also states the governance invariants that do not relax as models improve.