## Trigger

Start this runbook when an agent acts outside its purpose, a denied-action spike appears, a credential leaks or a user reports harm.

## Step 1: confirm and classify

- Identify the agent, its owner and the person it acted for (GOV-01, GOV-02, GOV-13).
- Classify severity using the risk tier of the actions involved.

## Step 2: contain

- Use the kill switch for the agent, or for all agents if scope is unclear (GOV-11).
- Revoke the agent's credentials and confirm cached tokens fail (GOV-05).

## Step 3: capture evidence

- Export audit logs for the agent and the person it acted for (GOV-13).
- Preserve approvals, denials and policy versions in force at the time.
- Record the time of each step.

## Step 4: notify

- Tell the agent owner and the security lead.
- Involve legal and privacy if personal data was touched.

## Step 5: recover

- Fix the cause: policy, permission, tool or prompt.
- Test the fix with policy replay before restoring access (GOV-09).
- Restore access through a change ticket (GOV-20).

## Step 6: review

- Write a short review within five working days.
- Add findings to the next board one-pager (GOV-24).