AI Incident Response Framework: AI IR Overlay
Security and incident response specification for autonomous agents
1Autonomous Agent Security Challenge
AI IR Overlay addresses a unique security problem where an authorized agent performs unintended actions. Traditional security measures fall short when an account isn't compromised but the agent is misdirected. The framework aligns with standards like NIST SP 800-61 Rev. 3 and OWASP Top 10 for Agentic Applications. Its primary focus is mapping and controlling the resources an agent can access, creating a new paradigm for AI security incident response.
2AI Bill of Materials
A core component is the AI Bill of Materials - a YAML file per production agent recording service identity, scopes, tools, write targets, and memory settings. It documents what the deployed agent can actually reach, not just what design documents specify. For instance, an agent connected to email, CRM, and ERP systems has three separate blast radii. This mapping becomes critical during incident investigation, especially when traditional intrusion indicators are absent.
3Gradual Containment Ladder
The framework replaces a single kill switch with a graduated containment ladder from M0 to M5. The M1 level is particularly significant, removing all write tools while keeping read and query tools operational. This approach aims to maintain business process continuity while ensuring security. Unlike traditional methods that destroy session state through credential rotation, this preserves forensic evidence needed to reconstruct incidents.
4Evidence Collection Standards
The specification defines minimum evidence sets across six classes: prompts/responses, tool-call records, retrieval traces, memory state, configuration state, and identity/downstream audit logs. This scope is intentionally broader than traditional endpoint telemetry, crucial for detecting autonomous agent incidents that don't trigger conventional security alerts. The framework acknowledges that unusual process trees or authentication events may be absent in AI-related incidents.
5Validation Mechanisms
The 279-line validate.py script performs JSON Schema validation and date-staleness checks against AI-BOM and privilege-matrix files. In strict mode, stale containment-test dates fail the build - a feature exceeding most control frameworks. However, validation only confirms controls are declared, not that they function. This distinction is fundamental to the framework's philosophy: clearly separating documented controls from their operational effectiveness.
6Activation Model Gaps
The current version (v0.35.0) has notable gaps for fully autonomous 24/7 operations. The documented activation path assumes a staffed SOC and human incident commander reachable within ten minutes. For unattended agents managed by small teams, automatic triggering mechanisms remain undefined. This gap exists precisely where the need is greatest, highlighting an area for future development in the specification.
7Reference Implementations
The framework includes two runnable reference implementations: kill_switch_demo and evidence_exporter. The demo implements M0-M4 containment against a synthetic tool registry (M5 is explicitly out of scope), while the exporter provides adapter stubs for all six evidence classes. A 19KB kill-switch API contract references M1 containment a dozen times, demonstrating the interface for moving agents between containment states.
8Industry Context and Significance
AI IR Overlay represents an important evolution from 2016's FIDO and 2017's FIR in automated incident response systems. As autonomous AI agents proliferate, they demand security solutions beyond traditional approaches. While still early-stage, the framework's NIST-aligned structure and practical tools position it to address critical industry gaps. Its explicit recognition of AI-specific incident patterns makes it particularly relevant for organizations deploying agentic AI systems at scale.