Incident Response Plan Generator

Generate a production-ready incident response plan tailored to your AI agent deployment.

When to Use

• Deploying AI agents to production for the first time
• Preparing for SOC2 or ISO 27001 audits
• Client asks "what happens when something breaks?"
• Building operational runbooks for managed AI services
• After an incident — to prevent recurrence

Input

Service: [Name of AI agent/service]
Environment: [cloud provider, region, architecture]
Data Sensitivity: [low/medium/high/critical]
Team Size: [number of responders]
SLA: [uptime target, e.g., 99.9%]
Integrations: [list of connected systems]

Plan Structure

1. Severity Classification

2. Detection & Alerting

• Health check endpoints (every 60s)
• Error rate thresholds (>1% = SEV3, >5% = SEV2, >25% = SEV1)
• Response time monitoring (p99 > 2x baseline = alert)
• Cost anomaly detection (>150% daily average)
• Output quality sampling (random audit of agent responses)
• Uptime monitoring (UptimeRobot, Pingdom, or custom)

3. Triage Checklist

□ Confirm the alert is real (not false positive)
□ Classify severity (SEV1-4)
□ Identify affected scope (which agents, which clients)
□ Check recent changes (deploys, config changes, upstream)
□ Assign incident commander
□ Open incident channel/thread
□ Notify affected stakeholders per SLA

4. Containment Actions by Type

Agent Misbehavior:

• Pause agent processing (kill switch)
• Revert to last known good config
• Enable human-in-the-loop mode
• Queue messages for manual review

Infrastructure Failure:

• Failover to backup region/instance
• Scale horizontally if capacity issue
• Check upstream dependencies (API providers, databases)
• Enable circuit breakers

Security Incident:

• Rotate all credentials immediately
• Isolate affected systems
• Preserve logs and evidence
• Engage security team / legal if data breach

Data Quality Issue:

• Halt automated outputs
• Identify contamination window
• Notify affected clients with timeline
• Prepare correction batch

5. Communication Templates

Client notification (SEV1/2):

Subject: [Service Name] — Incident Update

We've identified an issue affecting [description].
- Impact: [what's affected]
- Status: [investigating/identified/monitoring/resolved]
- ETA: [estimated resolution time]
- Workaround: [if available]

We'll provide updates every [30 min / 1 hour].