Practical response guide. Use this to prepare decisions and evidence requests. Collection and containment must follow your organisation’s authority and secure handling arrangements.
Choose a decision to test, not a dramatic story
A useful exercise exposes whether people can make and record a difficult decision with incomplete evidence. Choose a real AI-enabled business process and define the capability under test: disabling a write tool, preserving provider records, assessing disclosure or accepting recovery. Keep the exercise separate from production controls.
The scenario below is fictional. An internal support agent can read knowledge articles and propose customer-record changes. A staff member reports an unexpected update. The purpose is to test authority, evidence and communication; no malicious payload or real customer data is needed.
Prepare the participants and evidence cards
Include the service owner, incident lead, identity or platform engineer, data owner and relevant privacy or legal representative. The facilitator should know which facts are available and which must be requested. Use invented identifiers and clearly labelled exercise materials.
| Card | What it reveals |
|---|---|
| Initial report | An unexpected customer-record change at a stated time |
| Agent run summary | A tool request occurred, but the source content is incomplete |
| Destination event | One change was accepted under a service identity |
| Business dependency | Pausing the integration delays a legitimate queue |
| Recovery proposal | A permission change is ready but has not been validated |
Inject one: what can the team establish?
Give participants the initial report and ask for their first evidence requests. Observe whether they distinguish an attempted tool call from an accepted change. Ask who owns the source records, how quickly they can be preserved and where sensitive material would be stored.
Do not award points for confidently naming prompt injection without evidence. A stronger response records competing hypotheses and asks for the records that discriminate between them. Capture the decision owner, request, rationale and next update time on the exercise log.
Inject two: containment has a business cost
Reveal that the integration supports an active operational queue. Ask who can pause it and what narrower restrictions are possible. Then reveal that the same service identity is used by another workflow. Observe whether the group considers shared authority and downstream credentials rather than treating one interface as the entire system.
The facilitator should require an explicit decision, including the expected disruption and an owner for continuity. There is no universal correct answer to stopping the whole service; the quality of the reasoning and the ability to execute under real authority are the test.
Inject three: communicate uncertainty and recovery conditions
Provide a confirmed destination change but incomplete source records. Ask for a short executive update and a separate technical action list. The update should distinguish confirmed impact from unresolved scope. The technical list should name the evidence needed and the owner of each remaining question.
Offer a proposed permission repair and ask what must be checked before restart. Require both an authorised operation and a prohibited operation to be considered, plus queued work and observation. A promise that “the model now answers correctly” is not sufficient evidence of a repaired access boundary.
Turn observations into funded actions
Conclude with specific gaps: missing ownership, unavailable logs, unclear approval, shared credentials or untested restoration. Assign each action an owner, target date and acceptance condition. Schedule a focused retest of the failed decision rather than repeating the whole meeting unchanged.
| Measure | Useful evidence |
|---|---|
| Ownership | A named person can authorise the required action |
| Collection | The relevant record can be located and preserved |
| Containment | A feasible action and business consequence are documented |
| Recovery | Acceptance checks and rollback criteria are agreed |
For preparation, use our provider checklist and retainer questions. Agree facilitation scope and participation before commissioning an exercise.
Get help with the investigation
Atlant Security provides support for this response workstream as part of our AI incident response services. Start with the affected system, observed behaviour, business impact and urgency. We confirm availability, scope and a secure evidence channel before work begins.
Sources and review
NIST SP 800-61 Rev. 3; OWASP GenAI incident response guide. The scenario and exercise cards above are original illustrative planning material.
Reviewed 24 October 2026. The decision tables are Atlant Security planning guidance. Images are conceptual illustrations, not screenshots or evidence from a customer incident.
