13 , incidents

Incident Response

Faramesh provides a structured incident workflow: declare an incident, isolate the agent, collect evidence, and resolve. All incident actions are recorded in the DPR chain for audit.

Incident workflow

The four-phase incident lifecycle.

Declare an incident

Create a new incident with severity and description.

faramesh incident declare \
  --severity high \
  --agent support-bot \
  --reason "Agent issuing refunds without customer request"

Isolate the agent

Immediately deny all actions from the agent and quarantine its sessions.

faramesh incident isolate <agent-id>

Attach evidence

Attach audit exports, screenshots, or other evidence to the incident record.

faramesh incident evidence <incident-id>

Resolve the incident

Close the incident with a resolution summary. The agent remains isolated until explicitly unkilled.

faramesh incident resolve <incident-id>

Run a playbook

Playbooks automate common incident response workflows.

faramesh incident playbook <incident-id>