Brief.

Tag

incident-response

4 entries, including 2 patterns.

  1. Pattern

    Evidence-Bound Callback Completion

    Accept a completion as a scoped claim, then verify independent evidence and current authorization before the next side effect.

  2. The callback said done

    A workflow completion token can close a task without proving that the approved work happened. Verify the result at the boundary before an agent acts on it.

  3. Pattern

    Telemetry-as-Evidence Incident Gate

    Let an assistant inspect attacker-influenced logs without allowing their prose to close incidents or authorize response actions.

  4. The log line became an incident command

    An investigation assistant can read an honest log record containing an adversary's words. Keep telemetry as evidence, not authority.