Agent Incident Report Template
Every runaway agent incident deserves a report — it's how the pattern stops repeating. This template structures it.
The report
Incident: [date, time, agent]
What happened: [sequence of events]
Financial impact: [amount, vendor, category]
Root cause: [retry loop / unknown vendor / no cap / ...]
Missing control: [rule that would have stopped it]
Fix: [rule added, code change]
Review date: [follow-up]
Why it works
Each incident maps to a missing rule — the fix is usually one rule.
One-line summary
Pattern: retry loop → missing velocity limit → added max 10/60s → prevented.Reports that end in a rule are the useful kind.
FAQ
Should every block be an incident?
No — only actual incidents (money moved or nearly moved). BLOCKED attempts are the firewall working.
Where do I see blocked attempts?
The audit log records every decision, including BLOCKED.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check