FUURAA AI Knowledge Library · Browser-local tool
Turn incident declaration, authority containment, evidence, impact, causal hypotheses, recovery verification and re-authorisation into a fifteen-field JSON record. Entries are processed only in this browser page.
Incident decision workspace
Start blank or load a clearly marked fictional example. Completion checks only field presence—not whether the incident, evidence, cause or decision is valid.
0%15 fields remain incomplete.
Bind the alert to one system, authority envelope, clock set and predeclared boundary.
Reduce authority before changing evidence, then preserve only what the review needs.
Separate demonstrated consequences from possible scope and competing causal hypotheses.
A repaired service remains unauthorised until bounded recovery evidence survives challenge.
Name what may resume, what remains excluded, who owns the decision and when it expires.
JSON
The export uses RFC 8259 JSON. The field structure is a FUURAA public method—not an international standard, cybersecurity incident plan, forensic format, legal evidence, audit or certification format.
{
"schema": "fuuraa.ai-agent-incident-decision-record/v1",
"incident": {
"identity": "",
"deployment_and_authority": "",
"detection_and_clocks": "",
"triggered_boundary": ""
},
"containment": {
"actions": ""
},
"evidence": {
"bundle": "",
"affected_scope": "",
"consequence_evidence": ""
},
"investigation": {
"hypotheses_and_counter_evidence": ""
},
"recovery": {
"repair_or_rollback": "",
"recovery_tests": "",
"independent_review": ""
},
"reauthorisation": {
"decision_and_rationale": "",
"scope_and_exclusions": "",
"owner_expiry_and_reopen_triggers": ""
}
}Applicability boundary
FUURAA analysisThe point of an incident record is not a smooth narrative. It is making alerts, containment, evidence, competing causes and recovery tests constrain the next decision together. Without counter-evidence, exclusions, expiry and reopen triggers, re-authorisation merely restores authority while unknowns remain open.
Primary sources and boundaries
Connects governance, context, measurement and risk treatment across the AI lifecycle.
BoundaryVoluntary and use-case agnostic; it does not prescribe this record or certify a decision.
Open primary source ↗26 July 2024 · page updated 8 April 2026Adds generative-AI actions for incident disclosure, provenance, monitoring and third-party risk.
BoundaryA cross-sector profile that still requires prioritisation for the actual system and affected people.
Open primary source ↗Final 3 April 2025Frames preparation, detection, response and recovery as integrated cybersecurity risk management.
BoundaryCybersecurity guidance broadly; this tool adapts, but does not replace, an organisation's incident plan.
Open primary source ↗26 February 2024Provides high-level outcomes for governing, identifying, protecting, detecting, responding and recovering.
BoundaryIt does not prescribe how outcomes must be achieved or validate a specific response decision.
Open primary source ↗W3C Recommendation · 30 April 2013Models entities, activities, agents, time, derivation and responsibility for provenance.
BoundaryA provenance data model—not a guarantee of evidence integrity, authenticity or causal truth.
Open primary source ↗Internet Standard · December 2017Defines the portable structured-data format used by the exported incident decision record.
BoundaryValid JSON cannot prove that an incident occurred, evidence is authentic or re-authorisation is justified.
Open primary source ↗Method and evidence chain