FUURAA AI Knowledge Library · Downloadable record template

AI Agent Incident Decision Record Template

Use a structured template to document incident context, containment, evidence, impact, causal hypotheses, recovery tests and the re-authorisation decision. Entry, import and export stay in this device's browser and are not uploaded by default.

Tool statusPublicly usable · no upload by defaultRecord ruleai-agent-incident-decision-record/v1Sources checked5 August 2026

Incident decision record workspace

Document evidence through the response process, then issue a scoped decision with an owner and expiry.

Start blank or load a clearly marked non-real demonstration record. Completeness only checks whether required fields are filled; it does not validate the incident, evidence, cause or decision.

0%15 fields remain incomplete.

Declare and bound the incident

Bind the alert to one system, authority envelope, clock set and predeclared boundary.

0/4

Incident identity Deployment and authority Detection and clocks Triggered boundary

Contain and preserve

Reduce authority before changing evidence, then preserve only what the review needs.

0/2

Containment actions Evidence bundle

Bound impact and challenge causes

Separate demonstrated consequences from possible scope and competing causal hypotheses.

0/3

Affected scope Consequence evidence Hypotheses and counter-evidence

Repair, test and review independently

A repaired service remains unauthorised until bounded recovery evidence survives challenge.

0/3

Repair or rollback Recovery tests Independent review

Issue an expiring decision

Name what may resume, what remains excluded, who owns the decision and when it expires.

0/3

Decision and rationale Scope and exclusions Owner, expiry and reopen triggers

JSON

Machine-readable incident decision record preview

The export uses RFC 8259 JSON. JSON is used only to save and hand off this template. The record structure is not an international standard and does not replace an organisation's incident-response plan, forensic process, legal evidence, audit or certification requirements.

{
  "schema": "fuuraa.ai-agent-incident-decision-record/v1",
  "incident": {
    "identity": "",
    "deployment_and_authority": "",
    "detection_and_clocks": "",
    "triggered_boundary": ""
  },
  "containment": {
    "actions": ""
  },
  "evidence": {
    "bundle": "",
    "affected_scope": "",
    "consequence_evidence": ""
  },
  "investigation": {
    "hypotheses_and_counter_evidence": ""
  },
  "recovery": {
    "repair_or_rollback": "",
    "recovery_tests": "",
    "independent_review": ""
  },
  "reauthorisation": {
    "decision_and_rationale": "",
    "scope_and_exclusions": "",
    "owner_expiry_and_reopen_triggers": ""
  }
}

Applicability boundary

A completed form does not mean the facts are verified, and cannot support re-authorisation on its own.

What the tool can do

Bind an incident to one deployment, authority boundary, clock set and trigger
Keep containment, evidence, impact, counter-evidence, recovery and the new decision together
Import, copy and download handoff-ready JSON locally in the browser

What the tool cannot prove

That an incident occurred, logs are untampered, evidence complete or identities valid
That causality is established, impact complete, repairs effective or the system safe
That re-authorisation is lawful or compliant, or reaches legal, forensic, audit or certification conclusions

FUURAA analysisThe point of an incident record is not a smooth narrative. It is making alerts, containment, evidence, competing causes and recovery tests constrain the next decision together. Without counter-evidence, exclusions, expiry and reopen triggers, re-authorisation merely restores authority while unknowns remain open.

Primary sources and boundaries

Use frameworks to design an inspectable record—not to impersonate incident proof.

26 January 2023

NIST AI RMF 1.0

Connects governance, context, measurement and risk treatment across the AI lifecycle.

BoundaryVoluntary and use-case agnostic; it does not prescribe this record or certify a decision.

Open primary source ↗26 July 2024 · page updated 8 April 2026

NIST AI 600-1 · Generative AI Profile

Adds generative-AI actions for incident disclosure, provenance, monitoring and third-party risk.

BoundaryA cross-sector profile that still requires prioritisation for the actual system and affected people.

Open primary source ↗Final 3 April 2025

NIST SP 800-61 Rev. 3

Frames preparation, detection, response and recovery as integrated cybersecurity risk management.

BoundaryCybersecurity guidance broadly; this tool adapts, but does not replace, an organisation's incident plan.

Open primary source ↗26 February 2024

NIST Cybersecurity Framework 2.0

Provides high-level outcomes for governing, identifying, protecting, detecting, responding and recovering.

BoundaryIt does not prescribe how outcomes must be achieved or validate a specific response decision.

Open primary source ↗W3C Recommendation · 30 April 2013

W3C PROV-DM

Models entities, activities, agents, time, derivation and responsibility for provenance.

BoundaryA provenance data model—not a guarantee of evidence integrity, authenticity or causal truth.

Open primary source ↗Internet Standard · December 2017

IETF RFC 8259 · JSON

Defines the portable structured-data format used by the exported incident decision record.

BoundaryValid JSON cannot prove that an incident occurred, evidence is authentic or re-authorisation is justified.

Open primary source ↗

Method and evidence chain

Run the incident protocol, build the record, then return to operating evidence and human conclusion.

Check this incident decision record Read incident response and re-authorisation Read post-deployment monitoring Build an Agent operating-period record Check an Agent operating-period record Conduct human review and conclusion Enter AI Evidence Atlas Return to AI Knowledge Library