AG12Govern AI agent scope
Agent incident response
Playbooks for the incidents agents create, and a way to reconstruct from traces what an agent saw, decided and did.
Price on requestAsk about AG12How pricing works
What it is for
G2 AI incident response prepares you for AI incidents in general. AG12 goes deeper on agents, where the incident is often an action rather than a leak: an email sent, a record changed, a payment started, a pull request merged.
What we build with you
- Playbooks for prompt injection that led to an action, stolen or misused agent tokens, poisoned memory, and an agent acting outside its job.
- A trace forensics procedure: how to rebuild, from logs and traces, what the agent read, what it decided, which tools it called and with what authority.
- Containment steps that work for agents: revoking tokens, isolating memory, disabling tools, stopping sessions.
- A tabletop exercise with your team.
The playbooks draw on CoSAI’s AI Incident Response Framework V1.0[1] and the OWASP GenAI Incident Response Guide 1.0,[2] and address the OWASP agentic risks ASI08 Cascading Failures and ASI10 Rogue Agents.[3]
Framework mapping
The frameworks this scope is aligned with, the version we map to, and what we map. Aligned with means we use the framework; it does not mean any body has certified TriOngle.
| Framework | Version | What we map |
|---|---|---|
| OWASP Top 10 for Agentic Applications | 2026 edition, 9 Dec 2025[4] | ASI08 Cascading Failures; ASI10 Rogue Agents |
| OWASP GenAI Incident Response Guide | 1.0, 28 Jul 2025[2] | Response steps for GenAI incidents |
| CoSAI AI Incident Response Framework | V1.0, 18 Nov 2025[1] | AI-specific detection, containment and recovery |