Free checklist
The first hour after an agent does something wrong
Print this before you need it. Every step is ordered by how much it costs to do late, not by how obvious it is, and the first four are the ones people skip because they feel like admin.
- 1
Revoke the credential before you investigate anything.
Stopping the process is not enough if the token still works from somewhere else. Revocation is reversible in a way that an extra thirty minutes of access is not.
- 2
Stop the retries, not just the agent.
A queue that keeps handing the same task to a restarted process will reproduce the incident on your behalf, and bill you for it.
- 3
Write down the time you noticed, in a place other than the system involved.
Every later question depends on this timestamp and nobody remembers it accurately by the afternoon.
- 4
Screenshot before you fix.
The state that explains what happened is the state you are about to clear. Capture the queue, the logs and the permission screen as they are.
- 5
Establish what it could have reached, not what it did.
The permission set is knowable in two minutes and is your worst case. What it actually did takes hours and can wait.
- 6
Check egress before contents.
Whether data left is a different question from what data was touched, and it is the one with a deadline attached in most jurisdictions.
- 7
Look for the input, not the bug.
Agent incidents usually begin with a document, an email or a page. Find the text it read immediately before it went wrong.
- 8
Tell one person who is not involved.
A second reader catches the thing you have already explained to yourself. Pick them before the incident, so the choice is not part of it.
- 9
Do not delete the run history to tidy up.
It is the only record of what was decided and when, and it is routinely destroyed by somebody being helpful in hour two.
- 10
Write the one-line cause the same day.
Not the full write-up. One line, while you still know it. The full version can be written from that; it cannot be reconstructed from memory a week later.
Leave your address to hear when a new checklist or free tool is published. Nothing else. This form does not email you a copy of this page.
No spam, no selling your address, unsubscribe in one click. The tools stay free either way.
Educational information, not financial advice. Figures current as of July 2026 where dated; allowances and rates change, so check the source before acting.