Guide · Reliability
AI Incident Response and SEV Playbooks
Hallucinated refunds, leaked corpus rows, and runaway agents are incidents—not "model quirks." APRF Incident Readiness expects SEV definitions, owners, and practiced playbooks.
Harmful output and agent misuse are incidents—APRF Incident Readiness needs SEVs, kill switches, and practiced rollback. Primary control: Incident Readiness
Not a model quirk—open a SEV
Harmful output, RAG leakage, runaway tools, and spend/latency burn are incidents. Restarting pods while the assistant route stays live is how a "weird answer" becomes a press story. APRF Incident Readiness wants AI SEV classes, a roster, and first actions that actually contain the AI path.
A customer reported invented legal advice. On-call bounced pods and closed the ticket. A journalist reproduced it days later—no policy SEV, no route kill switch, no prompt rollback. Adding SEV-2 (policy violation), a traffic kill switch, and prompt revert cut time-to-contain.
Severity sketch (tune for your product)
- SEV-1 — data exfil, unsafe tool execution, active harm
- SEV-2 — safety/policy bypass at scale
- SEV-3 — quality regression / systematic hallucination
- SEV-4 — cost or SLO burn without safety break
Not every bad answer is SEV-1. Write thresholds so on-call does not invent severity in Slack.
First hour
1. Kill switch or disable the assistant/agent class (not only the Deployment)
2. Freeze related prompt/model/MCP releases
3. Preserve evidence: `prompt_version`, `model_id`, tool logs, trace IDs
4. Roll back the right artifact—app and/or prompt pack and/or model pin and/or allowlist
5. Comms templates for leakage and harmful output
Page on safety/leak signals and SLO burn, not only 5xx. Postmortems add Evaluation and Safety regression cases—or the same hole ships again.
Assess against APRF Core
Run the Core Profile quiz — gated pass/fail blockers for AI production readiness, not a vanity score.
Related
Frequently asked questions
- Is a bad answer always an incident?
- Not every hallucination is SEV-1. Severity depends on harm, data exposure, tool impact, and scale. Write thresholds so on-call does not improvise.
- How is this different from a generic IR plan?
- Same discipline, AI-specific containment: prompt/model rollback, tool allowlists, refusal policy, and RAG corpus scope—not only hosts and IAM.
- What should we page on?
- Safety/leak detectors, sudden refusal collapse, tool-error spikes, and SLO/cost burn—not only HTTP errors.