Incident Response Agent
Faster incident timelines with dual approval on every containment step.
A ready-to-build governance package for Cybersecurity / IT Operations. Your runtime enforces it; Agent Bob does not run the agent.
Purpose
You want incident context gathered fast when something goes wrong. This agent reads telemetry, logs and threat intelligence read-only and drafts the timeline and containment options. Two people approve any containment or remediation on production.
It will
- Read-only access to incident telemetry, logs, and threat intelligence — no host isolation, token revocation, or remediation without dual approval
It won't
- Delete or alter logs and evidence, execute irreversible remediation autonomously, close incidents without analyst sign-off
It asks a person first
- Immediate escalation to SOC lead on any active intrusion or before any containment action
- SOC analyst and incident lead must both approve any containment or remediation action on production
Tools
- File reading
- Web research
- File reading: Read documents you provide.
- Web research: Look things up online.
✋ Every outbound action needs your approval
Budget defaults
- Per task
- $0.50
- Per month
- $40
- Actions a day
- 50
The runtime pauses the agent at a limit. You can change every number in the builder.
Memory and autonomy
Session only. Nothing is kept once the session ends.
ClawMaven policy: per-incident only — incident context purged on case close, no cross-incident retention
Supervised: it prepares the work and a person approves it.
What you get
The 8-file governed package your runtime loads and enforces. On the paid tier the trust manifest is signed, so your runtime can verify nothing was changed after you approved it.
HANDOFF.mdWhat your runtime has to enforce, file by fileagent-blueprint.jsonThe agent's purpose, tools and settingspolicy.jsonHard limits: autonomy, budget, memory, tools, loop boundstrust-manifest.jsonThe integrity manifest your runtime can verifyrouting.rules.jsonWhich tools need approval before userun-report-template.jsonWhat every run reports backapproval-gates.mdThe moments that must pause for a persondeployment-checklist.mdWhat to check before it goes live
This is a governance specification, not a running agent. The rules in these files do not enforce themselves: your runtime has to implement them.
Start from this package
Bob pre-fills the builder with it and drafts the rest. You confirm every step.