Decision anatomy
Accountable owner
Operational risk owner with an accountable business or service executive
Recurrence
Continuous event-driven triage with periodic risk review
Reversibility
Varies by response; alerts are reversible, but shutdowns, disclosures, and missed containment windows may not be.
Cost of error
Potentially critical through cascading loss, safety impact, service interruption, or delayed escalation.
Evidence
- risk event and control evidence
- likelihood, severity, and exposure
- affected processes and dependencies
- available mitigations and response capacity
- policy, continuity, and escalation thresholds
Alternatives
- monitor
- mitigate
- escalate
- accept within authority
- pause affected operation
Objectives
- harm reduction
- continuity
- speed of containment
- proportionality
- recovery
Constraints
- authority
- safety
- policy
- continuity requirements
- response capacity
- legal obligations
Uncertainty
- event scope
- propagation
- control efficacy
- secondary effects
- time to recovery
How AI may participate
This is design guidance for the archetype, not a universal maturity requirement or a claim about a particular product.
- Assemble current incident, asset, dependency, control, and exposure evidence with time and source provenance.
- Compare monitor, isolate, mitigate, switch, pause, or escalate responses against safety, continuity, and cost constraints.
- Recommend an immediate posture while identifying evidence that would require a different response.
Authority and retained human judgment
AI may triage and recommend. Shutdowns, safety-critical control changes, external notifications, access restrictions, and other consequential interventions require explicit policy authority or a qualified human approver.
What accountable people still decide
- Whether incomplete evidence warrants precautionary action or continued operation.
- How to balance safety, service continuity, customer harm, and recovery cost.
- When a specialist, incident commander, or regulated-role review is mandatory.
Outcome observability
Containment and recovery signals appear quickly, while avoided harm and control effectiveness may be hard to attribute.
Evaluation and trace
- Measure time to appropriate action, incident severity, recovery, recurrence, false escalation, and avoided harm.
- Retain the evidence and expected effect available at the decision time, not only the post-incident narrative.
- Separate detection quality, decision quality, execution quality, and observed outcome.
Failure and abstention conditions
- Escalate immediately when safety, rights, regulation, or large irreversible impact is plausible.
- Abstain from effectful action when asset state, authority, or rollback conditions are unknown.
- Do not treat absence of telemetry as evidence that risk is absent.
Assess your version of this decision
An archetype cannot determine the right authority boundary by itself. Decisagent Fit separately assesses useful AI participation and supportable action authority from your decision context.
Reviewed relevant products
No product relationship has crossed human review for this decision. Candidate seed links are intentionally excluded.