The AI IR Overlay framework provides a standardized specification for managing incident response in autonomous agents by focusing on containment, evidence collection, and mapping potential system blast radii.

Key Points

• The framework includes 24 playbooks, three JSON schemas, and two reference implementations to address risks from authorized but unintended agent actions.
• It introduces an AI Bill of Materials (AI-BOM) to document service identities, tool scopes, and write targets for production agents.
• A containment ladder (M0–M5) allows security teams to restrict agent capabilities, such as disabling write tools, without fully terminating the session.
• The specification maps directly to NIST SP 800-61 Rev. 3, NIST CSF 2.0, and the OWASP Top 10 for Agentic Applications.
• The validator tool performs schema checks to ensure security controls are declared, though it does not verify the functional performance of those controls.

Why it Matters

This framework addresses the unique challenge of securing autonomous agents that operate using valid credentials, where traditional intrusion detection fails to identify malicious activity. By providing a structured approach to containment and evidence gathering, it helps organizations identify critical security gaps in their agentic workflows before an incident occurs.