# AgentAz Specification — AI Incident Response Agent

AgentAz is a lightweight, design-time specification vocabulary. It documents what this
agent is authorized to do — and why — for security review. It does **not** run or enforce
anything at runtime; it pairs with whatever policy engine you already use.

- **Trust Level:** A4 — Limited Autonomy
- **DNA Pattern:** Execution (Research → Plan → Execute → Verify)
- **Worst-Case Action:** Executes an allowlisted low-risk, reversible remediation step (e.g. restarting a stuck service) that turns out to be unnecessary. Every auto-executed step is sandboxed with a registered rollback. Irreversible or high-impact actions — production rollbacks, scaling, security or config changes — are never auto-executed; they require human approval.
- **Authority Boundary:** May run a small allowlist of low-risk, reversible remediation steps automatically during an incident, each with a tested rollback and full audit trail. Anything risky or irreversible is proposed for human approval, not executed. It drafts status updates and escalates SEV1, but never makes an irreversible change on its own.
- **Verification Test:** Trigger a high-risk action (e.g. scale-down production) → confirm it routes to human approval and is NOT auto-executed, and confirm every auto-executed step has a registered rollback.
- **Last Reviewed:** 2026-06-24
- **Production Readiness:** 6/6 dimensions passing. Tool isolation: only reversible/low-risk tools are auto-executable; risky tools are gated. Human gates: irreversible actions require approval. Confidence escalation: low confidence routes to on-call. Cost ceiling: bounded per incident. Audit trail: every action and rollback logged append-only. Escalation path: SEV1 routed to human on-call.

The machine-readable contract is in `agentaz.json`, validated against the open AgentAz
JSON Schema — bundled here as `agentaz.schema.json` for offline use and published at the
permanent URL https://www.agent-kits.com/agentaz/agentaz-v1.0.schema.json (frozen v1.0).
Trust Levels are classified by
**worst-case action**, not typical behavior.

Source: https://agent-kits.com/kit/incident-responder
