Return to normal after an incident

Before you leave the emergency mode

1. The cause is changed. The permission that allowed it is now block or require approval, or the connection user is narrower, or both.
2. Content is recovered as far as it can be, and you know what could not be.
3. Credentials are rotated if there was any chance of exposure.
4. Evidence is exported if anyone will review this later.
5. The audit chain verifies.

Restoring service

1. Return the site to normal first, while the agent responsible stays paused. Other integrations resume; the suspect one does not.
2. Move the suspect agent to restricted rather than straight to active, if you want a period of reduced boundary.
3. Watch the timeline for the first few real requests from it.
4. Move it to active once you have seen it behave.

Afterwards

• Re-run readiness and runtime verification. Confirm the controls still behave as documented after everything you changed.
• Write down what changed and why. The audit trail records the change; it does not record your reasoning, and in three months that is what you will want.
• Review neighbouring permissions. If one Ability was too open, its siblings usually are too.
• Check the approval queue is real. If the incident happened because approvals were being cleared without reading, that is the thing to fix.

A note on what to conclude

Most incidents here end with a permission that was granted reasonably at the time and outlived its reason. That is a process finding, not a personal one — and it is what periodic permission review exists to catch before it becomes an incident.

Related guides

• RecoveryUse read-only and paused

  Three site modes that take effect immediately across every agent. Which to reach for, what each still permits, and why stopping is never gated by plan.

• AuthorityReview permissions you no longer need

  Boundaries drift wider, never narrower, unless someone revisits them. A short periodic review using invocation summaries and the audit trail.

• ApprovalKeep the approval queue meaningful

  A queue that is always approved has stopped being a control. How to tell the difference between real review and rubber-stamping, and what to change.