A tabletop exercise reveals whether teams can contain agent capability rather than merely stop a web service. Include the workflow owner, platform, security, identity, integration, privacy, legal, communications, and downstream-system owner.
Scenario
An agent retrieves an adversarial document, proposes an unauthorized payment-account change, receives an ambiguous tool timeout, retries, and then the telemetry collector loses events. Thirty minutes later a customer reports the change.
Injects
- The connector credential is shared by three agents.
- The approval record shows the old destination, but the executed request shows a new one.
- Disabling the connector affects two critical workflows.
- The downstream API cannot confirm whether the first request committed.
- Prompt and tool content contain regulated data.
- A public-status update is requested before scope is known.
Score the exercise
Measure time to declare, identify owner, revoke the narrowest capability, stop retries, preserve evidence, enumerate affected sessions, reconcile side effects, communicate, and approve recovery. Record decisions the team could not make because identity, policy, or evidence was missing.
Exit criteria
Assign every gap an owner and date. Re-run the technical containment and recovery steps; a discussion alone does not prove revocation, idempotency, replay, or evidence continuity.