Use case / Incident response

An agent did something wrong. Reconstruct exactly what happened, in minutes.
Not days of log-spelunking.

A customer escalation, a regulator inquiry, a reporting clock — and you need to know what the agent did and prove it before time runs out. AIR's causal graph and counterfactual replay reconstruct the chain, and the signed log proves the reconstruction wasn't edited after the fact.

Causal graphCounterfactual replaySigned timelineReporting deadlines

Book an agent audit See the evidence ↓

Minutes, not weeks · reconstruction you can defend

Incident reconstruction · live

Agentpayments-agent-09

Triggerexceeded scope @ 13:02

Causecausal graph → step 4

Replaycounterfactual resolved

reconstructed in minutes · signed in-process

✓ original record · not edited after

01The stakes

13:02 · incident: payments-agent-09

An agent did something it shouldn't have, and the clock to report just started.

Across systems never built to attribute agent behavior, answering "what exactly happened" is normally days or weeks of log-spelunking. With AIR the causal chain reconstructs in minutes, and the signed record proves it's the truth, not an after-the-fact edit.

02What it takes

Answer fast, and prove the answer.

Reconstruct the chain

causal graph

The causal graph links each agent action to what caused it, so you read the path, not scattered logs across systems.

Hard edges at confidence 1.0; soft edges scored.

Replay the counterfactual

what if it hadn't

Counterfactual replay shows the branch that didn't happen, so you can establish intent and impact, not just sequence.

The "why," not only the "what."

Prove it wasn't edited

signed timeline

The signed, anchored log proves your reconstruction is the original record, admissible under FRE 902.

Reconstructed from signed records, not rebuilt from editable logs.

03How AIR answers

Everything the clock demands, in order.

What exactly did the agent do?

InvestigateThe signed timeline of every action, in order, attributed to the agent.

What caused it?

CausalThe causal graph links each step to its trigger upstream.

What would have happened otherwise?

ReplayCounterfactual replay runs over the same graph.

Can I prove the reconstruction is real?

ProveSigned in-process and anchored — not rebuilt from editable logs.

Before the reporting deadline?

MinutesMinutes, against the days of cross-system log-spelunking it replaces.

04The evidence

The timeline you file, and can defend.

A reconstructed, signed, timestamped chain of exactly what happened and why — independently verifiable, and admissible under FRE 902(13)–(14) when the inquiry escalates.

See structural verification →

Incident reconstruction · agdr/v2

Trigger · agent exceeded scope @ 13:02:04Z

Cause · causal graph → poisoned input at step 4

Replay · counterfactual: blocked path shown

Halt · action stopped — SV-SCOPE

signed in-process · reconstructed in minutes · anchored Rekor

✓ original, not edited after · verify on search.sigstore.dev

05What you get

The tiers incident teams choose.

Enterprise

most teams here

Causal graph, query & counterfactual replay
Signed, attributable agent timeline
Containment — halt agents before harm
SIEM: Splunk · Datadog · Sentinel · Sumo
SSO / OIDC, SLA

Book an agent audit

Air-gapped

regulated · sovereign

Everything in Enterprise, plus

On-prem / offline reconstruction
No phone-home — records never leave
Extended retention + PQ re-anchoring
Admissibility Pack — FRE 902 + expert support

Talk to us

When the clock starts, have the answer already.

A free agent audit shows how fast you could reconstruct an incident today, and what the signed record would prove.

Book an agent audit →