Part 1 of 4 · 1 min read
Overview
When an agent does something wrong, the questions are: what exactly happened, who approved it, how fast did we know, who was told, and how did we stop it? Interviewers ask "how do you audit an agent and handle incidents?" and expect logs you can trust, severity levels, an escalation path and a kill switch.
About the example, and what is real
Real: the chain, HMAC chain and anchor verification, tamper attacks, required-field enforcement, severity function, escalation and circuit-breaker simulations and the 19 test cases in code/mini-accountability; verification timing. Assumed: event contents, severity weights, the probability that a person is reachable (0.5 to 0.9), 15-minute page windows, the attack rate and flagged fractions, the benign flag rate (5 percent). Not real: no real paging system, write-once store, key management, SIEM or incident process; the anchor is a tuple kept by the test.