The Feds Just Published a Rogue-Agent Playbook. It Wasn't Addressed to You. Follow It Anyway.

On October 16, NIST, CISA, and the NSA published a joint document with a title only a federal working group could love: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. Ten voluntary practices. Five stages — prepare, detect, respond, recover, report. Version 1.0, TLP:CLEAR, addressed to the frontier labs training the biggest models on earth (coverage and analysis here).

You, the person running forty ordinary agents against your CRM, were not the addressee. The authors do note, almost in passing, that the practices "may also apply to deployers."

They may also apply to deployers the way gravity may also apply to passengers.

The memo went to the labs. The incident will happen at your place.

Here's the uncomfortable math. According to IBM's October 2026 study of 3,221 executives across EMEA, 35% of enterprises are already running agentic AI in production, and 80% say an AI-related incident — agent failures, data exposures, AI-driven decision errors — reached their board or C-suite in the past year. Only 40% of those organizations changed their governance in response.

So: incidents are already happening, they're already board-level, and most governance programs shrugged. Meanwhile, the adversary playbook got a formal update the same month — MITRE ATT&CK v20 now catalogs prompt injection (direct and indirect) and abuse of an organization's own AI agents as named enterprise techniques, among nine AI-and-evasion-flavored additions.

When the three agencies that write the nation's incident-response doctrine, the framework used by every threat-intel team, and a survey of three thousand executives all converge on the same subject in the same two weeks, that's not a news cycle. That's a readiness checklist being handed to you slightly early.

What the playbook actually asks for

Strip away the superintelligence framing and the ten practices make three demands that apply to anyone operating agents today.

First: evidence that survives the incident. Practice 5 — collect, retain, and analyze evidence — asks for tamper-resistant logs with reliable timestamps covering agent trajectories, tool calls, reasoning traces, rejected actions, and security-control decisions, plus the configuration detail needed to reproduce the incident. Not "we have Datadog." Logs an attacker (or the agent itself) cannot quietly rewrite, capturing not just what the agent did but what it tried to do and was refused.

Second: a shutdown you've actually verified. The recovery practices require rebuilding from verified baselines and — this is the detail most teams will fail — confirming that monitoring, logging, and shutdown mechanisms work before agents restart. A kill switch you've never tested is a decorative button.

Third: attribution from records, not vibes. The document makes a subtle, consequential call: actions produced by prompt injection or a backdoored model count as instructed behavior, not uninstructed. Translation: when your agent exfiltrates data because a poisoned webpage told it to, "the AI went rogue" is not a finding. The only way to establish what instructed the agent — and therefore who owns the failure — is the evidence trail. No logs, no attribution. No attribution, and the liability conversation happens in the dark.

And one thing the playbook conspicuously doesn't ask for: a retention clock. It never says how long to keep weights, checkpoints, or logs, and its own disclaimer waves off compliance and legal purposes. If your incident ends up in litigation — and with eight state AGs currently suing over AI conduct, incidents increasingly do — the preservation duty arrives from a courtroom, not from the playbook. Set your own retention period in writing, now, while nobody is subpoenaing you.

Implementing the checklist without a federal budget

This is the part where we tell you what VeriSwarm actually does, because "voluntary practices" become involuntary the day an examiner, underwriter, or plaintiff asks for the artifacts.

Vault is the evidence practice, implemented: an immutable, hash-chained audit ledger for every agent action, with chain verification to prove nothing was altered after the fact and exports for the day someone official asks. Tamper-resistant logs with reliable timestamps isn't an aspiration here; it's the data structure.

Guard is the shutdown practice: a kill switch that halts agent activity immediately — the capability that, per IBM, 29% of executives say they want across the enterprise by 2027 and rather fewer currently have. Pair it with Guard's policy rules and the "confirm controls work before restart" step stops being a manual prayer.

Gate covers the part the playbook calls security-control decisions: every trust-scoring verdict, policy-tier evaluation, and moderation decision — including the rejected actions the feds specifically want preserved — lands in the event stream as a first-class record. Gate is free and always on, which means the evidence layer costs you nothing to start.

Fleet handles recovery: agents deployed from templates are agents you can rebuild from a verified baseline instead of archaeology.

The playbook's five stages assume you prepared before you detected. Preparation, concretely, is instrumentation — you cannot retrofit a reasoning trace onto last Tuesday.

The deadline that isn't one

Voluntary guidance has a predictable lifecycle: it gets cited in examinations, then in underwriting, then in complaints, and somewhere along the way "voluntary" quietly retires. US banking examiners are already asking for decision logs and named accountability owners for every agent. The NIST document just gave every one of those conversations a common vocabulary.

The labs got the memo. The homework is yours. Start with Gate — the logging is free, and the first question after any agent incident is always the same: show me what it did.

Make sure you can.