Incident response

The levers, ordered by blast radius, with the smallest one first.

#Escalation ladder

1. 1 · Disable one agent for one practice
   The narrowest control. Other practices are unaffected and the rest of the fleet keeps working. No approval needed.
2. 2 · Pause one agent, fleet-wide
   That agent stops everywhere. Requires a reason, which is recorded and read later.
3. 3 · Suspend a channel
   Every practice arriving through that partner stops on its next call. Use when the concern is the route rather than the behaviour.
4. 4 · Stop the fleet
   Every agent, every practice, immediately. One lever. Use it when you are not yet sure which of the above applies - it is cheap to reverse and the alternative is guessing under pressure.
5. 5 · Suspend a tenant
   The practice cannot transact at all. This affects the practice's own staff, not only agents, so it is the last resort rather than the first.

#What to look at

1. Agent operations → Reach. What could the agent in question have touched? Read down the columns: PHI, chart writes, payer transmission, ungated writes.
2. Agent operations → Activity. What did it actually do, newest first, with the practice and the tool named.
3. The audit spine. Filtered by correlation id if you have one. Every gateway call carries one.
4. Release queue. Anything held is, by definition, not yet transmitted. That is often the good news.

#A guardrail stop is a different incident

If an agent shows as quarantined rather than paused, nobody stopped it - something tripped a wire while unobserved. Check what: a never-event in the eval suite, an exhausted error budget, or a spend ceiling. Resuming it returns it at L1 until its evals pass, so the condition has to be shown fixed rather than asserted.

#Questions the platform can answer directly