Summary

  • A 2 November individual Internet-Draft proposes five signed records for an AI agent incident, from the order to stop it through the decision to let it run again.
  • The restart record has 16 evidence slots. Each must point to evidence by digest or say, with a reason, that the subject was not addressed. A blank box cannot silently disappear.
  • A linked bundle can pass every consistency check while the party receiving it still refuses the restart. The claimed independence of an approver is a statement to verify, not a credential that verifies itself.

A restart button with a paper trail

When an agent is paused after an incident, the difficult moment comes later. The operator wants its tools back. The customer wants proof that the old route to trouble is closed. The 2 November draft proposes five record types to make that argument inspectable: authorization of the incident action (R1), a credential revocation sweep (R2), the re-enable decision (R3), joint authority across organizations (R4), and a report on the boundary of revocation (RB). Each would travel as an in-toto Statement in a signed DSSE envelope.

R3 is the switch record. It can say resume_full, resume_staged, remain_restricted, or not_established. A staged return must name the agents, tools, routes, or credentials restored. Its approvers carry roles and a declared basis for independence. It also contains exactly 16 evidence slots, ranging from root cause and asset integrity to replay testing, post-restart monitoring, residual risk, senior approval, and owner confirmation. Each slot holds a digest of evidence or a notAddressed reason. The draft permits an honest omission; it denies a quiet one.

The record has teeth at the join. R3 cites predecessors by digest. A reader checks that each predecessor is present exactly once, has the stated type, belongs to the same incident, and follows a valid order without cycles. A credential restored in a staged return must appear in an R2 sweep. Passing earns the bundle the verdict bundle-consistent. It says the documents fit together. The receiver then applies its own admission policy to the evidence and the omissions.

That separation matters most for approval. The draft calls independenceBasis the producer’s statement. A receiver demanding independent approval should resolve the named approver itself. A signature from the same person who stopped and restarted the agent can be faithfully recorded; the receiver decides whether that concentration of control is acceptable. The IETF status record lists this as an individual Internet-Draft. A working-group adoption or operating trace would change what can be said about its reach; neither is in the checked record.