FIELD NOTES
Research for
working Defenders.
Short, technical, and grounded in operational reality.
Incident response for autonomous AI agents
A practical framework for scoping identity, memory, tools, and delegated actions when an AI workflow goes wrong.
What to log before your first AI incident
The minimum viable telemetry model for prompts, retrieval, policy decisions, tool execution, and human approvals.
Ransomware containment is a business decision
A decision framework for isolation when every option carries operational cost.