Playbooks // in progress

Why one workflow serves the whole map: at the start of an investigation, the category is usually not yet known. Establishing whether the AI system acted on its own, was misused by a human, or was itself attacked is part of the investigation. Classification is the investigation's output. The playbooks are therefore category-agnostic:

INCIDENTsomething harmful happened, category unknown▸

PB-001 FIRST HOURStriage · contain without destroying evidence▸

PRESERVEby order of volatility · clocks start▸

PB-002 EXAMINEreproduce · ablate · lineup▸

CLASSIFY H1–H5hypotheses discriminated by evidence▸

REPORTregulatory deadlines · findings · case file

First Hours: AI Incident Response (PB-001), currently being drafted.

Examining the Subject: Forensically Sound Model Examination (PB-002), currently being drafted.