Nebula MutualDefensible AI Library / Handle an incident / Incident pack
Incident pack: vendor model changed, customer assistant
Draft 2, saved 2026-10-16 by Practitioner, Northline Advisory. Template version 1.0.
Prototype states
typed stated in the records or by youproduced computed here from the recordsmissing the records hold nothing yet
nebula-mutual/events/chg-0014, from the client’s incident log. Severity: not classified yet.
| Stage | When | What | Accountable |
|---|---|---|---|
| Signal | 2026-10-15 | The model identifier declared on live calls no longer matches the one carried at G4 typed | CISO |
| Classify | 2026-10-15 | A change: the vendor updated the model behind the customer assistant typed | CRO |
| Contain | In progress | The CRO decides: suspend, return to G2, or a time-boxed exception | CRO |
| Reconstruct | not started | What ran, and on what, between the change and containment | CISO |
| Close | not started | A closing test that must fail without the fix | CRO |
Post-incident review
[Opens after Close, in the AIRP review form.]
Learn more about this document
Engine: AIRP. Every event moves through signal, classify, contain, reconstruct and close, with the accountable role and the time of each step.
The client’s own tenant holds the live event; this pack drafts the documents around it.
What changed in 1.1
- [Change notes from the corpus editor, as published with the version.]
Filled for Nebula Mutual in this prototype
The prototype fills the library from Nebula Mutual’s records. Open the library for Nebula Mutual, or the Sharia review kit for Nebula Gulf Bank.