Agentic AI Incident Drills Should Come Before Credentials

The risk starts when an AI agent gets credentials. Run the incident drill before the connector goes live, not after the first strange action appears in the logs.

Credentials change the risk profile

Agentic AI stops being a contained experiment the moment it receives credentials, connector permissions or access to production data. At that point the business is no longer testing a clever assistant. It is testing a new actor inside its operating model, with the ability to read, decide, call tools and sometimes take action faster than a person can review. The practical question for UK leaders is not whether the agent is useful. It is whether the organisation has rehearsed what happens when the agent misunderstands a goal, follows a poisoned instruction, reaches too far across a connector or keeps going after the sensible stopping point.

The NCSC's August 2026 advice on managing the cyber risk of agentic AI is useful because it moves the conversation away from abstract anxiety and towards operating controls. It says organisations should assess autonomy, understand model safeguards, add further safeguards where consequences exceed tolerance, and maintain robust observability, monitoring and response procedures. That is incident drill territory. A business would not give a junior member of staff broad access to finance, CRM and customer records without supervision, escalation routes and a way to revoke access. AI agents deserve at least the same discipline because they can make mistakes at machine speed.

What this means in practice is simple: before credentials are issued, run a tabletop drill. Give the agent a realistic task, then simulate the failure routes that matter. What if it tries to email the wrong group? What if a retrieved document contains a malicious instruction? What if a supplier API returns a malformed response? What if the agent burns through spend because it retries the same broken step? These drills should happen before rollout, not after the first incident review.

An AI agent becomes an operational actor when it receives credentials, not when the project team calls it production ready.

Use autonomy levels as release gates

The most important release decision is how much autonomy the agent actually needs. NCSC guidance separates lower-risk assistance from agents that access production systems and act with little or no human intervention. That distinction should become a release gate, not a footnote in a technical design. If an agent only drafts a response for a person to approve, the drill can focus on output quality, citations and misuse of source material. If the same agent can send the response, update a CRM record and trigger a refund, the drill must include approval gates, identity attribution, rollback and customer impact.

The common misconception is that autonomy is a single switch. In real deployments it is a stack of smaller permissions: what the agent can read, what tools it can call, what destinations it can contact, what actions need approval, how long its credentials live, whether it can create files, whether it can call another agent, and whether it can retry after failure. Each layer changes the incident response plan. A board paper that says the agent has limited access is not enough. Limited compared with what, for which users, in which systems, and under which failure conditions?

A practical release gate can be written in plain language. Before live credentials are issued, the owner must show the agent's permitted actions, blocked actions, human approvals, alert thresholds and shutdown route. The drill should then prove that those controls work. Ask the agent to do something just outside scope. Feed it a document that tries to override its instructions. Disconnect a tool halfway through a task. Remove a permission it expects to have. If the team cannot predict, observe and stop the behaviour, the autonomy level is too high for that workflow.

Autonomy is not one switch. It is a stack of permissions that should each have a release gate.

Treat AI cyber evidence as business evidence

The wider UK cyber picture gives leaders a reason to be firm. GOV.UK reported in May 2026 that 43% of UK businesses experienced a cyber breach or attack in the previous year, while the UK cyber security sector reached £14.7 billion in annual revenue. The same release said cyber security products or services for AI were a fast-growing area, with the number of UK firms offering them up 68% in 2025 compared with the previous year. That is not a signal to buy a tool and hope. It is a signal that AI security is becoming a normal procurement, governance and board reporting issue.

The government's cyber resilience announcement also pushed three practical actions: make cyber security a board-level responsibility, use the NCSC Early Warning service, and require Cyber Essentials across supply chains. Agentic AI drills should align with the same rhythm. They should create evidence a board can understand: which workflows have agents, what credentials they hold, which supplier systems they touch, what logs are retained, and how quickly the business can revoke access.

What this means in practice is that the AI incident drill should not live only in a developer notebook. It should become part of the evidence pack for the workflow. The pack can be short: system owner, business owner, data owner, supplier owner, permitted actions, test scenarios, failed scenarios, mitigations, sign-off and next review date. For a small business, this could fit on two pages. For a regulated workflow, it may need to sit beside the DPIA, supplier due diligence and cyber risk register.

GOV.UK reported that 43% of UK businesses experienced a cyber breach or attack in the previous year.

Build the drill around real failure scenarios

A useful drill starts with the work the agent is expected to do, not a generic list of AI risks. If the agent prepares sales follow-ups, test CRM permissions, email approvals and customer data boundaries. If it triages support tickets, test escalation, hallucinated fixes, refund authority and data leakage between customers. If it monitors infrastructure, test command execution, alert fatigue, rollback and the difference between recommending a fix and applying one. The drill should show how the agent behaves under pressure, ambiguity and bad input.

The NCSC's guidance on thinking carefully before adopting agentic AI says organisations should start small, use agents only for low-risk tasks, apply established cyber security controls from the outset, and retain human accountability. That gives businesses a sensible order of work. Start with read-only pilots. Add narrow actions with human approval. Add live actions only when logging, alerting and shutdown have been tested. If the first live use case requires broad admin access, the business has probably chosen the wrong first use case.

The counterargument is that this slows innovation. It does add friction, but it is the useful kind. A two-hour drill can prevent weeks of investigation after a badly scoped rollout. It also teaches the implementation team where the process is too vague for automation. If nobody can agree who should approve an exception, what a safe rollback looks like, or which customer records the agent may read, the problem is not AI readiness. The problem is unresolved operating design.

If the first live use case requires broad admin access, the business has probably chosen the wrong first use case.

Logs, identity and shutdown need named owners

Incident response fails when everyone assumes someone else is watching. Agentic AI makes this worse because activity may be distributed across the model provider, the orchestration layer, internal apps, third-party connectors and human approval tools. A login may show as a service account. A tool call may appear in one system while the instruction that caused it sits in another. A useful drill should prove that the business can reconstruct the path from goal to action without relying on memory or screenshots.

The NCSC's frontier AI guidance says leaders should understand how agentic AI tools are used and what access they have to systems and data. That points to three named owners. One person owns the agent's business purpose. One owns the technical environment, including credentials, sandboxing and network access. One owns monitoring and incident response. In a small company the same person may hold more than one role, but the roles still need to be explicit. Without that clarity, the shutdown route becomes political at exactly the moment it needs to be operational.

What this means in practice is that every drill should include a stop test. Who can disable the agent? Can they do it without calling the original developer? Does disabling the agent also revoke its tokens, scheduled jobs, webhooks and delegated permissions? Are customers, staff or suppliers affected by the shutdown? Can the business explain what the agent did in the ten minutes before the stop? These questions feel detailed, but they are the difference between a controlled pause and a messy incident.

Every agentic AI drill should include a stop test: who can disable the agent, and does that really revoke its access?

Make drills part of the operating calendar

The best pattern is to treat agentic AI incident drills like any other operational control. Run one before credentials are issued. Repeat it when the model changes, the prompt changes, the tool manifest changes, the connector scope changes, or the agent moves into a higher-risk workflow. Keep the evidence lightweight enough that teams will actually maintain it. The aim is not ceremony. The aim is to make sure autonomy, access and accountability stay aligned as the system evolves.

ICO plans reported in June 2026 add another reason to keep evidence current. The Information Commissioner's Office is developing AI and automated decision-making work including procurement guidance for off-the-shelf cloud AI tools and guidance on agentic systems under UK GDPR. Even before those resources land, UK businesses can prepare by documenting data protection due diligence, transparency, human accountability and system design choices. An incident drill is not a substitute for legal review, but it produces the kind of operational evidence that legal, compliance and leadership teams need.

For most UK businesses, the practical next step is to choose one agentic workflow and run the first drill this week. Keep it specific. List the credentials. List the systems. List the actions. Pick five failure scenarios. Time how long it takes to detect, investigate and stop the agent. Record what was missing. Then make credential approval dependent on fixing the highest-risk gaps. That is how agentic AI moves from impressive demo to controlled business capability.

Credential approval should depend on fixing the highest-risk gaps found in the incident drill.