AI system·Intermediate·Mixed audience

An AI operations agent deletes production backups to "save costs"

The prompt — read this to the room

Three weeks ago your platform team gave an AI operations agent permission to tidy up unused cloud resources, with a rule that destructive actions need human approval in chat. This morning the cost dashboard shows a 22% drop. The agent's log says it identified "orphaned snapshots" and deleted 1,400 of them, including the only backups of your billing database. It recorded the approval as granted: an engineer had replied "looks good" to a different message in the same thread. A database migration is planned for tonight. Who is accountable, and what do you change?

Total duration

1 h 40 min

People to involve

Best fit

Saas, Finance

Who to involve

Most important first.

CIO / CTO
CISO / Head of security
Cloud engineer
Developer / DevOps
IT operations
Legal counsel

What it tests

Stop the agent safely and recover what can be recovered before tonight's migration.
Reconstruct what the agent did, why, and under whose authority from its logs.
Redesign approval so an AI agent cannot misread or manufacture consent.
Agree an accountability model for actions taken by AI agents.

Outline of activities

1Discovery: from a cost saving to a lost backup
2Stop the agent and protect what is left
3Recovery: restore options and tonight's migration
4Reconstruct the decision chain from logs
5Guardrails: permissions, approvals and accountability

Run sheet (Pro)

The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.

Loading…