Reconstruct what the agent actually did.
An independent, evidence-centered investigation engine being built for incidents involving autonomous and agentic AI systems.
AI agents can authenticate to systems, retrieve sensitive information, invoke tools, modify records, communicate externally, and trigger downstream agents. When something goes wrong, the central question is no longer only what the model said. It is whether the organization can reconstruct the complete sequence of action.
Evidence may be scattered across model providers, identity platforms, agent frameworks, tool gateways, cloud services, SaaS applications, and the business systems the agent touched. AgentAutopsy is being designed to correlate those fragments without pretending incomplete evidence is certainty.
AAE is the developing common evidence model behind AgentAutopsy:
Each normalized event also carries source provenance, collection time, schema version, integrity metadata, and an evidence hash. The objective is a consistent investigative language across otherwise disconnected platforms.
Content-addressed artifacts, cryptographic hashing, an append-only examiner ledger, and verifiable case exports support chain of custody by construction.
Identity resolution, session stitching, causal chaining, blast-radius analysis, and explicit High/Medium/Low reconstruction confidence with the reason shown.
Executive narratives, technical timelines, and regulatory reporting generated from a common case file, with claims linked back to underlying evidence records.
The evidence and causal layers are intended to be deterministic and defensible without a generative model establishing investigative facts. Any model-assisted narrative drafting remains optional and segregated from the evidentiary chain.
The ability to investigate an agent incident depends on evidence that must exist before the incident begins.
RedCon1 Response evaluates your current logging, identity, audit, retention, and evidence-preservation capabilities against the developing AAE framework. The engagement identifies which investigative questions your current telemetry can answer, which it cannot, and what must change.
Final scope depends on the number of agent systems, environments, model providers, tool integrations, identity sources, and enterprise applications reviewed.
Organizations should not discover after an AI incident that the evidence required to understand it was never collected.
View the Readiness Assessment Discuss AgentAutopsy