The four-phase agent incident runbook (detect within 4h, contain within 30s, roll back per action class, post-mortem with MTTD-for-Agents detection chain) is the operational overlay on standard SRE incident response that most enterprises deploying agentic AI in 2026 do not have; the seven action classes (database writes, external API calls, customer comms, document publication, code commits, identity changes, knowledge-base writes) each require a distinct rollback procedure and the runbook captures the operator authorised, time budget, and substitute action where rollback is impossible.

Premise: standard SRE runbooks assume the actor is a system you control; agent-mode incidents invert that. Anchored to MTTD-for-Agents methodology (the publication's own framework, /mttd/) and the operational pattern documented in AM-121 (IT operations reality). 60-day review cadence (faster than other resources) because the agent action surface evolves faster than the regulatory surface — new action classes will land as code-execution and agent-authorising-agent capabilities ship.