IncidentGate: Testing Recoverable and Governed Agent Actions

Ebin built IncidentGate to measure an AI incident assistant that could patch components and redeploy services. He structured the workflow in LangGraph and placed the agent's state in PostgreSQL so progress survived outside the running process.

He connected tools through MCP and emitted OpenTelemetry traces into LangFuse. This made each run replayable, including its steps and cost.

Three controls sat before consequential actions: an explicit policy list, an AI action monitor, and a single-use human approval token. The token could authorize one action once, which prevented reuse during a later step.

Ebin then killed the process at 594 defined points across 27 incident scenarios. Of those interruptions, 434 landed mid-task, and every one resumed correctly without lost work or duplicate mutations.

The safety result exposed a separate weakness. He split a harmful outcome across benign-looking actions, and the policy list, monitor, and human reviewer allowed the sequence, producing the same 12 side effects as the no-safeguard baseline.

He published that negative result and closed the project at a measured baseline. The next planned iteration replaces a closed attacker model that refused the attack with an open model suitable for controlled adversarial testing.