# agent generated the incident report before containment finished: sequencing

## TL;DR

The agent wrote the incident report while the incident was still active, so the report described a moving target and implied resolution. Gate reporting on containment: draft during, publish after. A report on an uncontained incident is fiction with timestamps.

```text
agent generated the incident report before containment finished
```

## Steps

1. Mark the premature report as draft and correct its status.
   Expected: The record stops claiming resolution.

2. Define the phase gates: report drafts during response, publishes after containment is verified.
   Expected: The sequence is explicit.

3. Verify containment with evidence (indicators cleared, access revoked) before publishing.
   Expected: The gate has teeth.

4. Republish the report once containment is confirmed.
   Expected: The final report describes the whole incident.

5. Add the gate to the incident runbook so the agent cannot skip it.
   Expected: The sequence is enforced.

## When to use

- reports describe active incidents as resolved
- the agent writes reports autonomously
- incident phases are informal

## When not to use

- the report is explicitly a draft status update (label it so)
- containment is verified (then publish)
- the incident is a drill (different stakes, same discipline)

## Tool compatibility

- any incident response runbook
- agent-generated reports

## Variant phrasings

- "incident report before containment"
- "report generated during active incident"
- "premature incident report"

## Why it happens

Agents optimize for completing their task list, and 'write the report' is a task. Without a phase gate, it completes while responders are still working, freezing a partial understanding as the official record. Stakeholders read 'report published' as 'incident over'. The gate aligns the artifact with the reality.

## Edge cases

- draft status updates during the incident are valuable; label them drafts
- containment verification needs its own checklist, not a feeling
- the final report should note what was known when; the premature draft is part of the history

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uop09GuyI7Kcu3jJ7BN0Zg