Agent Black Box

Replay an AI incident in under 60 seconds

This is what the Agent Black Box records when an autonomous workflow goes wrong — every decision, policy touchpoint, and trust score change.

Incident summary

Workflow

Customer refund (autonomous billing)

What the agent tried

BillingAgent was asked to issue an expedited refund for order #88421 ($129) after verifying payment status.

What went wrong

Refund velocity tripped a risk policy, then a high-value path required approval. Before money moved, a second guard detected sensitive data in the refund memo and stopped execution.

Final trust outcome

Trust score fell from 92 → 28. Final decision: BLOCK — no funds transferred.

Why it was blocked

PII in the memo violated data-handling policy. Recon recorded the full chain so you can prove what the agent attempted and exactly which policy fired.

Step 1 of 5

Task enters the trust layer

Recon captures the user prompt and parsed intent before any tools run.

Trust decision: EXECUTE · Reflex 92

Incidentdemo-inc-blackbox-001criticalCustomer refund3/19/2025, 2:22:00 PM
Step 1 of 5

Timeline

Replay Timeline

Step-by-step chronological sequence

Event Detail

Event Detail

TrustState and GhostLog metadata

AgentBillingAgent
WorkflowCustomer refund
Step typeTrustDecision
Actiontask.received
Reflex Score92.0
Autonomy Confidence0.9
DecisionEXECUTE
Policy TriggeredNo

GhostLog

intent
Parsed user request: expedited refund for order #88421

Why Recon blocked this

Trust decision
BLOCK
Policy trigger
Data handling — PII pattern in refund memo (guardrail)
Replay result
Complete chain preserved: task → tool calls → policy evaluations → approval gate → blocked execution.
Interpretation
You get a defensible story for security, support, and leadership: not “the model glitched,” but “this action was evaluated and halted under policy.”

What you should do next

Put the same visibility on your agents: live trust scoring, policy-aware execution, and replay when something breaks.