Federal Guidance on AI Agent Incidents Sets No Retention Period for the Evidence It Asks You to Keep
By Frank Balonis, Chief Information Security Officer and Senior Vice president of Operations, Kiteworks
Federal guidance on artificial intelligence (AI) agent incidents tells organizations to preserve the evidence and to rebuild the compromised environment, and it does not say which comes first. Rebuild first and you have erased what you were told to keep.
NIST, the NSA and CISA published Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation on October 16, 2026. It sets out 10 voluntary practices across five stages, from prepare to report. Its primary audience is organizations that train or evaluate highly capable agents on long tasks with limited human supervision, though it says the practices may also apply to deployers. In Practice 5, it asks responders to preserve model weights, sandbox and network logs, and rejected tool calls. In Practice 6, it asks them to revoke credentials the agent touched and to rebuild environments that may be compromised.
The vocabulary is new, since the document says “SI agents” where most of us say “AI agents.” The dilemma is old. Every responder has stood over a compromised system and weighed wiping it against keeping it for the investigators. What is new is the evidence. It includes the agent’s own reasoning traces, and the document leaves the sequencing to the response team.
The recovery stage adds pressure. Practice 7 asks organizations to verify and strengthen containment before resuming agent activity, including rebuilding from verified baselines. Anyone who has run an outage knows the pull of that moment. The business wants the service back, the environment is dirty, and the fastest path to clean is a rebuild. Nothing in the guidance tells the person making that call to confirm first that the evidence has been copied somewhere safe, so the safe order lives or dies on what you wrote down beforehand.
Agent evidence is a governance responsibility
Do not file this under problems for frontier labs. The moment an agent holds a credential in your environment, you inherit the same evidence questions. Who authorized it? What did it touch? What can the log prove? An agent is one more identity to govern, alongside employees and contractors. An identity with no owner, no scope and no record is a finding waiting for an auditor.
The guidance defines an incident around “significant uninstructed actions.” Read that phrase as a CISO or a chief compliance officer would. Whether an action was instructed is a factual question, and only the record can answer it. One record shows an agent that weighed a control and went around it, which is a governance failure. Another shows a permission someone misconfigured, which is a hygiene failure. A regulator is likely to treat the two differently, and you can only tell them apart if you kept the trace.
The scope is wider than security teams may assume. A footnote offers “executing unauthorized financial transactions” as an example of an incident that is not necessarily a cybersecurity incident. That is a compliance event in any company that moves money, and it belongs to people who do not sit in the security operations center.
Now consider what the document cannot do for you. It says plainly that it does not constitute advice for compliance, regulatory or legal purposes, and it tells readers to confer with their own advisors. It sets no retention period for the weights, checkpoints, and logs it asks you to keep. It says nothing about litigation or legal holds. It offers no safe harbor. Those gaps are yours to fill.
Confidence is the usual substitute for evidence. In its 2026 State of AI Governance report, Schellman surveyed 525 U.S. professionals in April and May 2026. It found that 74 percent say they could pass an AI audit, while only 27 percent describe their governance as fully mature.
Both numbers are self-reported, and both measure belief. Audit-ready means you can produce the proof, not that you hold the policy. A policy that says agents must be logged and a log that survives an incident rebuild are different assets. Only one of them satisfies an assessor.
Set the preservation rules before an incident
Start by deciding the order before the incident, in writing. Evidence capture comes first, a named person owns it, and the copy lives somewhere the agent’s credentials cannot reach. The guidance itself calls for logs the agent cannot access or interfere with, and that principle should extend to the evidence copy. Rebuilding comes second. A drill will find the gaps in that sequence in an afternoon. An incident will find them in front of your regulator.
Next, set a retention period for agent evidence and let counsel override it with a hold. Logs that capture user interactions can contain personal data, so keeping everything forever is its own exposure. Keeping nothing is worse. Whether and when a duty to preserve attaches is a question for your lawyers, which is why they belong in the room when the number is chosen.
Then name the executive who answers for each agent’s conduct. If you cannot name one today, that is your first finding, and it is easier to write yourself than to receive from someone else.
Finally, run the drill an assessor would run. Pick one agent and one week. Ask your team to show who authorized it, what it touched and what the logs say, with a clock running. If the answer takes longer than a regulator would allow, you have found the problem before anyone else did.
An agent will always leave a record of what it did. Whether that record survives your own cleanup is the part you control.
Frank Balonis is the chief information security officer and senior vice president of operations at Kiteworks. He joined the company in 2003. He is a Certified Information Systems Security Professional and a U.S. Navy veteran.