Agentic Restorations Matrix

NIST CSF 2.0 · Recover (RC) · 5 concerns × 3 layers

How do I get back to a known-good state and not repeat this?

Concern	In-agent advisory	Client-side deterministic	Server-side external
IdentityRotate credentials, re-issue per-agent identities, regenerate trust relationships.	empty by design(no enforcement)	1 artifactRegenerate credential file with strict ACLs, rotate OIDC client secret, re-authenticate operator host to SSO, verify ACLs survived.	1 artifactDisable old ServiceAccount, recreate from declarative source, rotate IAM keys, re-establish OIDC trust policy, re-issue SPIFFE identity, verify no inherited permissions.
AuthorizationRebuild RBAC and IAM from declarative source. Audit for drift introduced during the incident.	empty by design(no enforcement)	1 artifactRestore local hook config from VCS, verify file ownership and ACLs, reinstall pre-commit hooks, verify Claude Code is on the patched version.	2 artifactsReapply RBAC, Kyverno, IAM from declarative source; audit for drift between cluster state and source.
Blast radiusRestore data, redeploy infrastructure, rebuild from clean state.	empty by design(no enforcement)	1 artifactRebuild operator host from known-good image if untrusted, reinstall agent runtime with signature verification, re-derive sandbox profiles.	1 artifactRestore data from immutable backups verified pre-incident, redeploy IaC, reapply NetworkPolicy and ResourceQuota.
Approval gatingRe-enable branch protection, audit bypass events, harden gates that were exploited.	empty by design(no enforcement)	1 artifactRestore PreToolUse config from VCS, reapply tier definitions, re-enable Auto Mode, re-establish out-of-band channel.	2 artifactsRe-enable branch protection (enforce_admins true), re-add CODEOWNERS, audit bypass events from incident, unfreeze deployments only after rest of recovery is verified.
Supply chainRe-pin dependencies, regenerate SBOMs, re-verify signatures, rebuild from clean source.	empty by design(no enforcement)	1 artifactReinstall agent runtime with signature verification, re-pin MCP hashes from clean source, regenerate lockfiles from declared deps.	1 artifactRebuild and re-sign images, regenerate SBOMs, rotate signing key if exposed, force redeploy with new SHA pins.

Walk a row left to right and ask one question at each layer: if the agent decides to violate this concern, what stops it here? All three populated is defense in depth. Only the in-agent cell populated is an audit finding, because the model can be talked out of it.