Maetra recommends that UK essential-service operators test whether they can preserve evidence of an unsuccessful attempt to stop an AI agent. The government's new agentic AI resilience factsheet, published on November 3, describes proposed future measures on security, notification, evidence preservation and incident reviews. It does not establish those agent-specific duties today. For compliance teams, the useful preparation is a rehearsal that connects an observed action to the operator's intervention and the action that followed.
The official policy paper says detailed scope and definitions will be developed with industry and oversight authorities. Its focus is loss of monitoring or control over agents within networks and information systems. Teams should track that developing scope alongside their existing incident arrangements.
What the government has proposed
The factsheet envisages four measures: technical and organizational resilience requirements, notification of other affected organizations, preservation of relevant incident information, and ministerial powers to commission technical reviews. Implementation would follow Royal Assent through secondary legislation, with consultation and Parliament's affirmative procedure. The paper explicitly limits its ambition to agentic loss of control rather than a comprehensive framework covering all AI harms.
That distinction affects the compliance work. An internal record should identify the proposal, the potentially relevant service and a person responsible for monitoring developments. It should leave unresolved applicability and implementation dates visible. Recording a proposal as an implemented obligation creates false assurance and can send engineering work toward a requirement whose scope is still being designed.
Maetra's analysis is that organizations can prepare useful operational evidence while those questions remain open. The proposed evidence-preservation direction makes a narrow exercise worthwhile: demonstrate what happened when an operator tried to regain control. The exercise described below is a preparation method, not a government checklist or a conclusion about any organization's legal duties.
Preserve the intervention as well as the agent action
A record that ends at an alert cannot explain whether containment worked. A command sent to stop a workflow is also insufficient by itself. Investigators need to distinguish the request, its acknowledgement and the subsequent observable behavior.
Consider a hypothetical service-management agent that starts changing records outside its assigned service. An operator pauses its scheduler, but a worker already running continues to use a connector. A log entry saying “agent paused” would hide the gap. A better record would show which scheduler was paused, which worker remained active, what access it retained and when its last external operation completed.
The factsheet's own example includes information about agent actions and attempts to control them. Teams should decide which reliable records their systems can actually produce. They should avoid making speculative internal reasoning a prerequisite for reconstruction. Tool requests, authorization decisions, connector responses and observed system changes can support an investigation even when a model's private reasoning is unavailable.
Rehearse one control attempt
Select one bounded workflow in a safe test environment and agree the expected containment result before starting. Give the exercise an engineering owner and a compliance evidence owner. The engineering owner establishes what the controls do; the evidence owner checks whether another reviewer can understand the result.
| Evidence to retain | Question it should answer |
|---|---|
| Workflow, worker and connector identifiers | Which parts of the system could still act? |
| Alert and intervention timestamps | When did the operator learn of the issue and respond? |
| Exact control request and acknowledgement | What was requested, and which component accepted it? |
| Subsequent action results | Did activity stop, fail or continue elsewhere? |
| Preservation location and access record | Who can retrieve the evidence without altering it? |
Use a harmless, reversible test action with a known destination. If a worker continues after a pause, preserve that result as a finding. Do not mark the exercise successful because the dashboard changed state. Agree a correction, assign an owner and repeat the test after the change.
Retention needs its own decision. Preserve the information needed to understand the incident, restrict access and apply relevant privacy and retention rules. Copying every prompt, file and credential into an incident folder can create a separate exposure. Reference protected originals where appropriate and record deliberate redactions so reviewers know what is missing.
Keep affected-party decisions traceable
The proposal also looks beyond customer notification to other organizations an agent may affect. As preparation, a service owner can map connector destinations to an operational contact and identify who would decide whether notification is needed. Actual notification duties and thresholds require assessment under the rules that apply at the time.
During the rehearsal, test whether the team can identify an affected external system from its own records. Record uncertainty if a shared connector obscures the destination or the acting identity. A contact list is useful only when the team can connect it to the operation under investigation.
This builds on the ownership questions in Maetra's NIST agent identity evidence analysis. Here the specific question is whether evidence survives an attempted intervention and supports a later review. Comply supports framework mapping, regulatory watch and evidence management; Audit supports an inspectable history. Neither replaces incident engineering or determines legal applicability.
For the next compliance review, use Maetra's framework coverage to connect one existing control to its evidence owner and latest rehearsal result. Keep the UK proposal's status separate until the consultation and implementation process establishes the applicable requirements.
Sources
- UK government, Agentic AI resilience measures, November 3, 2026. Primary policy paper. The operational rehearsal above is Maetra analysis.