An AI Incident Plan Needs a Named Decision Owner

On October 28, 2026, Skadden’s Decrypted podcast published an episode on responding to an AI-agent attack, featuring Commvault Chief Legal and Trust Officer Danielle Sheer. The episode uses a hypothetical incident to examine containment, evidence, escalation and board oversight.

The useful shift is from asking what an agent knows to asking what it is authorized to do—and who can stop it. That makes governance operational: define consequential-action boundaries, name who owns the trade-off, preserve evidence, and decide what conditions must be met before work resumes.

The discussion also makes a case for targeted human judgment rather than human approval of every step. My caution: a tabletop clarifies responsibilities, but it does not prove that permissions, logs or shutdown procedures work in practice. Those need testing.

Which decision right is easiest to leave vague in an agent incident plan—and how would you make it explicit before a crisis?