Main site

Information TechnologyManaged AI Agents

Information Technology AI Agents,
Monitored for Security

Nestack Agent Care helps IT teams monitor, evaluate, and optimize AI agents used for helpdesk support, access requests, provisioning, and incident response — before small AI errors become security or downtime issues.

Get startedFailure modes
29failure modes
13SEV-1 failure modes
710+baseline eval cases
24/7Agent Monitoring

Scope

Information Technology AI agents we build & manage

Thirteen archetypes — from helpdesk to autonomous patching, identity lifecycle and cyber recovery.

Employee support5

  • IT helpdesk
  • Access-management
  • Asset & license management
  • Identity-lifecycle (JML)
  • SaaS-spend optimization

Infrastructure3

  • Infrastructure
  • Network-operations
  • Change-management

Security & recovery5

  • Security-alert triage
  • Patch-management
  • Endpoint-remediation
  • Phishing-response
  • Backup & cyber-recovery

Observability

What we make observable

Every IT agent session is traced across ten layers — what we capture and the evidence we keep.

  1. Evidence we keep
    Goalconstraintsapproval requirement
  2. Evidence we keep
    Sourceversiontimestamprelevancecitation
  3. Evidence we keep
    Planned sequenceactual sequenceworkflow status
  4. Evidence we keep
    Task statusresultretryfailure reason
  5. Evidence we keep
    Tool nameversioninputoutputpermissionresult
  6. Evidence we keep
    Model/versioninput/outputtoken usagelatencycost
  7. Evidence we keep
    Evaluation typemetricthresholdresult
  8. Evidence we keep
    Guardrail targettriggeractionenforcement result
  9. Evidence we keep
    Reviewerdecisioncorrectionreason
  10. Evidence we keep
    Outcome statusbusiness resultlinked trace

Catalog

Failure modes

Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.

Nothing on this page matches that. Try a layer (tool, retrieval, guardrail), a code, or a severity.

0 documented↑↓ move · ↵ open · ⌘↵ filter matrix
29 documented · select a cell to filter
2
8
8
8
12
11
16
15
5
3
ITD-01Social-engineered resets and MFA changesSEV-1
ITD-02Insecure configuration guidance — open ports, weak TLS, permissive IAMSEV-1
ITD-03Phishing-triage misses — malicious mail marked benignSEV-1
ITD-04Access-grant errors — over-provisioning, orphaned accountsSEV-1
ITD-05Stale runbooks — outdated procedures confidently appliedSEV-2
ITD-06Ticket-data exposure — credentials and PII inside tickets surfacing broadlySEV-2
ITD-07Injection via tickets, logs and alert payloadsSEV-1
ITD-08Alert-triage suppression — true-positive security alerts auto-closed as noiseSEV-1
ITD-09Change-management misadvice — patches without windows, rollbacks or commsSEV-2
ITD-10Shadow-SaaS approval slippage — unvetted tools cleared outside security reviewSEV-2
ITD-11Asset and license misstatement — wrong counts in audits and renewalsSEV-2
ITD-12Backup-restore misguidance — wrong restore points, untested paths stated as verifiedSEV-1
ITD-13Autonomous destructive remediation — agent takes irreversible action to “fix” a problemSEV-1
ITD-14Agent-to-agent privilege escalation — a low-privilege agent recruits or inherits higher rightsSEV-1
ITD-15Stolen or abused agent OAuth tokens — delegated access reused to hit connected SaaSSEV-1
ITD-16Malicious tool / connector layer — MCP tool poisoning, rug-pull and RCE on the tool hostSEV-1
ITD-17Zero-click context exfiltration — crafted input leaks in-context data without user actionSEV-1
ITD-18Confident fabrication of policy or resolution — invented rules users act onSEV-2
ITD-19Cost and action runaway loops — retry or multi-agent loops spawn resources without capSEV-2
ITD-20Non-human-identity sprawl — orphaned “ghost” agents outliving their creatorsSEV-2
ITD-21Persistent memory / knowledge-base poisoning — planted records fire on later triggersSEV-1
ITD-22Silent model drift and regression — provider update changes behavior behind a stable endpointSEV-2
ITD-23Non-deterministic answers to identical requests — different users, different answersSEV-3
ITD-24Deflection-metric gaming — tickets closed or deflected without being resolvedSEV-3
ITD-25Agent-platform outage — vendor lock-in as a single point of failureSEV-2
ITD-26Multi-agent coordination failure — chained agents amplify single errorsSEV-2
ITD-27Lost audit attribution — shared service accounts make actions untraceableSEV-2
ITD-28Automation complacency and L1 de-skilling — eroded oversight and talent pipelineSEV-3
ITD-29Hallucinated write-back — plausible-but-wrong data written into CMDB and knowledge basesSEV-2

Guardrails

Critical guardrails for IT agents

Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.

GR-01No credential reset without verified requester identityOverride defined

  1. Target

    Password resets, MFA changes, recovery-code issuance and session revocations at the service desk.

  2. Trigger

    A reset or MFA change requested by chat, email, ticket or voice.

  3. Action — enforced

    Platform holds the change, forces step-up verification against registered factors, and alerts the account owner on every attempt.

  4. Human override

    Service-desk supervisor via completed step-up verification recorded on the ticket.

Logged evidenceticket id · account id · verification method and result · requester channel · change timestamp

GR-02No cross-scope context exposure from tickets or sessionsNo override

  1. Target

    Ticket bodies, credentials, PII and session context scoped to requester and assigned technicians.

  2. Trigger

    Any output or retrieval carrying context to a party outside the record’s access scope.

  3. Action — enforced

    Platform blocks the disclosure, redacts credentials and PII from indexes, and serves only records the requester may see.

  4. Human override

    None — cannot be overridden in session

Logged evidencerecord id · requester identity · blocked content hash · scope rule · timestamp

GR-03No instruction embedded in tickets, logs or alerts executedNo override

  1. Target

    Ticket text, log lines, alert payloads and attachments ingested by triage and remediation agents.

  2. Trigger

    Directive text detected in ingested operational content, including encoded and hidden payloads.

  3. Action — enforced

    Platform treats the content as data only, quarantines the artifact, and blocks writes to memory and knowledge bases.

  4. Human override

    None — cannot be overridden in session

Logged evidenceartifact hash · payload excerpt · source system · quarantine id · scanner version · timestamp

GR-04No access grant beyond role-mapped entitlementsOverride defined

  1. Target

    Group memberships, application roles, admin rights and agent permissions across directory and SaaS estate.

  2. Trigger

    A grant request exceeding the role map or lacking an owner-approved justification.

  3. Action — enforced

    Platform blocks the grant, issues time-boxed least-privilege access instead, and queues the exception for access review.

  4. Human override

    Application owner via approved access request in the IGA workflow.

Logged evidencerequest id · requested versus granted scope · role map version · approver identity · expiry timestamp

GR-05No irreversible remediation without an approved change recordOverride defined

  1. Target

    Host reimaging, account deletion, VM termination, firewall changes and forced rollbacks by remediation agents.

  2. Trigger

    Any action lacking a rollback path or touching production without a change record.

  3. Action — enforced

    Platform blocks execution, snapshots affected state first, and requires a CAB-approved change reference before the action proceeds.

  4. Human override

    Change manager via emergency change record with post-implementation review scheduled.

Logged evidencechange id · target assets · snapshot reference · approver identity · execution and rollback timestamps

GR-06No auto-closure of security alerts as noiseOverride defined

  1. Target

    SIEM detections, phishing reports and endpoint alerts in the triage queue.

  2. Trigger

    A benign or false-positive disposition on any alert above the severity floor.

  3. Action — enforced

    Platform keeps the alert open, requires analyst review with recorded rationale, and preserves the full payload for investigation.

  4. Human override

    SOC lead via documented tuning change applied to the detection rule.

Logged evidencealert id · proposed disposition · analyst identity · rationale hash · final status · timestamp

GR-07No tool call on an unpinned connector manifestOverride defined

  1. Target

    MCP servers, connectors and tool descriptions registered for service-desk and operations agents.

  2. Trigger

    A manifest or description hash differing from the version approved at onboarding.

  3. Action — enforced

    Platform refuses the call, disables the connector fleet-wide, and requires security re-approval of the changed manifest.

  4. Human override

    Security architecture via re-approval and hash pinning in the connector registry.

Logged evidenceconnector id · approved hash · observed hash · disable timestamp · re-approval record

GR-08No delegated token use outside its origin scopeOverride defined

  1. Target

    Agent OAuth tokens, service accounts and non-human identities connected to SaaS and infrastructure.

  2. Trigger

    A token exercised from a new client, scope or resource outside its issuance record.

  3. Action — enforced

    Platform revokes the token, expires ownerless identities on schedule, and reissues least-privilege credentials bound to a named owner.

  4. Human override

    Identity governance lead via re-issuance with documented owner and scope.

Logged evidencetoken id · issuance scope · observed use · revocation timestamp · new owner identity

GR-09No configuration change below the hardening baselineOverride defined

  1. Target

    Firewall rules, TLS settings, IAM policies and patch configurations advised or applied by agents.

  2. Trigger

    A recommended or executed setting weaker than the CIS-aligned baseline for that asset.

  3. Action — enforced

    Platform blocks the change, substitutes the baseline-compliant setting, and schedules it inside an approved maintenance window.

  4. Human override

    Security architect via documented risk acceptance with compensating control and expiry.

Logged evidenceasset id · proposed versus baseline setting · policy version · window reference · approver identity

GR-10No restore guidance from untested restore pointsOverride defined

  1. Target

    Backup catalogs, restore runbooks and recovery-time answers during incidents and DR tests.

  2. Trigger

    A restore path or point stated as verified without a logged test result.

  3. Action — enforced

    Platform withholds the claim, cites the last verified test with its date, and flags untested paths to the backup owner.

  4. Human override

    Backup administrator via logged restore test validating the cited point.

Logged evidencerestore point id · last test date and result · runbook version · incident id · owner notification

Oversight

Human review — triggers, decisions and evidence

When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.

  • ConfidenceLow-confidence alert triage
  • Financial impactLicence or asset commitment
  • Identity / change riskReset or MFA change
  • Irreversible actionAccess grant or remediation
  • Policy riskChange-window conflict
  • Safety controlGuardrail override
  • Quality failureFailed critical evaluation
Humanreviewnamed reviewer
  • Revieweridentity + role
  • Decisionapprove / reject / amend
  • Correctionwhat changed
  • Escalationwho, why and severity
  • Final outcomereleased / blocked / returned for rework

7 triggers · any one halts the agent

1 record · 5 fields, every time

Compliance

Regulatory mapping

  • 04 Task
  • 05 Tool
  • 06 LLM
  • 07 Evaluation
  • 08 Guardrail

Identity security

Password resets and MFA changes are the top social-engineering target in every breach report.

Lifecycle layer:04 Task · 05 Tool · 08 Guardrail

  • ITD-01

Evaluations

Baseline evaluation suite — in detail

Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.

Detailed case sets
31
Failure modes covered
29
Retired & rotated / quarter
10%
Audit-ready scorecard
Monthly

Output evaluation3 suites · 190 cases

100 casesPhishing-triage recallcatches ITD-03
50 casesAlert-triage setcatches ITD-08
40 casesRecovery-guidance setcatches ITD-12

Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.

  1. Department lead review

    For applicable high-risk agents, the client’s designated department leader reviews the evaluation criteria and pass thresholds before baseline approval.

  2. Test-case rotation

    Evaluation cases are refreshed regularly to reduce memorisation and maintain reliable performance measurement.

  3. Scorecard integration

    Scorecards track results against the approved baseline and flag material declines for review and escalation.

  4. Department-specific extensions

    Where included in scope, evaluations may be expanded using approved workflows, tools, templates, policies, and incident history.

Monitoring

Change-aware monitoring

When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.

Version changes by layer
01AgentAgent changed in week 5
02PromptPrompt changed in week 3Prompt changed in week 9
03ModelModel changed in week 8Model changed in week 10
04ToolTool changed in week 7Tool changed in week 12
05Knowledge-baseKnowledge-base changed in week 4
06GuardrailGuardrail changed in week 6
07Eval-suiteEval-suite changed in week 11
Triage-accuracy rate92–100%
  • Week 1 · 97.9%
  • Week 2 · 97.8%
  • Week 3 · 98.0%
  • Week 4 · 97.9%
  • Week 5 · 98.1%
  • Week 6 · 97.9%
  • Week 7 · 98.0%
  • Week 8 · 93.6%
  • Week 9 · 93.4%
  • Week 10 · 97.9%
  • Week 11 · 98.0%
  • Week 12 · 98.1%

Week readouthover or select

Week 8of 12

  • 03Modelopus 4.6 · 0612

93.6%Triage-accuracy rate

  • 7 layers stamped on every run · 12-week window
  • Catches ITD-22 · silent model drift and regression

Something missing?

Don’t see your agent’s issue here?

Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.

Report an agent issue

Tell us what you’re seeing

The more specific, the faster we can reproduce it. Playbook: Information Technology

We reply within one business day.

See pricing

No commitment. Even if you never become a client, we’ll tell you what we think is happening.

Process

Universal incident runbook

Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.

  • SEV-1 Critical
  • SEV-2 Major
  • SEV-3 Moderate
  • SEV-4 Minor
STEP 01

Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.

Cost control

Keep information technology AI agent costs under control

Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.

We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.

Running information technology AI agents in production?

Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.

Get free assessmentSee pricing →

Loading open times…

Open times

Select an available date above to view open 45-minute times from our calendar.