53. Operational, security, privacy, financial, and safety incident response

An embodied-machine platform can experience conventional service incidents and incidents that touch private location, physical safety, auctions, payments, vehicle control, telemetry provenance, youth protection, or external provider effects. Incident response is therefore typed casework with scoped emergency powers, evidence preservation, reconciliation, notification assessment, and corrective action.

#53.1 Incident declaration and classification

IncidentCase binds incident kinds, severity, affected subjects and tenants, occurrence interval, discovery time, reporter, accountable principal, incident commander, response team, evidence holds, external effects, policy lock, and projected state. Detection is not confirmation. False positives and merged incidents remain recorded outcomes.

#53.2 Severity, command, and response team

Severity and command changes append through authorized transitions with evidence. Incident roles are time-bound functional assignments; response-team membership is not tenant-wide access. Safety, privacy, security, financial, market, and communications responsibilities can have separate accountable principals under one incident commander.

#53.3 Evidence preservation and containment

IncidentTimelineEntry records actor, event kind, occurrence and record times, evidence, before/after state, uncertainty, and correlations. Containment actions use exact target selectors, expiry, risk, authorization, and rollback conditions. Emergency credentials, profile freezes, connector disables, market halts, location suppression, or command fences are narrow and audited.

#53.4 Recovery and external-effect reconciliation

Recovery proves restored records/artifacts, state checkpoints, credential epochs, affected projections, provider effects, market state, accounting reservations, and safety-control separation. An unresolved payment, dispatch, title change, auction close, physical command, or disclosure remains UNKNOWN_EFFECT or OPERATOR_REQUIRED and blocks incident closure where policy requires.

#53.5 Notification assessment and communications

IncidentNotificationDecision names decider, advisor/authority assertions, audiences considered, policy lock, known-facts checkpoint, unknowns, result, reasons, deadlines or review time, and notice receipts. Results are NOTIFY, DO_NOT_NOTIFY, DEFER, or INDETERMINATE. Communication never outruns the evidence checkpoint and preserves protected investigative details.

#53.6 Post-incident review and corrective actions

PostIncidentReview binds reviewers, evidence checkpoint, root-cause findings, contributing factors, failed and successful controls, corrective actions, remaining risks, and approval. Every corrective action has owner, due state, verification method, and closure evidence. An incident may reopen by decision when new evidence or failed remediation appears.