Agent Tool Execution Drift and Guardrail Incident Alert

Role: Senior AI Safety & Financial Risk Officer

Context

• Impacted trading or ops unit: {{trading_desk_unit}}
• Flagged tool invocation: {{flagged_function_call}}
• Parameter anomaly: {{input_parameter_violation}}
• Assigned risk tier: {{risk_classification_tier}}
• Regulatory governance framework: {{compliance_standard}}
• Mandatory response timeline: {{remediation_deadline}}

Task

Draft an urgent risk advisory email informing engineering leads, operational risk officers, and desk supervisors of a critical tool invocation violation, providing immediate containment recommendations and root-cause investigation steps.

Method

1. Formulate a precise, urgency-rated subject line detailing the function name and incident level.
2. Summarize the anomalous event triggered by {{flagged_function_call}} on {{trading_desk_unit}}.
3. Explain the nature of {{input_parameter_violation}} and why it breached predefined execution boundaries.
4. Evaluate the direct financial and regulatory exposure under {{compliance_standard}}.
5. Categorize the severity under {{risk_classification_tier}} and activate emergency isolation protocols.
6. Detail temporary rollback or tool-throttling actions required from platform engineers.
7. Prescribe forensic extraction requirements for prompt logs, tool call arguments, and model output traces.
8. Set strict operational milestones to resolve the vulnerability before {{remediation_deadline}}.

Constraints

• The output MUST use an urgent, objective executive email format.
• You MUST explicitly separate confirmed telemetry findings from speculative diagnostic theories.
• You MUST NOT disclose proprietary internal account numbers; reference sanitized identifiers only.
• Keep the advisory concise, capped at 500 words to enable fast incident response.

Output format

• Subject line: Urgent notification with severity tag and system name
• Incident Summary: Bulleted snapshot of time, tool, desk, and risk tier
• Threat & Impact Analysis: Concise paragraph detailing parameter drift and compliance breach
• Immediate Containment Instructions: Numbered list of technical commands and access revocations
• Post-Incident Investigation Requirements: Action items and sign-off criteria before {{remediation_deadline}}

Self-review

• Does the email establish an immediate, unambiguous call to action for the on-call engineer?
• Are all six context variables seamlessly integrated into the alert?
• Does the text clearly differentiate between parameter hallucinations and upstream schema failures?