Agentic Restorations Matrix
How do I get back to a known-good state and not repeat this?
Filter
Layers, by what they can actually enforce
- In-agent (empty) — none
The agent is the patient, not the surgeon. Empty for recovery.
- Client-side rebuild — low-blast-radius
Operator-machine actions. Minutes. Reversible.
- Server-side restore — high-blast-radius
Target-system actions. Minutes to hours. The only way to recover from cluster-level compromise.
Showing 5 of 15.
Identity at Server-side restore
Disable old ServiceAccount, recreate from declarative source, rotate IAM keys, re-establish OIDC trust policy, re-issue SPIFFE identity, verify no inherited permissions.
Authorization at Server-side restore
Reapply RBAC, Kyverno, IAM from declarative source; audit for drift between cluster state and source.
Blast radius at Server-side restore
Restore data from immutable backups verified pre-incident, redeploy IaC, reapply NetworkPolicy and ResourceQuota.
Approval gating at Server-side restore
Re-enable branch protection (enforce_admins true), re-add CODEOWNERS, audit bypass events from incident, unfreeze deployments only after rest of recovery is verified.
Supply chain at Server-side restore
Rebuild and re-sign images, regenerate SBOMs, rotate signing key if exposed, force redeploy with new SHA pins.