Building a Reg S-P incident response program for CrewAI multi-agent systems

What the amended rule asks of the program

Regulation S-P (17 CFR 248.30) was amended by final amendments published in the Federal Register on June 3, 2024. As of November 2026, the rule requires written policies that include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.

The program must contain procedures to assess the nature and scope of an incident, and to identify the customer information systems and types of customer information that may have been accessed or used without authorization. It must also include procedures to contain and control the incident to prevent further unauthorized access or use. Affected individuals must be notified when their sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Finally, covered institutions must oversee service providers through due diligence and monitoring, including to ensure the customer notification requirements are satisfied.

None of this changes for agents. What changes is where the evidence comes from. Timing and retention parameters belong in the written program as set by counsel. The engineering task is to make sure the system can produce what the program specifies.

Define events, incidents and detection points

Traditional runbooks rarely say what an incident is in an agent workflow. Write it down. An event is any observable occurrence in the system, such as a tool call that retrieves a customer record. An incident is an event or sequence of events involving unauthorized access to or use of customer information. That distinction triggers the response program, so agree on it before anything is deployed.

Useful incident categories for agent workflows include: a tool call outside the scope of the assigned task; customer information sent to a destination that is not approved; a handoff that passes nonpublic personal information to an agent without a need for it; retrieval volume well above the norm for a task; and agent behavior that departs from its instructions after untrusted input. Add severity criteria and indicators for near-misses, so that a blocked attempt is recorded and reviewed rather than discarded.

Detection needs four points in the path: before a tool call executes, on the tool response, at each agent handoff, and on requests sent to an external model. Telemetry that exists only after a run completes can describe an incident but cannot limit one. Do not run agents without telemetry, and run drills that exercise detection, response, recovery and reporting so the team has practiced the sequence.

Specify runtime containment per detection point

Containment under the rule means preventing further unauthorized access or use. In an agent system that is only reliable if the control sits in the execution path and is enforced at runtime, not reviewed after the fact. Decide in advance which action applies at each detection point and who owns the decision.

There are tradeoffs. Aggressive blocking interrupts legitimate work and produces false positives. Human approval adds latency and needs a named approver with authority. Redaction can break a downstream task that needs the field. Tune these per task and data type, and review the outcomes during drills.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, at the level of individual interactions and tool calls. The actions below are the ones it applies. Whatever mechanism you use, the decision vocabulary is a useful template.

• Allow: The call is within task scope and policy. It proceeds, and the decision is recorded.
• Redact: Customer information is removed or masked from a request or response when the task does not need it, for example before a prompt goes to an external model.
• Block: The call is stopped before data leaves the environment, such as a tool request to an unapproved destination.
• Rate limit: Retrieval volume is capped when an agent pulls records at a rate that suggests bulk access.
• Escalate for human approval: The call is held until a named approver decides, which suits high-sensitivity actions and ambiguous cases.

Capture the evidence needed to scope and defend decisions

Scope assessment and notification decisions both rest on one question: what customer information did the agents access or use, and was it authorized? Answering it requires a record for every tool call and interaction, written at the moment of enforcement. At minimum, record the agent identity, the task, the tool or model called, the destination, the data types and systems touched, the policy that applied, the decision taken, the outcome, a timestamp, and any approver. This maps directly to the requirement to identify affected systems and types of customer information.

The same records show what the AI was allowed to do and what it did. That supports internal review, regulator inquiries and service provider oversight. NIST incident handling guidance also expects each step of analysis and containment to be documented, including which systems were affected, where the incident originated and how it occurred.

Trussed produces continuous, audit-ready evidence as a by-product of enforcement. It can be deployed self-managed in the customer cloud, with configurable retention and data residency. Evidence is scoped to individual interactions and tool calls. Linking those records into a single crew run is something your team should design, for example by carrying a run identifier through the application. Set retention to meet the recordkeeping requirements in your written program.