Mistral Incident Response

Overview

Restore safety before throughput. Classify, stop amplification, protect evidence, reconcile ambiguous work, and use the smallest reversible containment action.

Prerequisites

• An incident commander, severity policy, inventory, and current runbooks.
• Content-free telemetry, deployment controls, rotation, and admin/status evidence.
• Communication, evidence-retention, and post-incident owners.

Current Contract

Provider, account, app, and data incidents differ. Workspace caps can suspend access; Files, Batch, Conversations, Agents, and Workflows may outlive a failed request and need reconciliation.

Authentication

Never paste keys into incident channels. On exposure, revoke through approved admin, rotate consumers, and verify old-key denial without displaying values.