Incident Disclosure Agent
Drafts every notification while the clock is running — and sends none of them
- 7hard rules
- Things it must never do, enforced in every run
- 6handover rules
- Conditions where it stops and gives the work to a person
- 7output fields
- A structured result, not a paragraph you have to re-read
- ≤3steps per run
- Bounded work, enforced by the runtime rather than requested in the prompt
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
In the hours after an incident, disclosure obligations run on a clock. GDPR allows 72 hours from awareness; other regimes allow less, and contracts often allow less still. Deadlines are missed not from negligence but because the people who know the obligations are the same people containing the breach.
This agent takes the facts as they stand and drafts what has to go out: the regulator notification, the customer notice, the internal brief, and a holding statement for the questions that arrive before the facts are settled. It counts each deadline from the awareness time you give it and shows what remains.
It sends nothing. Every output is a draft for a named human to approve, and that limit is enforced by the agent's permissions rather than its instructions. It also refuses to characterise what happened beyond your stated facts — writing 'no evidence of misuse' before anyone has checked is how a notification becomes a second problem.
Benefits
Drafting removed from the critical hour
Responders contain the incident; the drafts are already waiting.
72h GDPR
Deadlines visible
The 72-hour clock counted rather than remembered.
Nothing overstated under pressure
The reassuring sentence nobody can yet support is never written.
What it does
Every audience, one pass
Regulator, affected customers, internal staff, and a holding statement.
Deadlines counted, not recalled
Each obligation counted from your stated awareness time, with time remaining.
Written to your facts only
No reassurance the facts do not support. What is unconfirmed is labelled unconfirmed.
Cannot send
Drafts only. The send is a human's, enforced by permissions rather than by instruction.
Flags what only counsel can decide
Liability, admission and regulator strategy are routed, never drafted around.
What this changes
What this changes about your week
- It takes over
- Working out who must be told, by when, under which regime.
- Done today by
- Counsel and the incident lead, at the worst possible moment.
- How often
- Rare, and it decides the outcome when it happens.
- Typical manual effort
- Establishing obligations across jurisdictions is hours you do not have.
Why Cybersecurity in particular. Deadlines run in hours, not days. This is the one agent whose value is entirely in the worst week of your year.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Incident Disclosure Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3ToolsNo external tools
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output, abridged.
Input
{
"factsKnown": [
"Unauthorised access to a support database",
"Names and email addresses present"
],
"awarenessTime": "2026-09-01T08:00:00Z",
"jurisdictions": [
"EU"
],
"factsUnconfirmed": [
"Whether any records were exported"
]
}Output
{
"clock": [
{
"deadline": "2026-09-04T08:00:00Z",
"requires": "Nature of breach, categories and approximate numbers, likely consequences, measures taken.",
"obligation": "GDPR Art. 33 — supervisory authority",
"timeRemaining": "72 hours from awareness"
}
],
"disclaimer": "Drafts for review. Not legal advice. Every notification requires named human approval before release.",
"forCounsel": [
"Whether Art. 34 individual notification is triggered",
"Whether export remains unconfirmed at the point of notification"
],
"missingForCompliance": [
"Approximate number of data subjects affected — required by Art. 33(3)(a)",
"Contact point for the supervisory authority"
]
}Requirements
Integrations
No integrations required.
Before you start
- The facts as known: what happened, when awareness began, what data and how many people
- Which regimes and contracts apply
- Requires the All-Access plan or higher
Use cases
Confirmed data incident
Produce the full notification set while containment continues.
Suspected but unconfirmed
Get a holding statement that commits to nothing prematurely.
Tabletop exercises
Rehearse the disclosure path before it is needed.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Can it notify the regulator directly?
No. It drafts; a person sends. Regulatory notification is a legal act with consequences for the organisation and its officers, and it is never automated here.
Is this legal advice?
No. It organises facts against commonly cited timelines and produces drafts for review. Every incident needs counsel; the agent says so in its output and flags what only counsel can decide.
Why will it not say 'no evidence of misuse'?
Because that is a finding, not a fact, and it is usually written before anyone has checked. If your investigation establishes it, supply it as a fact and the agent will use it.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent