What to do when a finding lands.

• PB-POLICYIMMEDIATE

  Unauthorized network policy change

  Triggered when: A network control policy changed without a matching approval record.

  1. Compare the changed policy against the last approved version.
  2. If the change was not approved, restore the previous version.
  3. Turn on policy signing so future changes can be verified.

  Verify: The active policy matches an approved, signed version.

• PB-APP-ONBOARDSOON

  App signed by unknown publisher

  Triggered when: An app tried to join without a signature from a known publisher.

  1. Keep the app blocked until its publisher is verified.
  2. Require a signature from a publisher you trust.
  3. Re-verify the app after a valid signature is provided.

  Verify: Only apps from verified publishers can onboard.

• PB-SERVICE-UNKNOWNIMMEDIATE

  Unknown service tried to join the network

  Triggered when: A service appeared that is not in the service registry.

  1. Isolate the unknown service so it cannot serve traffic.
  2. Remove it from the service registry if it was registered.
  3. Investigate where it came from before allowing it back.

  Verify: Every live service traces to a known registered identity.

• PB-SLICE-CROSSSOON

  Traffic crossed a network slice boundary

  Triggered when: Traffic moved between network slices that should stay separate.

  1. Enable or restore the isolation policy between the slices.
  2. Audit the slice configuration to find where the boundary broke.
  3. Re-test that traffic can no longer cross the boundary.

  Verify: No traffic crosses the slice boundary in a repeat check.

• PB-MODEL-DRIFTSOON

  AI model behaviour changed from baseline

  Triggered when: The model started behaving differently from its approved baseline.

  1. Compare current model behaviour against the recorded baseline.
  2. Check whether the training data or model version changed.
  3. Roll back to the last approved version if the change was not approved.

  Verify: Model behaviour matches an approved baseline again.

• PB-EGRESSIMMEDIATE

  Data left through an unapproved destination

  Triggered when: Outbound traffic went to a destination not on the approved list.

  1. Block the unapproved destination at the egress control.
  2. Review the telemetry config to see what was sent and how much.
  3. Check whether the volume suggests routine traffic or something else.

  Verify: All outbound traffic goes only to approved destinations.

• PB-MISSING-FILESINFO

  Standard project files are missing

  Triggered when: Common project files (manifest, env example, auth config) were not found.

  1. Add the project manifest file.
  2. Add a .env.example listing required variables.
  3. Add an auth configuration file if the project needs one.

  Verify: The standard project files exist in the repository.

• PB-CRED-LEAKIMMEDIATE

  Credential found in source

  Triggered when: A credential value appears inside committed source code.

  1. Rotate the credential immediately — treat it as exposed.
  2. Remove the credential from source and use a secret store instead.
  3. Check access logs for any use of the exposed credential.

  Verify: No credentials appear in source and the exposed one is revoked.

• PB-CONTAINER-ROOTSOON

  Container running as root

  Triggered when: A container is configured to run as the root user.

  1. Update the pod spec to set a non-root user.
  2. Add a dedicated non-root user to the container image if needed.
  3. Redeploy and confirm the container runs unprivileged.

  Verify: The container runs as a non-root user in a fresh deploy.

• PB-CERT-EXPIREDSOON

  Certificate expired

  Triggered when: An active endpoint is still presenting an expired certificate.

  1. Renew the certificate with the issuing authority.
  2. Verify the full certificate chain after renewal.
  3. Review whether the expiry window could have allowed interception.

  Verify: The endpoint presents a valid certificate with a clean chain.

• PB-CLOCK-DRIFTSOON

  Time source out of sync

  Triggered when: Clocks disagree or the time source changed without a config update.

  1. Check the NTP configuration on the affected systems.
  2. Verify all systems point at the same trusted time sources.
  3. Audit the event timeline for gaps while clocks were drifting.

  Verify: All sources agree within the accepted drift threshold.

• PB-BUS-UNDECLAREDMONITOR

  Message published to undeclared topic

  Triggered when: A producer sent a message to a topic it never declared.

  1. Review the producer configuration for the undeclared topic.
  2. Check whether the publish was intentional or a config gap.
  3. Isolate the producer if the traffic was not intended.

  Verify: Every producer publishes only to declared topics.

• PB-DATA-BULKSOON

  Unusual bulk data read

  Triggered when: A principal read a large volume of records in a short window.

  1. Identify which principal ran the bulk read.
  2. Check whether the read was authorized for that principal.
  3. Review retention and export policies for the affected data.

  Verify: The bulk read is explained by an authorized job or is revoked.

• PB-DELEGATIONIMMEDIATE

  Agent delegation chain anomaly

  Triggered when: A delegated action expanded its scope, broke its chain, or ran without an authenticated chain head.

  1. Re-issue the delegation with the exact scopes the task needs.
  2. Verify every hop in the chain is authenticated and intact.
  3. Reject actions that fall outside the declared delegation scope.

  Verify: Every delegated action traces to an authenticated, intact chain within declared scope.

• PB-IDENTITYSOON

  Agent identity could not be confirmed

  Triggered when: An agent identity, credential mapping, or attestation is missing, expired, or mismatched.

  1. Check the identity registry for the agent record.
  2. Verify the credential or client id maps to a registered agent.
  3. Renew expired trust profiles; re-issue missing attestations.

  Verify: Every running agent resolves to a registered, attested identity.

• PB-SUPPLY-CHAINIMMEDIATE

  Software supply-chain drift

  Triggered when: A dependency, artifact hash, signature, or publisher differs from the approved record.

  1. Compare the observed artifact or dependency against the approved record.
  2. Block the deployment until the difference is explained.
  3. Require signed artifacts and pinned versions for future builds.

  Verify: Every deployed artifact matches a signed, approved record.

• PB-SERVICE-DISCOVERYSOON

  Unexpected service call pattern

  Triggered when: A service called outside its registered profile, crossed a boundary, or routed to an unexpected destination.

  1. Check whether the calling service is registered correctly.
  2. Verify the routing rules send calls only to expected services.
  3. Deregister services that should no longer accept calls.

  Verify: Every service call resolves through registered profiles and expected routes.

Source of truth: lib/assurance/remediation-playbook-catalog.ts. Rules link to playbooks via playbookRef — see the detection catalog.