Run an AI incident tabletop exercise

A tabletop tests decisions and coordination before a real incident removes time and certainty. The value comes from realistic injects and observed gaps, not from a polished discussion where every answer is known.

Define the measurable control

Choose a plausible scenario, business impact and exercise boundary. Assign incident command, operations, security, product, communications and legal/privacy roles. Release evidence over time, record decisions and timestamps, and end with owners and due dates. Clearly label the exercise so no one mistakes it for a real event.

The AI reliability lab makes the decision reproducible with authored data:

from reliability_cases import incident_tabletop_case

result = incident_tabletop_case()
assert len(result["injects"]) == 4
assert result["real_incident"] is False
assert result["client_notified"] is False
assert result["open_actions"] == ["validate all cache partitions"]

The fixture simulates a cross-tenant citation report, cache discovery, scope expansion and notification decision. It records containment and an unresolved partition-validation action. No real incident occurred and no client was notified.

Challenge the result

Do not make the scenario depend on secret clues only the facilitator knows. Participants should be able to request logs and tests. Include ambiguity, but evaluate the process: detection, authority, evidence preservation, containment and communication.

Keep a reviewable evidence pack:

• exercise brief and participant roles
• timed inject and decision log
• containment and recovery record
• action register with owner, due date and retest

This work aligns with the evaluation, security, cloud operations, reliability and FinOps sequence in the FDE for Professionals course. The linked course describes the learning pathway; this article’s numbers are synthetic and do not report a model, client, audit or production result.

Practice task

Write four injects for a model-version regression or tool compromise. Let another person run the timeline while you make and record the decisions.

Continue learning

This article is part of the Advanced AI reliability and assurance sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Set a rollback threshold from user-visible failures.
• Continue with Create a control-evidence matrix for a security review.

Reference: Google SRE Workbook: Incident Response.