The Day After

The Day After is a board-led, cross-sector framework for AI agent incidents, systemic contagion and trusted recovery across critical financial services. It is proposed doctrine, not enacted law or certification.

Four decision horizons organize the response: prevent unauthorized authority, detect and contain harmful execution, stabilize critical services and liquidity, and restore trusted operations with evidence.

Contagion runs through parallel failure. Firms sharing the same provider, model stack, connector or identity service can fail together, without any attacker moving between them.

A successful restore is not a trusted restore. Records, queues and customer positions must be validated from independent sources before normal authority resumes.

No publicly confirmed systemic breach of a regulated bank caused by an autonomous agent is claimed. The paper uses severe but plausible scenarios, and says so.

The framework addresses banks, insurers, payment firms, broker-dealers, asset managers, financial market infrastructures and the technology providers on which they rely. It covers legacy estates and newer digital operating platforms alike. Its unit of analysis is the critical service node: a payment service, deposit access function, securities settlement process, claims operation or custody service, mapped to every agent, machine identity, tool, provider, facility, network, power source, settlement rail and jurisdiction it depends on.

This is the same analytical pattern CABIER applies to data centers, extended from a physical site to a financial service and its dependency graph. The evidence record is expected to show source, owner, collection date, confidence, conflicts, substitutability, restoration sequence and financial impact. A dashboard that turns weak data into a precise score would contradict the paper's own evidence standard.

The paper is unusually disciplined about what has actually happened. Public incident reporting is incomplete, attribution is difficult, and many disclosures describe AI used by attackers rather than a compromised agent acting inside a bank. The authors therefore distinguish observed facts, published technical demonstrations and severe but plausible scenarios, and they do not claim a confirmed system-wide breach caused by an autonomous agent.

That restraint matters for readers. Credible control design should not depend on overstating the incident record. The international evidence base is real but general: the FSB has connected AI adoption to third-party concentration, correlated behavior, cyber exposure and data governance; the IMF has shown how concentrated payment and custody services can transmit cyber disruption into liquidity and confidence pressures. Neither provides an institution-level playbook for containing an agent with production access during a live settlement event. That is the gap the paper tries to fill.

The contagion sequence has five stages. It begins with an initiating event: a compromised agent, a poisoned instruction source, a stolen machine identity or an unsafe model update invoking a legitimate tool in an unauthorized way. The second stage is parallel failure. When several firms share the same provider, model stack, connector or identity service, the same failure appears everywhere at once rather than spreading through lateral movement.

The third stage is financial transmission. Customers and counterparties see delayed, duplicated or unverified transactions. Treasury teams cannot quickly distinguish actual outflows from queue state or reporting delay. Large depositors move funds to perceived safer institutions, payment counterparties raise intraday liquidity buffers, and collateral and settlement needs rise. The fourth stage is the confidence shock: inconsistent communications and synthetic messages push uncertainty beyond the actual loss. The fifth stage is the controlled Day After, a restricted operating state with a verified record of obligations and staged restoration under independent approval.

The mechanism is operational ambiguity plus interconnection, not magic. A cyber event becomes a liquidity and confidence event because nobody can see clean balances quickly enough to stay calm.

The first horizon is prevention: bound delegated authority. Inventory every agent, machine identity and tool path that can touch a critical service, and enforce hard limits outside the model. The evidence produced is an agent register linked to critical-service maps, with proof that the model cannot expand its own authority.

The second horizon is detection: see harmful execution early. Correlate agent reasoning traces where retained, tool calls, identity events, transaction behavior and configuration changes, and detect deviations from approved purpose and pace. The third horizon is stabilization: protect services and liquidity. Define minimum safe service modes and transaction priorities, and connect operational disruption thresholds to treasury forecasts, intraday liquidity, collateral and customer access. The fourth horizon is restoration: return only with evidence. Rebuild from known-good assets, revoke and reissue affected credentials, reconcile all transactions, and obtain independent approval before normal agent authority resumes.

The interactive simulator below lets you test how an institution's posture changes across these four horizons as detection latency, shared-provider concentration, liquidity buffers and evidence quality vary.

In the first hours, the priorities are command and containment. Establish incident command, identify affected agents and identities, impose transaction and privilege limits, and isolate compromised tools without disabling unrelated essential services. Use pre-agreed contact paths that do not rely on the affected identity or communications environment. Reconcile queues, balances, settlement positions, collateral and intraday funding needs from independent records, and give supervisors early, structured facts that include uncertainty.

Over the first day, the institution moves to restricted operations where safe. Publish time-stamped customer guidance, protect cash and essential payment access, and coordinate liquidity actions and settlement priorities with relevant authorities. One shared operational picture should span cyber, operations, legal, treasury, fraud, customer service and executive command. Model-generated summaries are not source evidence; original logs, API calls, configuration changes and approval records must be preserved.

During the recovery period, restoration is sequenced and independently approved. Rebuild from known-good assets, rotate credentials, validate model and tool versions, test data lineage and reconcile every transaction. Quantify customer harm, loss allocation, operational backlogs and control failures. Recovery is complete when essential services operate within approved tolerances and their records and control paths have been independently validated, not when a press release declares the incident closed.

The framework's seven domains join AI governance controls, IT general controls, operational resilience and financial-stability planning. The first is the service and dependency map, a live record from critical service to agent, model, tools, identity, data, provider, facility, network, power, payment rail and jurisdiction, including acquired entities and transitional platforms. The second is bounded authority: distinct short-lived identities, least privilege, purpose-bound scopes, transaction and rate limits, segregation of duties and independent deterministic approval for high-impact actions.

The third domain is governed change and supply chain: change approval, model and connector versioning, allowlists, provenance checks, staged release and rollback. The fourth is runtime detection and containment, with replayable incident traces and measured time to contain. The fifth is service continuity and liquidity, linking disruption thresholds to treasury and customer access. The sixth is trusted restoration, covering independent backups, credential rotation, queue reconciliation and independent sign-off. The seventh is sector coordination and learning: notification thresholds, cross-firm contact paths, shared indicators with safeguards, and multi-party exercises whose unresolved dependencies and retest dates reach the board.

Three incorrect assumptions recur across current practice. A model's apparent reasoning is not a security boundary; the enforceable boundary must live outside the model. A human-in-the-loop label does not prove meaningful oversight if the reviewer sees too little context or cannot halt the action. And a successful restore is not a trusted restore until records, queues and customer positions are validated from independent sources.

The paper refuses to rank continents as inherently secure or insecure. Vulnerability follows service concentration, cross-border dependencies, supervisory reach, substitutability and the capacity to preserve records and settle obligations during disruption. A regional map should be a dependency map, not a scorecard of national maturity.

In North America, the lenses are cloud and identity concentration, cross-border wholesale funding and market utilities. In Europe and the United Kingdom, DORA-regulated entities and critical ICT providers raise questions about whether registers of information reflect actual agent dependencies. In Asia Pacific, high-volume real-time payment systems ask whether firms can slow or isolate compromised automated flows without creating settlement uncertainty. In Africa and the Middle East, mobile money reach and connectivity variation ask whether incident plans work where networks are degraded. In Latin America and the Caribbean, fast payment adoption and concentrated domestic rails ask whether sector exercises include payment integrity, cash access and coordinated public communication.

The paper maps its proposals onto existing regimes rather than inventing new ones. In the United States, operational resilience practices from the OCC, Federal Reserve and FDIC aim at large and complex firms and draw on existing guidance; the Federal Reserve's SR 20-24 page was revised in June 2026, and institutions should use the current version. In the European Union, DORA applies broadly to in-scope financial entities, while Article 16 provides a simplified framework for specified categories of smaller entities, not a general exemption. CPMI-IOSCO's cyber resilience guidance for financial market infrastructures and the FSB's cyber incident response toolkit supply mature foundations for preparation, response and restoration.

Across jurisdictions, supervisors can reasonably expect a firm to identify critical services and dependencies, govern third-party and internal agents, demonstrate severe-scenario readiness, report material incidents, preserve trustworthy records and show how it restores safe operations. Expectations should scale with systemic role, service criticality, complexity and substitutability. This paper is a governance proposal, not a legal opinion.

In the first 90 days, establish an executive sponsor and board reporting line, inventory production and pilot agents, machine identities, connected tools, critical data and providers, and freeze unreviewed expansion of high-impact authority while the inventory completes. Over the next two quarters, map agents and providers to critical services and external dependencies, and define hard limits, approved tools, segregation rules, alert thresholds, incident command roles, restricted-service modes and safe restoration criteria.

Within the first year, run a cross-enterprise scenario with at least one material provider and one external infrastructure dependency, covering customer access, liquidity, settlement, records integrity, cross-border notification and recovery, then retest remediations. On an ongoing basis, review the map after acquisitions, migrations, material model or connector changes, provider changes and major incidents. The board should receive the exercise's unresolved dependencies and retest dates, not only a pass or fail score.

Useful measures connect capability to a decision. The paper lists the share of critical services with verified end-to-end dependency maps, the percentage of production agents with unique identities and approved tool scopes, time to revoke an agent credential, the fraction of high-impact actions protected by independent deterministic controls, measured time to detect and contain a simulated incident, duration until minimum service resumes, time to reconcile affected transactions, provider substitution time and customer impact by service and geography. Each indicator should carry confidence and coverage so board members can distinguish a measured control from a missing record.

At sector level, authorities and operators can track concentration in critical providers and agent platforms, the overlap of dependencies across systemically important firms, and the time required to coordinate a common response. Indicators need confidentiality, competition and privacy safeguards. The goal is to reveal common-mode exposure early enough to act, not to publish sensitive institution-level weaknesses.

Has an autonomous agent already caused a systemic bank breach? The paper does not claim one. Public reporting is incomplete and attribution is difficult, so the framework is built on severe but plausible scenarios rather than a false historical claim.

What makes an agentic incident different from a conventional cyber incident? Speed and delegation. An agent can use legitimate identity, APIs and workflow permissions to make high-impact changes faster than people can detect, authorize or reverse them, and shared providers can make several firms fail in parallel.

Why is a successful restore not enough? Restoring infrastructure does not prove that data, instruction queues and customer positions are clean and complete. Trusted restoration requires independent validation of records, credential rotation and staged approval before normal authority resumes.

Does DORA or US guidance already cover this? Existing regimes cover operational resilience, third-party oversight and incident reporting, but they do not provide an institution-level playbook for containing an agent with production access during a live liquidity event. The framework maps onto them; it does not replace them.

Is the CABIER platform mapping a claim of deployed capability? No. The paper describes a target-state mapping across TrustGraph, AssureCore, the Evidence Vault and related components. It explicitly states that not every capability is implemented, integrated or independently validated.

For the next board briefing, ask one question of each critical service: what evidence shows we can contain a compromised agent without disabling the service itself? Request the latest exercise's unresolved dependencies, the measured time to revoke an agent credential, and the reconciliation plan for queues and balances. Compare answers across services to find shared providers, scarce recovery skills and assumptions that cannot all hold during a common disruption.

Disclosure: LUMINAIRE and CABIER Consulting are affiliated platforms. This is an AI-assisted editorial synthesis of CABIER research, not independent technical assurance, legal advice, investment advice or certification. Readers should request scoped evidence before relying on any commercial capability claim.

The resilient institution is not the one that predicts every exploit. It is the one that prevents a single agent, identity, provider or stale control from taking a whole service beyond recoverable bounds. The Day After reframes recovery as a governance discipline: bounded authority, contained failure, informed liquidity action and a restoration path that can be trusted.

The practical test is not whether leaders can declare an incident closed. It is whether they can show a controlled operating state and a verified record of obligations before normal automation resumes. CABIER's strongest contribution here is connecting containment, liquidity and evidence into one testable system. Use the four horizons to structure the board conversation, use the operating sequence to rehearse the first hours, and use independent evidence to judge when restoration is real.