EcoCitizenZ
Intermediate1-2 hoursPython · Python

Operations & Incident Agent

Fast Start

What you will have in minutes

A locally running, ECZ-ID-backed agent scaffold with resolver-verifiable identity hooks, a credential manifest, and Resolver verification ready to run.

What you do first — in order

1Get starter scaffold2Install dependencies3Go to TrustOps /start4Paste credentials5Run locally6Verify via Resolver7Deploy into your environment

What comes back from TrustOps

  • Agent ECZ-ID(s)
  • Credential manifest (JSON, discovery only)
  • API keys issued in TrustOps

Success looks like

Resolver returns a resolver-verifiable state for your Agent ECZ-ID. You can share it with any party without an account.

1What This Kit Builds

An operations monitoring and incident response agent with resolver-verifiable identity chains at every decision point. This agent detects anomalies, coordinates incident response, manages escalation workflows, and produces identity-anchored post-incident reports.

2Who It Is For

Operations teams, SREs, and developers building automated incident response systems. Ideal for organisations running critical infrastructure where every response action must be traceable to a resolver-verifiable identity.

3Why ECZ-ID Matters Here

During incidents, multiple agents and humans take actions under time pressure. Without resolver-verifiable identity, post-incident review becomes forensic guesswork. ECZ-ID ensures every action in the response chain carries resolver-verifiable identity.

4Architecture

Anomaly Detection Interface

Integrates with monitoring systems to detect operational anomalies with identity context.

Incident Coordinator

Manages incident lifecycle from detection through resolution with resolver-verifiable identity at every step.

Escalation Engine

Identity-aware escalation routing that maintains provenance through every escalation level.

Response Chain Tracker

Tracks every action taken during incident response with identity-anchored provenance.

Alert Router

Routes alerts with resolver-verifiable identity context to appropriate responders and systems.

Post-Incident Reporter

Generates comprehensive post-incident reports with complete identity-anchored action logs.

5Build Steps Overview

1
Clone the operations incident starter
Pull the template with incident response scaffolding.
2
Install dependencies
Install the ECZ-ID SDK, monitoring integrations, and alerting libraries.
3
Configure monitoring sources
Connect to your monitoring and observability systems.
4
Define escalation policies
Set up escalation levels, routing rules, and response playbooks.
5
Review identity chain patterns
Understand how identity flows through the incident response chain.

Trust Map

Required Passports
ECZ-ID Business PassportAgent Credential
Recommended Passports
Cyber Resilience PassportIoT Device PassportRisk & Policy Passport
Relevant Packages
KYA Ready Pack™Critical Operator Pack
What Each Enables
ECZ-ID Business Passport: Organisation identity for operations infrastructure
Agent Credential: Verified operations agent identity for incident response
Cyber Resilience Passport: Security posture attestation for operational systems
IoT Device Passport: Identity verification for monitored devices

6TrustOps Credentialing Checkpoint

TrustOps Credentialing Checkpoint

Pause here to acquire your required ECZ-ID trust objects

This is a designed pause point in your build process. Before continuing, you need to acquire the required ECZ-ID passports and credentials from TrustOps. This midpoint credentialing approach ensures your agent is built with resolver-verifiable identity from the start—not bolted on after the fact.

Required Passports

  • ECZ-ID Business Passport
  • Agent Credential

Recommended Passports

  • Cyber Resilience Passport
  • IoT Device Passport
  • Risk & Policy Passport

Relevant Packages

KYA Ready Pack™Critical Operator Pack

What You Must Acquire in TrustOps

ECZ-ID Business Passport
Enables: Parent identity for your operations infrastructure
Agent Credential
Enables: Resolver-verifiable identity for the operations/incident agent
Cyber Resilience Passport (recommended)
Enables: Security posture verification for operational systems
Risk & Policy Passport (recommended)
Enables: Operational risk posture attestation

What You Bring Back from TrustOps

Agent ECZ-ID
Operations agent’s resolver-verifiable identity string
Operational Credential Manifest
Declared capability metadata for monitoring, escalation, and response
API Keys
Production ECZ-ID API keys for identity-anchored operations
Escalation Policy Config
Identity-aware escalation configuration

9Return and Complete Integration

With your TrustOps credentials in hand, return here to complete the final build steps.

1
Inject operational credentials
Add Agent ECZ-ID and API keys to the operations agent configuration.
2
Wire identity into monitoring
Enable identity-anchored logging for all monitoring events.
3
Configure identity-aware escalation
Set up escalation routing with resolver-verifiable identity at every level.
4
Test incident response flows
Simulate incidents in sandbox and verify the complete identity chain.
5
Validate post-incident reports
Confirm generated reports carry complete identity-anchored provenance.

10Verify Through Resolver

Verify agent identity

Query the operations agent’s ECZ-ID through Resolver.

Trace incident response

Follow a complete incident response through Resolver, verifying identity at each action.

Verify escalation chains

Confirm every escalation carried correct identity context.

Audit post-incident report

Verify the complete post-incident report through Resolver.

Verify with Resolver

11Deploy Into Your Environment

ECZ-ID-backed agents are portable. Your resolver-verifiable identity travels with your agent regardless of deployment target after TrustOps and Resolver checks. No vendor lock-in.

Cloud-native (AWS, GCP, Azure)
On-premise monitoring stacks
Kubernetes clusters
Edge compute for low-latency
Hybrid cloud
NOC/SOC environments

12Limits & Non-Claims

  • This kit does not provision credentials. All credentialing happens through TrustOps.
  • This kit does not replace your monitoring stack. It integrates with existing monitoring systems.
  • Incident detection quality depends on monitoring source quality and configuration.
  • Response actions are logged and verified but not automatically executed without configuration.
  • Post-incident reports are as complete as the identity hooks configured.

Ready to Build This Agent?

Start with the build steps above, credential through TrustOps, and deploy your resolver-verifiable agent anywhere.