How an investigation works
TRACE is Protocol's investigation process. A person does the work, step by step, and every step is documented.
Save the evidence
Rebuild what happened
Measure how far it reached
Check the surroundings
Deliver the report
The four steps
Save the evidence
We copy the AI's activity records, and the account and tool activity around them, before anything is changed. Nothing is lost, and nothing is altered.
For your technical team. Agent logs and traces, prompts, tool-call records, identity and access logs, and scheduled jobs are copied from your systems. Each copy gets a SHA-256 fingerprint at collection, and we work from the copies.
Rebuild what happened
We work out who or what told the AI what to do, which tools and accounts it used, and what it touched.
For your technical team. We order model inputs, model outputs, and tool calls on one timeline and compare what the agent said it was doing with what its tools did. Where the two differ, we flag it.
Measure how far it reached
We find what was affected, and what the AI appears to have been trying to do.
For your technical team. We trace the data stores, services, and accounts the agent's identity touched, and compare them against its normal activity.
Check the surroundings
We examine the access, data, and connections around the AI to see whether something there made the behavior possible. Then we tell you what to fix.
For your technical team. We review the agent's permissions, tool scopes, connected data sources, saved memory, and any content it read before its behavior changed.
What we look into
We find what it left behind
Files, scheduled tasks, saved instructions, or passwords and keys that the activity left in your systems.
We measure how far it reached
The systems, data, and people the AI's actions affected.
We check what it was trying to do
Whether the activity matches what the AI was asked to do, drifted from it, or was redirected by something else.
We work out who needs to know
Who relied on the AI's output, and what notification duties may apply. We map these for your lawyers to review.
We look for what could happen again
The access, data, and connections that made this possible and may still be in place.
What you receive
A written report, in plain language.
- A timeline of what happened
- A map of what was affected
- Our assessment of what the AI was trying to do
- What in your setup allowed it
- Who may need to be told, for your lawyers to review
- A ranked list of fixes
- A record of how the evidence was handled, built to support legal or regulatory review
What a reconstruction looks likeIllustrative example. Not a real client.
What you are looking at is an illustrative example. An AI agent receives a request and opens a web page linked in it. Hidden text on that page tells the agent to ignore its instructions, and the agent then tries to reach payment credentials until a person halts it. Protocol rebuilds a record like this from your own systems, then works out what happened, how far it reached, and what made it possible.
For your technical team
Evidence we collect: agent logs and traces, tool-call records, identity and access activity, scheduled jobs, stored memory and instructions, and any credentials in scope.
We work read-only where possible and use proven open-source and commercial forensic tools. The method is ours. TRACE stands for Threat Residue and Agentic Cognitive Evaluation.
What TRACE is not
TRACE does not replace your security tools. It works alongside them.
It is not legal advice. We map who may need to be told and by when. Your lawyers decide how to apply it.
Want to talk it through?
Describe what you are seeing. We will tell you whether an investigation makes sense.