Incident notices
An agent’s operator discloses an incident with a signed incident notice (Provenance notice format 0.2), pushed to Nymbrink or published in its notices feed. Nymbrink keeps one record per incident and tells each company concerned once per change.
Which incident a notice is about
- Within the standard: notices with the same started_at are the same incident. Add resolved_at to resolve it; send without it to reopen it.
- A notice that changes nothing (same state, summary, severity and affected versions) is recorded and sends nothing. One issued before the latest applied notice is recorded and not applied.
- Changing the summary, severity or affected versions is a correction: everyone told before is told again.
Experimental extension
These claims are Nymbrink’s own and not part of the Provenance standard. The 0.2 schema does not allow extra claims, so a notice using them will not pass a strict schema check, though its signature verifies. Changes are announced here at least 90 days ahead.
- incident_id — a stable id of your choosing, used instead of started_at to tie notices together.
- affected_versions — exact version strings, compared character for character with the version an agent’s passport pins its dependency on yours to. No ranges. An agent pinned to an unlisted version is not warned through that dependency; one that pins none is warned, with the uncertainty stated.
- withdrawn: true — the disclosure is withdrawn; everyone told before is told.
- context — what you say it is: incident (in actual use), research (a research or evaluation finding) or advisory (a known limitation). Every message about it uses those words. Without it, a notice means an incident, as it always has.
- customer_impact — known, unknown or not_claimed, shown as your statement.
- source_url — your own write-up or advisory, shown as your link; Nymbrink does not check it.
{
"notice": "0.2",
"id": "notice-2026-10-05-002",
"event": "incident",
"provenance_id": "provenance:domain:agent.example",
"issued_at": "2026-10-05T12:00:00Z",
"claims": {
"severity": "high",
"summary": "Prompt logs from 1 to 3 October were readable by other tenants.",
"started_at": "2026-10-01T00:00:00Z",
"incident_id": "2026-10-logs",
"affected_versions": ["2.4.0", "2.4.1"]
},
"signature": "…"
}Without signing notices, an owner or admin of the company behind the agent can make the same disclosure on Nymbrink, from the agent’s page. It is recorded as made by a signed-in member of the company, not signed with the agent’s key.
Who is told
- Companies watching your agent, and companies watching agents that declare a dependency on it, up to 6 steps — as potential exposure, never as confirmed impact.
- A company is told about a dependency route only if it may see every agent on it. Private agents are never named to anyone outside their company, and a route through one is not followed for them.
- Each company gets one alert per change, however many routes lead to it. Companies told about an incident are told when it is corrected, resolved, reopened or withdrawn, as long as they may still see your agent.
- Undeclared dependencies are not covered, and each warning says so.