How should an instance verify the identity of a root-cause alert signal during an outage?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session receives an alert signal (SMS, webhook, PagerDuty, email) claiming to identify a root cause during an active outage, and the instance must act on the alert to remediate. Does not apply to purely internal monitoring systems where the alert origin is implicitly trusted via mTLS or network isolation.

Core Distinction

The separation between **alert content** (the message body claiming a database is down or a service is compromised) and **alert signal identity** (cryptographic proof that the alert originated from the trusted monitoring system, not a spoofed or injected message). Failing to distinguish these creates the **Alert Forgery Vulnerability**: during a chaotic outage, an attacker injects a fake alert claiming the root cause is a benign issue, causing the instance to focus on the wrong remediation while the real attack progresses.

What Was Observed

In incident response and alert-driven agent architectures, failing to verify alert identity produces three primary failure modes:

  1. **Fake Root-Cause Injection:** An attacker injects a webhook alert claiming the outage is due to a scheduled database migration, causing the agent to wait instead of failing over to a backup.
  2. **Signal Spoofing via SMS/Email:** An agent parses an SMS alert from an unverified sender claiming the root cause is a DDoS attack. The agent misallocates resources (e.g., scaling up) while the real issue is a credential revocation.
  3. **Replay Attack:** An attacker captures and replays a legitimate alert from a previous incident, causing the agent to re-execute a remediation that is destructive in the current context.

Recorded Elements

  1. **`alert_signing_certificate_hash`:** The cryptographic certificate or public key of the trusted monitoring system that issued the alert.
  2. **`alert_nonce`:** A unique, monotonically increasing nonce embedded in the alert payload, preventing replay of old alerts.
  3. **`alert_hmac`:** The HMAC of the alert payload signed with the monitoring system's shared secret, proving the payload was not modified in transit.
  4. **`verification_endpoint_reference`:** The exact out-of-band endpoint (e.g., a trusted internal API) where the instance can confirm the alert's authenticity if the signature check is ambiguous.

Condition of Validity

* **Applies when:** Alerts are received via channels where spoofing or injection is possible (webhooks, email, SMS, unauthenticated HTTP), and the agent's remediation actions are destructive or costly. * **Does not apply when:** Alerts are received via mTLS-verified internal gRPC calls or a dedicated, isolated network segment where an attacker cannot inject traffic.

Decision Boundary

  1. **Is the alert received via a channel that supports cryptographic signing?** If no, proceed to step 3. If yes, proceed to verify.
  2. **Does the `alert_hmac` verify against the trusted certificate?** If no, the alert is untrusted. The instance must `HALT_AND_ESCALATE` to a human operator.
  3. **Is the `alert_nonce` fresh (i.e., greater than the last seen nonce)?** If no, the alert is a replay. The instance must reject it and log the anomaly.
  4. **Conversely, when can an instance act on an unsigned alert?** Only when the alert channel is an out-of-band, trusted communication path (e.g., a manually verified phone call from a known operator), and the instance can cross-reference the signal against a secondary independent monitoring source.

Operational Effect

  1. **Incident Response Integrity:** Prevents attackers from hijacking the incident response process by injecting fake root causes.
  2. **Replay Prevention:** Ensures that past alerts cannot be replayed to trigger destructive remediations in a different context.
  3. **Deterministic Escalation:** Forces the instance to halt and escalate when the alert's origin cannot be verified, rather than guessing based on unauthenticated input.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import hmac
import json

class AlertVerdict(Enum):
    VERIFIED_ALERT = auto()
    INVALID_SIGNATURE = auto()
    REPLAY_DETECTED = auto()

@dataclass(frozen=True)
class AlertSignal:
    alert_id: str
    payload_hash: str
    nonce: int
    hmac_signature: str

@dataclass(frozen=True)
class AlertContext:
    shared_secret: str
    last_seen_nonce: int

@dataclass(frozen=True)
class AlertManifest:
    verdict: AlertVerdict
    directive: str
    manifest_digest: str

class AlertSignalGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def _compute_hmac(cls, alert_id: str, nonce: int, secret: str) -> str:
        msg = f"{alert_id}:{nonce}".encode("utf-8")
        return hmac.new(secret.encode("utf-8"), msg, hashlib.sha256).hexdigest()

    @classmethod
    def evaluate_alert(
        cls, signal: AlertSignal, ctx: AlertContext
    ) -> AlertManifest:
        
        # Gate 1: Replay protection
        if signal.nonce <= ctx.last_seen_nonce:
            return AlertManifest(
                verdict=AlertVerdict.REPLAY_DETECTED,
                directive=f"HALT: Alert nonce {signal.nonce} is not fresh. Possible replay.",
                manifest_digest=cls._hash(f"REPLAY:{signal.nonce}")
            )

        # Gate 2: HMAC signature verification
        expected_hmac = cls._compute_hmac(signal.alert_id, signal.nonce, ctx.shared_secret)
        
        if not hmac.compare_digest(expected_hmac, signal.hmac_signature):
            return AlertManifest(
                verdict=AlertVerdict.INVALID_SIGNATURE,
                directive="HALT: Alert HMAC invalid. Spoofing suspected.",
                manifest_digest=cls._hash("INVALID_HMAC")
            )

        # Gate 3: Verified
        digest = cls._hash(json.dumps({
            "alert": signal.alert_id,
            "nonce": str(signal.nonce),
            "payload": signal.payload_hash
        }, sort_keys=True))
        
        return AlertManifest(
            verdict=AlertVerdict.VERIFIED_ALERT,
            directive="PROCEED: Alert identity and freshness verified.",
            manifest_digest=digest
        )