latent-sre/save-toolkit/akamai-edge

Akamai edge — triage, delivery config, RUM

We are Akamai customers, not Akamai operators: our lane is our properties' configuration, our security policies, and the evidence the portal and DataStream 2 expose. The edge network itself is Akamai's platform — a suspected platform-wide Akamai problem is an escalation to Akamai support with evidence, not something to debug past the portal.

The first question: which side of the edge?

Establish which parts of the request path were exercised: client/DNS/TLS, edge/cache/WAF, and origin. Not every request reaches the origin; a cache hit can be served at the edge. Decode any Reference #… promptly while its edge logs remain available. Use edge triage for the matching diagnostics, property-specific debug-header mechanism, DataStream 2 fields and coverage limits, and offload reports.

Edge-side evidence (WAF deny, cache misconfiguration, edge 5xx) stays in this skill's lanes. Route origin-side findings through Handoffs.

Three lanes, three authority postures

• Triage is read-only, portal-first. Edge Diagnostics, Web Security Analytics, Reporting, and

DataStream 2 queries change nothing. Production debug-header requests stay recommend-for-human whatever tools the invoking lane holds; the human runs them with their own debug token. Other observations, including selected DNS reads, require the invoking agent's granted, scoped, output-protected read path.

• Delivery config is change-managed work. A property version edit is Tier 1 (prepare); any

activation — staging included — is a live change with an approval gate and a named, proven rollback or recovery path. Production activation additionally runs through production-change-gate with a human release owner.

• WAF policy changes are security changes. Evidence of a false positive goes to the human

security policy owner with the sampled requests attached; this fleet never loosens a protection itself.

Read the reference before acting

Handoffs

The responder with incident-investigation retains the overall live investigation. A dispatched sre-assistant may follow origin-side evidence (edge→origin errors, healthy edge with slow turnaround) within its assigned question, targets and access; return the leg finding, exact source, timestamps, alternatives and gaps to its invoking caller. A related lead does not grant new access or transfer incident ownership. Origin leg outside an incident: pcf-ops or gcp-ops for the origin app, obs-traces or obs-metrics for origin latency. A recurring query, missing alert, or detection gap goes to observability-engineer. For a proposed property change, send the human release owner the prepared version and property change packet. New durable operational facts route to scribe through the operational-learning disposition path.