scriptedalchemy/agent-bundle/incident-triage

Incident triage

Required resources

• Follow the triage runbook for the first 30 minutes.
• Record the handoff with the incident update template.

Workflow

1. Establish impact: affected users, services, regions, start time, and the

strongest known symptom. Separate observed facts from hypotheses.

1. Preserve evidence before changing the system: relevant request IDs, logs,

metrics, deploys, feature flags, and dependency health.

1. Choose the smallest reversible containment action. State its expected signal

and rollback condition before executing it.

1. Re-evaluate impact after containment. Escalate when severity, ownership, or

blast radius remains uncertain.

1. Produce an incident update with timeline, current impact, actions, owners,

open questions, and the next update time.

Guardrails

• Never claim root cause from correlation alone.
• Never expose credentials, customer payloads, or private identifiers.
• Never make a destructive or irreversible change without explicit authority.