Incidents, on-call, and postmortems

Incident artifacts under pressure:

• A timeline of detection, mitigation, and recovery—with evidence links.
• Customer-facing or internal status language that is accurate and calm.
• A postmortem with root cause, contributing factors, and tracked action items—without blame theater.

Agents help organize and draft; humans decide severity, comms, and when to page.

• Multi-channel inputs (Slack, email, ticketing) can feed one narrative if you wire them carefully.
• Approvals before sending external messages or closing incidents.
• Skills can encode your org’s postmortem template and severity definitions.

1. Stabilize first—do not let drafting slow mitigation.
2. Capture raw facts with timestamps as you go (pasted logs, messages).
3. After calm returns, build the timeline from those facts only.
4. Separate facts from hypotheses in the writeup.
5. Review customer-facing text with someone who owns comms.

• Severity rubric your team already uses (or agrees to adopt).
• Access to logs and tickets agents may summarize—within policy.
• A template for postmortems and status updates.

1. Open a single working doc for the incident; avoid scattered threads as the source of truth.
2. Record customer impact and scope as soon as known.
3. Draft timeline bullets; attach links to evidence.
4. Run a blameless review; focus on systems and process.
5. File action items with owners and dates; track to completion.

• “From these messages, produce a chronological timeline with unknowns marked.”
• “Draft a status update for non-technical readers; no acronyms without expansion.”
• “List five contributing factors using the template’s categories.”

Never publish automated comms without a human who owns the customer relationship.

• Timeline matches log evidence; no invented precision.
• Stakeholders sign off on external messaging.
• Action items have owners—not a vague “we should.”

• Premature root cause before data supports it.
• Leaking internals or customer data into public updates.
• Copy-paste from chat without verifying timestamps.
• Skipping the postmortem because the fire is “over.”