Skip to content

Docs

Team and Enterprise

Incidents & autonomous SRE

An incident gathers everything about one event in one place — a timeline, a commander and assignee, status and the change that may have caused it — and, when AI is enabled, an automatic investigation, a blameless postmortem, and a path to a human-approved fix.

The lifecycle

  • Incidents open from a high-severity alert or detection (or by hand) and move through open → acknowledged → mitigated → resolved. MTTA / MTTR are tracked for you.
  • Assign a commander and assignee, add notes, and watch the Recent changes panel for the mutation that lines up with the onset.

AI investigation

Moments after an incident opens, a background SRE worker investigates it read-only — searching operational memory for prior occurrences and the audit log for relevant activity — and writes a Markdown triage report onto the timeline: a summary, the likely cause, prior occurrences, and suggested next steps. When the incident is resolved it writes a postmortem the same way.

Investigation and postmortem are read-only and grounded in your real history — they never change infrastructure. Both need AI enabled; without it, incidents work exactly as before, minus the AI cards.

Human-approved remediation

When you understand the fix, the Remediate panel runs a single workload action — restart, scale, or set-image on a Kubernetes workload. You pick the target, kind, namespace and name; it's enqueued through the governed task pipeline, so it inherits guardrails and approval and is attributed to you.

Remediation is deliberately narrow: only the three workload rollouts, never deletes or shell commands. A change a guardrail flags for approval is refused, not auto-approved — the human "approve" can't bypass policy. Offered only while the incident is still active and to operators with resource.write.

Permissions

incident.read incident.write resource.write

incident.read to view, incident.write to manage status / notes / assignment, and resource.write to remediate. The AI cards appear automatically when AI is enabled — no extra permission.