---
id: procedures.incident
type: procedure
layer: L4
title: Incident response
authority: approved
owner: platform
status: approved
durability: operational
classification: internal
canonical_source: true
updated: 2026-08-01T00:00:00Z
references: [knowledge.architecture, policies.change-management]
applies_to: [oncall]
---

1. Declare the incident before investigating. A silent incident is a longer one.
2. Stabilise first, diagnose second. Roll back rather than roll forward.
3. Record what you did as you do it — the timeline is the postmortem.
4. Write the decision record before closing the incident.