Incident Response

Workflow

1. Establish impact, start time and relevant recent changes without exposing credentials or private data.
2. Preserve evidence and prefer a reversible mitigation with a clear rollback.
3. Verify recovery using user-visible signals and keep a factual timeline.
4. Record causes supported by evidence and a small set of prevention actions; do not blame people or invent certainty.

Completion

Return the concrete result, verification evidence and any material unresolved limitation. Keep documentation proportional to the change and preserve human feedback.

Focused references

• Detailed examples: load only the section relevant to the task.

---

Canonical source: skills/team-collaboration/incident-response.md.