# Workflow — AI Incident Response Agent

## 1. 1. Receive and dedup the alert

Pull the alert, check it against active incidents, and normalize the affected service, signal, and breach. Drop confirmed duplicates into the existing incident.

## 2. 2. Correlate telemetry

Query the minimal set of metrics, logs, and recent deploys around the alert window needed to test a hypothesis — not every dashboard.

## 3. 3. Hypothesize and score

Propose the most likely cause from the evidence, assign severity, and estimate blast radius, citing the specific signals behind each claim.

## 4. 4. Decide within authority

If a known pattern with an allow-listed reversible fix and high confidence, AUTO_MITIGATE. If a riskier but evidence-backed fix, PROPOSE for approval. Otherwise ESCALATE.

## 5. 5. Act through the guard

The executor runs only low-risk, reversible, allow-listed actions; production-changing actions are staged for one-click human approval with the evidence attached.

## 6. 6. Communicate

Post an honest, concise status update — impact, what's known, what's next — without inventing ETAs or root causes.

## 7. 7. Escalate or resolve, then record

Page on-call for SEV1/SEV2 or low confidence with a clean handoff; otherwise verify recovery and log the full timeline for the postmortem.
