# Setup guide — AI Incident Response Agent

## 1. Install and connect observability

Install the agent and connect it (read-only) to your metrics, logs, and deploy systems.

```
pipx install incident-agent
incident-agent connect --metrics prometheus --logs loki --deploys github
incident-agent doctor   # verifies read access + paging webhook
```

## 2. Set action authority and caps

Define what the agent may do autonomously. Everything else is propose-only. These limits are enforced outside the model.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
PAGER_WEBHOOK=...
MAX_TOOL_CALLS=8
AUTO_SCALE_CAP=2x
MODE=copilot   # copilot (propose) | responder (auto low-risk)
```

## 3. Allow-list safe runbook actions

Only reversible, low-blast-radius actions belong here. Risky actions stay approval-gated.

```
# .incident.yml
autonomous_actions:
  - restart_stateless_pod
  - clear_cache
  - scale_up_within_cap
  - silence_known_false_alert
require_approval:
  - rollback_deploy
  - scale_down
  - shift_traffic
always_escalate: [ "sev1", "data_layer", "security" ]
```

## 4. Replay a past incident

Validate the agent's reasoning and proposed actions against a known incident before going live.

```
incident-agent replay --incident 2026-05-INC-204 --explain
# prints severity, hypothesis, evidence, proposed actions, status update
```

## 5. Wire it to your alerting

Route alerts to the agent as a first responder. Start in copilot mode (proposes only), then enable responder mode for allow-listed actions once trust is built.

```
# Alertmanager receiver -> POST https://your-host/incident/alert (HMAC)
# Promote MODE=responder after reviewing a few weeks of proposals
```
