---
title: "Incidents · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/incidents
updated: 2026-10-20
licence: "All rights reserved"
---

# Incidents

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> When users are hurt, declare an incident, give people clear roles, keep users informed, and learn from it without blame.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/incidents`.

## Required

- [Declare incidents early](https://agentwranglers.se/playbook/operations/incidents/declare-incidents): Declare an incident as soon as users are affected or might be, and write down when and why.
- [Keep users informed](https://agentwranglers.se/playbook/operations/incidents/status-updates): Tell users what is broken, what they can do and when the next update comes, on a status page hosted apart from the service.
- [Keep evidence in security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents): When an incident may be an attack or a data leak, keep evidence before you clean up, and know who you must tell.
- [Learn without blame](https://agentwranglers.se/playbook/operations/incidents/blameless-postmortems): After every serious incident, such as every SEV1 and SEV2, write a short review without blame, with actions that have owners and dates.

## Recommended

- [Rank incidents on a fixed scale](https://agentwranglers.se/playbook/operations/incidents/incident-severity): Give every incident a severity from a short written scale. The severity decides who joins, how often users hear from you and whether a review follows.
- [Give each incident clear roles](https://agentwranglers.se/playbook/operations/incidents/incident-roles): Give every incident a lead who coordinates, separate from the people fixing it, and a person who updates users.
- [Fix the service first](https://agentwranglers.se/playbook/operations/incidents/mitigate-first): Restore service first, by rolling back, failing over or turning a feature off. Find the root cause after users are safe.

- Previous: [Alerts and on-call](https://agentwranglers.se/playbook/operations/alerts-and-on-call)
- Next: [Running the service](https://agentwranglers.se/playbook/operations/running-the-service)
- [All chapters](https://agentwranglers.se/playbook/operations)