---
title: "Fix the service first · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/incidents/mitigate-first
updated: 2026-10-20
licence: "All rights reserved"
---

# Fix the service first

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Incidents](https://agentwranglers.se/playbook/operations/incidents)
- Rule: Restore service first, by rolling back, failing over or turning a feature off. Find the root cause after users are safe.
- How: Keep a rollback one command away, as the [deploy rule](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/atomic-deploys-with-rollback) describes. Prefer a known safe state over a clever fix under pressure. In a suspected attack, snapshot disks and copy logs before you roll back or rebuild, as [security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents) says.
- Check: For each incident in the last quarter, the timeline shows when service was restored, before the time the root cause was found.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/incidents/mitigate-first`.

- Previous: [Keep users informed](https://agentwranglers.se/playbook/operations/incidents/status-updates)
- Next: [Keep evidence in security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents)
- [Incidents](https://agentwranglers.se/playbook/operations/incidents)