Triage

Turn a noisy report into an actionable next step. Establish impact and evidence before assigning urgency or prescribing a production action.

Process

1. Capture expected vs observed behavior, affected users/data, onset, environment/revision and reproduction or traces. Note recent changes without assuming causation.
2. Assess blast radius, severity, duration and trajectory with the organization's incident scheme if one exists. Separate confirmed impact from plausible exposure and unknowns.
3. Look for reversible containment that reduces ongoing harm. Verify prerequisites, user authorization and operational rules before touching live state; read-only checks and preparation can proceed meanwhile.
4. If mitigation is authorized, apply it and verify health improved, recording the before/after signal and rollback condition. Otherwise report containment as pending or blocked.
5. Route the remaining problem: flow-diagnose for unknown cause, flow-work for a bounded understood fix, flow-plan for broader dependent work. A fix-now or later call needs a reason, owner or next action where known, and the evidence needed to resume.