AI Incident Response Runbook Builder

# AI Incident Response Runbook - Your Company

## 1) Scope
- Protected workflow: Customer support copilot
- Incident threshold: SEV-2
- Severity definition: Partial degradation with meaningful business impact. Fast containment required.

## 2) Ownership and Escalation
- On-call owner: AI Platform On-Call
- Escalation SLA: 20 minutes
- Status update cadence: every 30 minutes

## 3) First 15 Minutes Checklist
1. Confirm incident scope, affected user segments, and first observed timestamp.
2. Freeze high-risk deployments and model routing changes.
3. Capture baseline metrics: error rate, latency p95, and cost spike indicators.
4. Assign commander, comms owner, and remediation owner.

## 4) Containment Actions
- Activate fallback model/provider if primary path is unstable.
- Reduce prompt complexity and disable non-essential post-processing.
- Enforce traffic shaping or feature flag rollback to limit blast radius.

## 5) Communication Template
- Incident: [title]
- Severity: [SEV level]
- Impact: [user/business impact summary]
- Current mitigation: [what changed and expected recovery window]
- Next update ETA: [time]

## 6) Recovery Exit Criteria
- Error rate and latency return to defined SLO range.
- Cost anomaly is contained and monitored for one full update cycle.
- Root cause hypothesis documented with owner and due date.

## 7) Post-Incident Follow-Up
- Publish postmortem in 48 hours with timeline, root cause, and controls.
- Add regression tests or synthetic checks for the failure mode.
- Update this runbook and incident alert thresholds.