Search articles

Search titles and article text.

Define inputs, permissions, idempotency, verification, and stop conditions for one operational capability before expanding its authority.

February 5, 20264 min read

Decide which workflow deserves an agent, where a fixed automation is sufficient, and how to measure the work left for responders.

February 4, 20264 min read

Connect on-call interruptions, specialist demand, and recovery work to a concrete capacity decision using an on-call workload worksheet.

January 29, 20265 min read

A design guide for an incident assistant that handles duplicate events, partial failures, and reviewed AI summaries across tools.

April 6, 20254 min read

A reusable prompt pattern for incident analysis, with checks for missing facts, unsafe recommendations, and unsupported certainty.

March 31, 20253 min read

Use directory purpose, mount boundaries, and read-only checks to investigate missing files, full disks, and unexpected runtime state.

March 28, 20254 min read

Measure a representative workload, identify the limiting resource, and test one reversible change instead of applying a universal sysctl recipe.

March 27, 20254 min read

Compare detection, correlation, investigation, and automation using your incidents, review costs, and failure paths.

March 24, 20253 min read

Locate the delay, choose a bounded intervention, and measure recovery quality alongside elapsed time.

March 23, 20254 min read

Use language-model assistance for evidence review, draft communication, and practice, with a clear boundary around production decisions.

March 20, 20253 min read

Decide which alerts earn an interruption using urgency, reachable authority, coverage evidence, and a practical alert acceptance record.

March 19, 20255 min read

Separate incident coordination from mitigation authority, compare competing actions, and use a worksheet that preserves decisions and verification.

October 16, 20235 min read