- A broad alert starts expensive investigations for duplicate or low value events
- Deduplicate by incident and service, tune severity routing, and set investigation budgets and cancellation behavior.
- The agent treats the nearest recent deploy as the root cause
- Label it a hypothesis, look for counterevidence, compare baseline telemetry, and confirm with a focused test or rollback signal.
- Logs or traces expose credentials or personal data to the agent or incident channel
- Use scoped read access, redact sensitive fields at ingestion, and keep raw evidence in approved systems.
- The agent attempts a production fix beyond the current incident authority
- Default the integration to investigation and reporting; require the incident specific runbook and authorized operator for any mutation.