Inputs
- Run and audit logs
- Workflow and credential inventory
- Downstream system records
- Incident and rollback owners
Control points
- Pause triggers and retries
- Preserve evidence
- Reconcile every side effect
- No automatic restart
Human approval gate
The business owner and technical incident owner approve reconciliation, corrective actions, residual risk, and restart conditions.
The workflow
Every step includes a check that can stop the process before risk moves downstream.
- 01
Contain execution
Pause triggers, workers, retries, schedules, and affected credentials without deleting evidence.
Gate: No new consequential action can start. - 02
Bound the incident
Identify affected runs, inputs, actions, systems, people, time window, and possible duplicate effects.
Gate: Unknown scope remains an explicit blocker. - 03
Reconstruct the event chain
Correlate model decisions, tool arguments, approvals, responses, retries, and downstream records.
Gate: Every consequential action has an evidence state. - 04
Correct and verify state
Reverse, compensate, or manually repair approved effects and validate each target system.
Gate: Business owners confirm the resulting state, not only the logs. - 05
Approve controlled restart
Fix the failure path, add regression cases, rotate access where needed, and resume gradually.
Gate: Named technical and business owners accept residual risk.
Candidates to pilot
Inclusion means relevant product shape, not measured superiority.
Sources checked
Open the original pages before relying on a time-sensitive product decision.