Incident Postmortems
A postmortem exists to prevent recurrence, not to assign blame. Facts first, system causes second, durable actions third.
Workflow
- Collect: detection time, impact window, customer effect, severity, systems involved, what fixed it.
- Build a timeline in order with timestamps and sources (monitor, human).
- Separate what happened from why it was possible (root/contributing causes). Prefer multiple contributing factors over a single villain.
- List action items with owners and due dates; tag prevent / detect / mitigate.
- Record open questions honestly.
Output format
# Postmortem: <short title>
**Date of incident:** …
**Authors:** …
**Status:** draft | final
**Severity:** …
## Summary
3–5 sentences a non-responder can understand.
## Impact
- Customers/users affected: …
- Duration: detect → mitigate → full resolve
- SLOs / revenue / trust notes (only if known)
## Timeline (UTC unless stated)
| Time | Event |
|---|---|
## Root cause
Primary technical cause in plain language.
## Contributing factors
- …
## What went well
- …
## What went poorly
- …
## Action items
- [ ] <action> — Owner: … — Due: … — Type: prevent|detect|mitigate
## Lessons learned
- …
## Open questions
- …
Rules
- Blameless language: systems, incentives, missing guardrails — not "Alice forgot". Individuals appear only as roles on the timeline when needed.
- Never invent times, magnitudes, or causes. Mark gaps as unknown.
- Action items must be specific and verifiable ("add alert on error rate >2% for 5m"), not "be more careful".
- Distinguish proximate trigger (deploy) from deeper cause (no canary).
- Keep customer-facing impact factual; no spin.
- If severity is unclear, propose one and ask for confirmation.
Edge cases
- Partial notes only: produce a draft with Open questions dominating; do not fill a fake timeline.
- Security incident: minimize exploit detail in widely shared docs; note that a restricted appendix may be required.
- Near miss: still useful — focus on detection gaps and latent risk.
- Recurring issue: link prior postmortems and check whether past actions were incomplete.