The Problem
Pick the version that's yours.
TEAM: 2:14 AM, PagerDuty fires. A migration agent that's been running since 8 PM just exited claiming success — but the completion check is failing, ~3M rows didn't get the new status column populated. You wake up the team. You stabilise in 90 minutes. The post-mortem is Monday.
SOLO: 2:14 AM, your monitoring fires on your own phone. The overnight billing-reconciliation agent finished and reported clean, but reconciliation deltas are wrong on 47 invoices. There's no team to wake — just you, your laptop, and a stabilisation deadline before customers see it.
BOT: 2:14 AM, your auto-incident-log fires: customer-facing AI is hallucinating product SKUs at 4× normal rate on a tail of customers. No human is “woken up” — the rate-limit triggers automatically. Monday's question: was the rate-limit enough, and what changed in the model that we missed?
Three modes, one playbook: an agent caused the incident. The questions are different from a human-caused incident. The IR template needs new branches.
The Core Insight
An agent-caused incident isn't a regular incident with a different actor. The questions are different, the remediations are different, the comms shape is different. The IR playbook needs new branches.
The standard postmortem assumes a human chose poorly with imperfect information; the remediations are training, runbooks, and sometimes process. None of those apply to an agent. The agent didn't “choose poorly with imperfect information” — it followed its prompt and harness rules exactly; the failure is in the prompt, the harness, or the work-class autonomy decision. That changes what you investigate and what you fix.
The framework that works is a parallel postmortem template for agent-caused incidents, plus an IR playbook that opens with steps human-IR doesn't (freeze the class fleet-wide, replay from spans, demote on the trust ladder) before getting to the part that overlaps. The whole flow is faster and more thorough than trying to torture a human-IR template into fitting agent failures.
// across actors
TEAM: Postmortem when AI is the actor — facts, timeline, contributing factors, what changes.
SOLO: Same template, smaller blast radius. The 2am incident is yours alone; the postmortem still earns its keep.
BOT: Auto-generated incident log + a human-curated postmortem when severity warrants. Same template.