In lesson 3.4.6, you cleared up an incident on your own, calmly and with fixed steps. In a real emergency, it is rarely that calm. The email arrives at 8:33 a.m., the office calls because customers can't book, and three people want to help at the same time. Whether an incident is over after half an hour or after three then depends less on technical knowledge than on order: Who decides? Who talks to the office? Who investigates?
This lesson sets that order for the Kladde before it is needed: roles, severity levels, an on-call rotation that doesn't wear anyone out, prepared messages and a course of action that limits the damage first. At the end, you play through an incident as a tabletop exercise: at a table, with roles handed out and a log, without changing anything in Azure.
Three roles
For incident management, the Well-Architected Framework describes roles that make responsibility and decisions clear. For a small team like the Kladde's, three are enough:
| Role | Task | What it does not do |
|---|---|---|
| Lead | accepts the incident, sets the severity, decides on measures, keeps the log, calls for help, declares the incident over | investigate itself; whoever writes queries loses the overview |
| Communications | writes the status updates to the office and users, answers follow-up questions, keeps the rhythm of the updates | pass on guesses; only what is proven gets reported |
| Engineering | looks for the cause following the approach from 3.4.6, proposes measures, carries them out once decided | measures on its own initiative; the lead decides |
The roles are hats, not positions. In a small incident, one person wears all three. As soon as a second person joins, the first hands off engineering or the lead role, never both at once. All that matters is that every role has exactly one name at any time and that everyone knows it.
Whoever accepts the alert takes over the lead first. They can hand it off, but only explicitly: "From now on Kim leads, I'm going into engineering." If that is in the log, there is no argument later about who decided what.