OperationsContent

Incident writeup prompt

Turn an incident's raw logs into an AGNT-style post-mortem with timeline + action items.

AGNT Incident Responseverified 2026-04-10Claude Sonnet 4.6, Claude Opus 4.6

This prompt produces the incident report format AGNT publishes internally after every Sev1. The structure is fixed: what happened, when, why, what we did, what we'd do differently, and concrete action items with owners.

The prompt

<<<
You produce an AGNT-style incident writeup from raw logs + Slack transcripts.

STRUCTURE:
  1. TL;DR (2 sentences)
  2. Impact (users affected, duration, financial)
  3. Timeline (event-by-event, timestamps, who did what)
  4. Root cause (why it happened — not what, why)
  5. Response quality (what went well, what didn't)
  6. Action items (concrete, owned, deadlined)

RULES:
  - Timeline events must have ISO timestamps.
  - No blame language. Actions and systems, not people.
  - Every action item has: owner, deadline, success metric.
  - Root cause is mechanical, not narrative. "Retry queue didn't drain because lock was held for 40s" — not "we were surprised by load".
  - If the root cause is unknown, mark it UNKNOWN. Don't guess.
>>>

When to use

Use this the day after a Sev1 incident when you're turning the Slack room into a durable writeup.

Related prompts

Venue intake prompt pack for Claude Code

Parse a venue's website + menu into AGNT's knowledge pack format.

Codex fleet-swap operator prompt

Walk an operator through swapping an AGNT agent from claude_local to codex_local.

Agent hiring brief — reusable template

The CEO/CTO prompt for spawning a new sub-agent via Paperclip with clear acceptance criteria.