Skip to content

Production incident investigation that proposes a fix

You describe a production problem in plain words and three read only helpers triage it, find the root cause in the logs and deployments, and propose a patch with a rollback. It assigns a severity and writes a report, and nothing is applied.

EngineeringWorks with Claude Code · Cursor+1Community example
Build your promptSee requirements

What it does

  • Reads error rates, deployments, logs and stack traces through read only tools
  • Works out what broke, since when and how bad
  • Finds the root cause with evidence from the logs
  • Proposes a patch as a diff plus a rollback and the risks
  • Assigns a severity and writes an incident report

Your approval boundaries

Approval required

These actions always wait for your yes:

  • Applying any patch or rollback
  • Posting the report to a team channel

You decide what happens next.

More about this workflow

This setup is for developers and small engineering teams who want fewer chores. It takes a repeat chore off your plate and hands back something you can check quickly.

First, it reads error rates, deployments, logs and stack traces through read only tools. Next, it works out what broke, since when and how bad. Then it finds the root cause with evidence from the logs. After that, it proposes a patch as a diff plus a rollback and the risks. Finally, it assigns a severity and writes an incident report. It works with your monitoring, git host and chat, each on its own login with limited access.

You get the prep work done and waiting for you. The agent stops and asks for your yes before applying any patch or rollback and posting the report to a team channel, and says plainly if a step cannot be undone.

“The agent proposes, the human decides.”
Dominik2806 Dominik2806 on GitHub · Oct 15, 2026
Before you startMonitoring · Git host accessScoped permissionsClaude Code or Cursor
Explore required tools and model recommendations

Tools and access

  • Sentry

    Handles the monitoring part of this job. Grant read-only token.

    API required: Yes. Needs an auth token from your Sentry account.

    Sign up: Sentry

  • GitHub

    Handles the git host part of this job. Grant a fine-grained token, read code and write comments.

    API required: Yes. Needs a GitHub App or a fine-grained personal access token scoped to the repos it needs.

    Sign up: Create a GitHub account

  • Slack

    Handles the chat part of this job. Grant a bot token in the channels it needs.

    API required: Yes. Needs a Slack app created in your workspace. It gets a bot token with the scopes you approve.

    Sign up: Create a Slack app

Official links only. Not sponsored, no affiliate links.

Model recommendations

Best pick

Claude Opus 5.5

Its maker points to it for long running coding work.

$4 per million input tokens, $20 per million output tokens.

Anthropic docs as of October 11, 2026

Cheaper backup

Claude Sonnet 5.5

Half the price per token and still strong for reviews and docs.

$2 per million input tokens, $10 per million output tokens.

Anthropic docs as of October 11, 2026

Our own picks. Not sponsored, no affiliate links.

Build your prompt

Add your details, then copy the prompt into your tool.

1Your details

Fill these in and the prompt updates as you type.

symptoms and start time

read only

2Your prompt

4 of 4 still empty
Fill these in before you run it: [WHAT YOU SAW: symptoms and start time] [LOG AND DEPLOY SOURCES: read only] [SEVERITY MATRIX] [REPORT FOLDER] You are the Production incident investigation that proposes a fix agent. You describe a production problem in plain words and three read only helpers triage it, find the root cause in the logs and deployments, and propose a patch with a rollback. It assigns a severity and writes a report, and nothing is applied. Use only the details filled in above. If any [BRACKETED] item is still blank or unclear, stop and ask for it first. Do not guess. What you do on your own: - Reads error rates, deployments, logs and stack traces through read only tools - Works out what broke, since when and how bad - Finds the root cause with evidence from the logs - Proposes a patch as a diff plus a rollback and the risks - Assigns a severity and writes an incident report What you must never do without a yes from a person: - Applying any patch or rollback - Posting the report to a team channel Rules: - Before any step on the list above, stop and ask. Say in plain words what you want to do, who it affects, and whether it can be undone. - If something cannot be undone, say so first, in one short line. - Write drafts, not final actions. A person sends, pays, posts, or deletes. - Keep a short log of every action you took and every source you read. - If you are unsure, ask instead of guessing.
View run instructionsPaste into: Claude Code, Cursor, Claude Desktop with MCP

Your answers stay in this browser only.

Run your workflow

Connect your tools with only the access this setup needs, then follow these steps.

Steps

Do these in order. Test on old data before it touches live work.

  1. 1Connect Sentry with its own login, not yours. Grant read-only token.
  2. 2Connect GitHub with its own login, not yours. Grant a fine-grained token, read code and write comments.
  3. 3Connect Slack with its own login, not yours. Grant a bot token in the channels it needs.
  4. 4Paste the prompt where your harness takes instructions. See the note under the Copy button.
  5. 5Do a dry run on old or test data first. Check every draft and every stop point by hand before you let it near live work.
  6. 6Read its log after the first real run. Only widen access once a week of runs looks clean.

Safeguards and trust score

The score describes this example setup’s access, approval boundaries, ability to undo changes, and scope.

Access18 / 30

Can draft things that send or spend, so it sits close to risky actions.

Human approval30 / 30

Waits for a yes on: applying any patch or rollback, posting the report to a team channel.

Undo and logs17 / 20

Leaves drafts you can throw away, with a record of what it made.

Scope16 / 20

Runs on its own login across 3 tools. Fewer connections means a smaller blast radius.

How to raise it

  • Access: Take away its ability to send, post or spend. Let it only write drafts, and have a person press send or pay from their own account +6
  • Scope: Cut it down from 3 connected tools to the 2 it needs most, each with its own limited login instead of your full account +2

Do all of these to reach 89, up from 81.

Want help getting there? Get an AI Trust Audit from Pixeldesigns

Reviewed by Trustcase (example setup). How scoring works

Embed badge

Show this trust score on your site or README. It links back here.

Trustcase trust score badge
Markdown
[![Trustcase trust score for Production incident investigation that proposes a fix](https://trustcase.dev/badge/production-incident-investigation-that-proposes-a-fix.svg)](https://trustcase.dev/use-cases/production-incident-investigation-that-proposes-a-fix)
HTML
<a href="https://trustcase.dev/use-cases/production-incident-investigation-that-proposes-a-fix"><img src="https://trustcase.dev/badge/production-incident-investigation-that-proposes-a-fix.svg" alt="Trustcase trust score for Production incident investigation that proposes a fix" height="20"></a>

More engineering workflows

  • Failed scheduled job triage with a cause label

    When a scheduled workflow starts failing, the alert opens an issue and fires a routine that reads the run log and the code it points at. It comments with the failing step and a cause, then opens a fix pull request only for a code bug.

  • Nightly flaky test fix verified by stress runs

    Once a night a bot picks one test that has flaked in two places, measures how often it fails on main, and lets a coding session try a fix on a runner that holds only read credentials. A separate job stress-runs the result in a clean checkout and opens a draft pull request for a person to review.

  • Nightly flake hunt that files one issue per test

    Each night every app's test suite runs 100 times with random seeds on spare machines, outside the normal CI path. Any test that fails some runs and passes the rest gets an issue with its failure rate, the failing seeds, the messages and the commands to reproduce it.

  • Security incident triage that recommends and records approvals

    A tier one security analyst pastes an alert or log and gets back a structured triage: incident type, severity with confidence, missing information and ordered first actions. Each action is marked safe or needing a specialist's approval, and approvals are only recorded, never carried out by the agent.

Other workflows that use the same tools

  • Ticket triage

    Support. Sorts new tickets by topic and urgency so the right person sees them first.

  • New hire checklist

    Operations. Keeps onboarding moving for each new person.

  • Standup update writer

    Operations. Pulls your tasks, comments and docs together into a quick standup update with progress and blockers. Saves the morning dig through every tool.