AnyoneLearnAI
LevelEasyStart
Build garageTry it → read → next · ~10 min

Tutorials · Chapter D (4/4) · ~10 min

Incident response lab

Try it → see it → read → next

When AI breaks in prod — **contain**, **rollback**, or **investigate** with traces and a runbook.

On paths: Builder · Student

Try tools: Code & developers

Try yourself

Playground

Incident response desk

Contain leaks, rollback bad releases, or investigate with traces — in that priority order.

Logs show raw customer email in traces

Contain, rollback, or investigate?

Recap

What you just did

You triaged three live signals — data leak vs bad deploy vs slow tail.

Read

[Runbook](/reference/runbook) sketch

  1. Contain — stop logging secrets, disable feature flag
  2. Rollback — revert model, prompt, or index version
  3. Investigate — trace IDs, golden query replay, postmortem doc