How to triage an AI incident

Separate outage from silent quality failure — both are incidents.

1. **Declare** severity: user impact, blast radius, data exposure risk.

2. **Capture** trace IDs, prompt/version, retrieval hits, model ID.

3. **Mitigate**: canary off, roll back model/prompt/index, or disable tool.

4. **Classify**: infra vs quality vs security (injection / leak).

5. **Verify** fix on golden tasks before full traffic.

6. **Write** a short postmortem with owner and prevention.

**Try the lesson:** `incident-response-lab` in Lane D · Glossary: [AI monitoring](/reference/ai-monitoring)