Run an incident room
A shared room where the agent keeps the timeline, owners, comms and post-mortem.
An incident response workflow has one job while things are on fire: keep the truth in one place. This workflow opens a shared room where your whole response team works with the agent: it keeps the timeline, tracks who's checking what, drafts customer comms, and writes the post-mortem skeleton when it's over.
What does this workflow do?
When an incident starts, from an error spike in PostHog, a message in your incidents channel, or someone starting it by hand, the workflow opens a shared run. Everyone responding joins the same conversation. As engineers post findings, the agent maintains a timestamped timeline, flags when the room holds two contradictory beliefs, and keeps an open-questions list with owners, resurfacing anything that's gone quiet for twenty minutes.
On request it drafts comms in two registers: customer-facing status updates that are plain and honest with no root-cause guesses, and internal updates with the current hypothesis labeled as such. When you close the incident, it produces the post-mortem skeleton: full timeline, impact summary, what went well and badly in the response, and follow-up actions filed to Linear.
How does it work?
- The incident opens the room. An error spike in PostHog or a message in your incidents channel starts the run, or anyone starts it manually. The response team joins the shared conversation.
- The agent keeps the timeline. Every finding, decision and status change is logged with a timestamp as the room reports it. Contradictory beliefs get flagged, not silently overwritten.
- It tracks questions and owners. Who is checking what, what's been answered, what's gone quiet. It pulls context from Linear and GitHub: recent deploys, related issues, the last incident that looked like this.
- It drafts comms on request. Status-page updates and internal summaries, each stating when the next update comes, with that promise tracked as a deadline.
- It closes with a post-mortem skeleton. Timeline, impact, response assessment, and follow-up actions filed to Linear with owners. No blame language; systems fail, people respond.
Why a shared run instead of a Slack thread?
The Slack thread is where the incident happens; the shared run is where it stays true. In a thread, the timeline is reconstructed afterwards from scrollback by whoever drew the short straw. In the shared run, every teammate's updates land in one conversation with the agent, and the timeline, the open questions, and the comms drafts are maintained as the incident unfolds, not archaeologically. And because the workflow remembers past incidents, the next one starts with what the last one taught: PagerDuty and incident.io are deeper on paging, escalation policies and on-call management; this workflow is the room where the response itself gets coordinated and remembered.
Works with
PostHog, Slack, Linear, GitHub, Notion. Triggered by an error spike or an incidents-channel message, or started on demand.
Frequently asked questions
Who can join the incident room?
Your teammates. Everyone responding joins the same shared run in Agentwork and works with the agent in one conversation.
Does the agent diagnose the incident?
No. Engineers diagnose; the agent tracks, structures, and drafts. It surfaces context like recent deploys from GitHub and related Linear issues, and it never speculates about causes in customer-facing text.
What lands on the status page?
Nothing automatically. The agent drafts customer updates that are plain and honest, with what's affected, what you're doing, and when the next update comes. A human reviews and publishes.
What happens after the incident?
A post-mortem skeleton: full timestamped timeline, impact summary, response assessment, and follow-up actions filed to Linear with owners. The root-cause analysis stays human; the skeleton means it starts from facts.
Does it learn from past incidents?
Yes. The workflow remembers previous runs, so recurring patterns get flagged ("this looks like the March 12 incident") and response improvements stick.