Documentation is a message to the teammate who arrives during the incident.
Write for a capable reader with little context and no spare attention.
Interpretation
Incident documentation is used under pressure, often by someone who did not build the system. Lead with recognition, safe first actions, decision points, and escalation. Theory can follow. Test the runbook in calm conditions so it becomes a trusted tool instead of a ceremonial document.
Practice
- Start with symptoms, impact, and safe checks.
- Include commands with expected output and rollback.
- Exercise runbooks during game days.
Anti-pattern
A ten-page architecture essay with no instruction for stopping user impact.