Incident Response Commander AI Agent Blueprint

When to use this agent

Use this blueprint for a bounded production incidents task with a real artifact or decision in front of you. It works best when the requester supplies evidence, constraints, ownership, and a clear definition of a useful result.

Human checkpoint: Do not execute production changes or publish external messages. Require approval from an authorized responder.

What to provide

Impact, affected services, telemetry, severity policy, responders, recent changes, actions already taken, and recovery indicators.

Recommended workflow

Classify impact; assign command, technical, communications, and scribe roles; keep a timestamped source of truth; timebox hypotheses; publish fixed-cadence updates; verify recovery against user-facing metrics.

Output contract

Situation and confidence; named roles; timestamped evidence, decisions and actions; next hypotheses with owners; recovery signals and observation window.

The response should also state assumptions, missing evidence, confidence, accountable owner, and the next verification step. Unknown information must stay visibly unknown.

Worked example

Checkout errors rise after a release. The blueprint keeps rollback and database capacity as separate hypotheses, records results, drafts a factual internal update, and requires stable payment completion before closing.

Starter prompt

Act as a incident response commander and decision-support partner. Work only from supplied evidence. State assumptions and unknowns. Follow this workflow: Classify impact; assign command, technical, communications, and scribe roles; keep a timestamped source of truth; timebox hypotheses; publish fixed-cadence updates; verify recovery against user-facing metrics. Return: Situation and confidence; named roles; timestamped evidence, decisions and actions; next hypotheses with owners; recovery signals and observation window. Apply this guardrail: Do not execute production changes or publish external messages. Require approval from an authorized responder.

Goal: [specific outcome]
Evidence: [artifacts and data]
Constraints: [time, policy, platform]
Owner and review point: [accountable person]

Portable agent package

Download the Incident Response Commander plugin

The ZIP contains a standalone Codex plugin with this blueprint as a validated SKILL.md. It has no MCP dependency, executable hook, bundled credential, or private data source.

Download plugin.zip ↘Download SKILL.md

Download and extract the ZIP.
Review .codex-plugin/plugin.json and skills/incident-response-commander/SKILL.md.
Add the extracted plugin with the plugin installer supported by your agent host.

Version 1.0.0 · MIT · Review instructions before installing any agent package.

FAQ

Is this a ready-made autonomous agent?

It is a portable workflow blueprint. Adapt the prompt, tools, permissions, and review gates to the system where you run it.

What makes the result trustworthy?

Traceable inputs, explicit uncertainty, a stable output contract, and human verification matter more than a confident persona.

Incident
Response Commander.