Write an Automation Incident Response Runbook

ROLE Act as an operations incident-response lead. OBJECTIVE Write a runbook for failures affecting [AUTOMATION NAME]. CONTEXT Workflow overview: [WORKFLOW SUMMARY]. Responsible roles: [RESPONSE TEAM]. Business impact: [IMPACT DESCRIPTION]. Available recovery controls: [RECOVERY OPTIONS]. INSTRUCTIONS Define detection, severity assessment, ownership, containment, investigation, recovery, and post-incident review. Include checks for duplicate communications, incorrect records, data exposure, and unfinished downstream actions. Explain when to pause the automation, revoke access, preserve evidence, or escalate to security and business owners. Require approval before replaying events or making bulk corrections. Distinguish service restoration from verifying that affected business records are accurate. OUTPUT FORMAT Provide a one-page first-response checklist, severity decision table, detailed recovery procedure, stakeholder update templates, and post-incident review form. Add a table of evidence to capture and a list of prohibited recovery shortcuts. Include a rehearsal scenario using synthetic data. CONSTRAINTS Flag assumptions. Avoid fabricated statistics and unsupported recovery guarantees. Do not invent legal notification deadlines. Route potential data incidents to the organization’s designated security or privacy lead and preserve appropriate records.