Incident Postmortem Agent
Turns a messy timeline into a postmortem that blames the system
- 8hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 11output fields
- A structured result, not a paragraph you have to re-read
- ≤5steps per run
- Bounded work: at most 3 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
Everyone agrees postmortems should be blameless, and most are not. Not from bad intent: at midnight, "the config push at 17:40" is the easiest true sentence to write, and once a person is on the page the document stops being about the system.
This agent cannot name a person. It reconstructs the timeline from your logs, alerts and chat, separates what happened from what was believed at the time, and asks the questions that find systemic causes — why the alert did not fire, why the rollback took nine minutes, why the config could be pushed unreviewed at all.
Its action items are specific and testable, and it marks the ones that are really wishes. "Be more careful" is not an action item; "require review on production config changes" is. And it separates what is known from what is assumed, so next month nobody mistakes a theory in the document for an established fact.
Benefits
Written the same day
A postmortem written a week later is a reconstruction.
Safe to circulate
Nothing in it can be read as an accusation.
Actions that change something
Testable items instead of resolutions.
What it does
Cannot name a person
A hard rule, not a tone preference. It refers to roles and systems, which is what keeps it blameless.
Separates fact from belief
What was true, and what responders thought at the time. Both matter, and confusing them is how myths start.
Finds systemic causes
Not what triggered it — what made a trigger sufficient to cause an outage.
Action items you can test
Each one has an owner role and a check for whether it worked. "Be more careful" is marked as a wish.
Detection and recovery gaps
How long until anyone knew, and what made recovery slower than it needed to be.
Marks what is unknown
An unresolved question is a finding, not a hole to fill with a theory.
What this changes
What this changes about your week
- It takes over
- Turning an incident channel into a document with causes and actions.
- Done today by
- An engineer at midnight, or a week later from memory.
- How often
- Every incident.
- Typical manual effort
- A proper postmortem is half a day while everything is fresh.
Why IT & Service Management in particular. It cannot name a person. If one engineer could cause the outage alone, the system allowed it — and that is the finding that prevents the next one.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Incident Postmortem Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-sonnet-5 with automatic fallback
- 3Toolsextract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output, abridged.
Input
{
"severity": "SEV2",
"timeline": "…",
"incidentReference": "INC-402"
}Output
{
"summary": "A configuration change reduced the connection pool below what peak traffic required. Requests queued, then timed out. Service was restored by reverting the change.",
"escalate": false,
"unknowns": [
"Why the pool size was reduced. The record does not say, and the change carried no description."
],
"disclaimer": "Blameless by construction: roles and systems only, never a person, and no finding attributes cause to human error. Actions are proposals; nothing has been changed.",
"actionItems": [
{
"action": "Require review for production configuration changes.",
"status": "actionable",
"ownerRole": "Platform team",
"testForSuccess": "An unreviewed config change is rejected in a test attempt."
},
{
"action": "Be more careful with configuration.",
"status": "not-actionable",
"ownerRole": "—",
"testForSuccess": "None possible."
}
],
"recoveryGap": "9 minutes of the 14-minute recovery was the redeploy. A config rollback would have been under a minute.",
"detectionGap": "23 minutes from first failed request to anyone knowing. The signal came from customers, not monitoring.",
"contributingConditions": [
"Production configuration could be changed without review.",
"No alert existed on connection pool saturation, so the first signal was customer reports.",
"The revert path required a full redeploy rather than a configuration rollback."
]
}Requirements
Integrations
No integrations required.
Before you start
- The incident timeline — alerts, logs, chat, deploy history
- Requires the Starter plan or higher
Use cases
After an outage
Turn the incident channel into a document in minutes.
Recurring incidents
Find the cause the last three postmortems missed.
Customer-facing summaries
A factual basis for what you tell customers, without internal detail.
Pricing
Starter
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Why will it not name who caused it?
Because if a person can cause an outage alone, the system allowed it, and that is the finding. Naming them ends the investigation early and teaches everyone else to be quieter during the next incident.
Can it write the customer-facing note?
It can draft the factual basis, without internal system detail. Whether and how to communicate an incident is a decision with commercial and legal weight, and stays with a person.
What if the timeline is incomplete?
It marks the gaps as unknown and lists what to check. A postmortem with a confidently invented middle is worse than one with an honest hole.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent