An on-call worker that can act — inside a blast radius you set
Incident response is where autonomy is most valuable and most dangerous: the same agent that can restart a service can take one down. Reachability graphs, per-hop delegation and durable approvals decide what it can touch at 3am.
The governed incident loop
Detect
Signals arrive; an orchestrator routes intent to the specialists permitted to see them.
Diagnose
Read paths are broad, write paths are narrow. The distinction is enforced, not requested.
Propose
Remediation above the blast-radius ceiling becomes a durable approval, not an action.
Act
Approved changes execute through the workflow runtime and survive restarts.
Review
The postmortem reads the ledger — who initiated, why a transition occurred, which policy allowed it.