Incidents

Incidents is the investigation and containment workspace at /incidents. Route access requires incident:read unless a full-access role applies. Lifecycle actions require incident:manage.

What it owns

• Incidents created from critical or high signals and operator reports.
• Triage, active investigation, containment, resolution, and post-incident state.
• Timeline events, responders, affected resources, actions, findings, and evidence references.
• Correlation with source signal, execution, run, trace, workflow, agent, policy, and Decision Request identifiers.

Classification routes containment work to Incidents before ordinary review or decision work. Retried signal escalation returns the existing Incident for the same tenant and lifecycle signal.

Incident lifecycle

flowchart LR
  S["Signal received"] --> I["Incident open"]
  I --> C["Contained"]
  C --> R["Remediation in progress"]
  R --> E["Evidence ready"]
  E --> X["Closed"]

Evidence creation delegates to the shared Evidence Factory. The Incident retains its investigation record. The Evidence Factory owns the export job and bundle lifecycle.

Tenant filtering and resource authorization apply to every read and transition.