Incidents

Incidents is the investigation and containment workspace at /incidents. Route access requires incident:read unless a full-access role applies. Lifecycle actions require incident:manage.

What it owns

• Incidents created from critical or high signals and operator reports.
• Triage, active investigation, containment, resolution, and post-incident state.
• A Decision and evidence trail of lifecycle events, drawn from the audit log.
• An owner and watchers, affected resources, containment actions and gates, findings, and evidence references.
• Correlation with source signal, execution, run, trace, workflow, agent, policy, and Decision Request identifiers.

Classification routes containment work to Incidents before ordinary review or decision work. Retried signal escalation returns the existing Incident for the same tenant and lifecycle signal.

Incident lifecycle

flowchart LR
  T["Triage"] --> A["Active"]
  A --> C["Contained"]
  C --> R["Resolved"]
  R --> P["Post-incident"]
  T -->|"No action needed + reason"| R
  A -->|"No action needed + reason"| R

An operator with incident:manage can select Close: no action needed from triage, active, or contained. A reason is required. The transition records the actor and reason in the incident history and evidence. Pending approvals and unfinished containment actions block closure, including approved actions whose effects are still queued or awaiting cleanup.

The API, CLI, and incident document use triage, active, contained, resolved, and post_incident. The incident response exposes lifecycleState; database status and canonical exception state mappings remain internal. updatedAt is the exact revision token, including PostgreSQL microseconds. Clients must pass it unchanged as expectedUpdatedAt. A conflict returns the current revision, state, and owner so the operator can review before retrying.

kla incident list
kla incident show INCIDENT_UUID
kla incident assign INCIDENT_UUID --owner [email protected]
kla incident transition INCIDENT_UUID active
kla incident close INCIDENT_UUID --reason 'Duplicate signal; no action needed.'

Evidence creation delegates to the shared Evidence Factory. The Incident retains its investigation record. The Evidence Factory owns the export job and bundle lifecycle.

Tenant filtering and resource authorization apply to every read and transition.