An RCA built on "we believe" is a story; one where every causal claim cites a log line, metric or config diff is a document. AI drafts the narrative fast — this playbook's discipline forces evidence onto every claim and keeps the causal chain owned by the engineer.
Tier: Foundation · Workflow area: Reliability & Incident Ops · ~25 minutes
Postmortems fail two ways: they take so long nobody writes them, or they get written as smooth narratives that quietly encode guesses as facts. This playbook fixes both. AI turns the raw timeline, metrics and chat log into a structured draft in minutes — but the prompt contract requires an evidence citation on every causal statement, and the review pass rejects any claim that cites nothing. Blameless is a constraint too: the draft names systems and conditions, never people's failures.
Assemble the evidence pack first — the draft is only as good as the exhibits. Collect into one folder, with stable names:
mkdir rca-2412 && cd rca-2412
# E1: alert history for the window
# E2: log slices (db + app) covering onset through recovery
# E3: metric screenshots/exports: connections, latency, replication lag
# E4: deploy/change log for the 48h prior
# E5: incident channel transcript
ls -1 | sed 's/^/EXHIBIT /'
Number every artifact. Citations will point at these numbers, so the numbering must be stable before drafting starts.
Prompt with the evidence-per-claim contract explicit.
Draft a blameless RCA from the numbered exhibits below.
Structure: Summary (3 sentences) / Impact (numbers only from
exhibits) / Timeline / Causal chain / Contributing factors /
What went well / Action items.
Hard rules:
- Every causal or factual claim ends with a citation like [E2:14:32]
(exhibit and timestamp/line). A claim you cannot cite goes into a
separate section titled OPEN QUESTIONS instead of the causal chain.
- Timeline entries: timestamp, event, exhibit citation. No entry
without a citation.
- Blameless language: name systems, configs and conditions. Never
write that a person erred; write what the system allowed.
- Impact numbers only from exhibits; if unmeasured, write
"unmeasured", do not estimate.
- Action items: phrased as testable changes, each mapped to the causal
link or contributing factor it addresses.
[paste exhibits]
The OPEN QUESTIONS section is the pressure valve — it gives the model somewhere honest to put what it would otherwise smooth into the narrative.
Audit the citations — every single one. This is the human pass that makes the document trustworthy, and it is fast because citations make it fast. For each [E_n:time], open the exhibit and confirm the line says what the claim says. Three failure patterns to hunt: a citation that exists but says something weaker than the claim ("connections elevated" cited as "pool exhausted"), a citation to the wrong exhibit, and a plausible causal step with no citation that slipped through anyway. Strike or downgrade every offender into OPEN QUESTIONS.
Interrogate the causal chain yourself — the engineer owns causality. The model orders events; correlation ordering is not causation. For each link in the chain ask: what evidence distinguishes this from the reverse arrow, or from a common cause? A good chain reads like: config change [E4:Aug2 22:10] → connection ceiling lowered [E2:22:11] → pool exhaustion at traffic peak [E3 graph 2, 08:14] → checkout errors [E1:08:16] — each arrow survivable under a "how do we know?" challenge in review.
Sharpen action items until each is testable and mapped. Reject "improve monitoring." Accept: Alert when connection usage exceeds 80% of max_connections for 5 min — addresses causal link 3, where exhaustion ran 2h unalerted [E3]. Every action item names the link it severs; an action item mapped to nothing is scope creep wearing a safety vest.
Review with the responders, then publish with the open questions intact. The people who were there validate the timeline and chain in a 20-minute read-through. Publish including OPEN QUESTIONS — unresolved uncertainty on the record is what lets the next incident's responder know what was never actually established.
[E marker or it moves to OPEN QUESTIONS.Incident channels and log slices carry customer identifiers, and RCAs travel further than either — to leadership, sometimes to customers. Scrub the exhibits before drafting, and classify the published document deliberately rather than inheriting the channel's looser reality.
The citation requirement is not bureaucracy — it is what lets AI draft the document at all without laundering guesses into findings. Evidence pack first, cited draft second, human audit of every citation third, and the causal chain signed by an engineer, not a model.