Incident Action Log¶

A contemporaneous register — instantiates Acute Stabilization Command

A timestamped, append-only record of every decision and action taken during the incident, written as it happens — the contemporaneous trail that later diagnosis, accountability, and learning all depend on.

The Incident Action Log is the append-only, timestamped record of what was decided and done, written as it happens rather than reconstructed afterward. Its whole value is in the word contemporaneous: a note made at 14:07, before anyone knows how the story ends, is evidence; the same note written from memory next week is a rationalization. The log captures each decision — who made it, when, and why — and in doing so preserves the evidentiary trail that later diagnosis, accountability, and learning depend on. What distinguishes it from the Common Operating Picture Board is direction in time: the board is the current state, overwritten as it moves; the log is history, immutable and only ever added to.

Example¶

During a disturbance on a regional transmission network, a control-room operator works the problem and, in parallel, keeps the action log running. Each entry is timestamped: 14:03 — opened breaker at substation D to isolate the faulted line; 14:07 — shed ≈40 MW of interruptible load to hold frequency; 14:12 — declined to re-close the breaker pending confirmation. Nobody yet knows the root cause. The log isn't for solving the incident; it is the trail. Weeks later, when the disturbance is analyzed, the reconstruction rests on that contemporaneous record — the sequence and timing of switching actions — not on anyone's after-the-fact recollection of a stressful hour.

The log's discipline shows precisely because it is written blind to the outcome: the 14:12 decision not to re-close, recorded with its reasoning at the time, is worth more than any later account, which would be coloured by knowing how things turned out.

How it works¶

Append-only and timestamped. Entries are added, never edited or deleted; each carries a time, an actor, and the decision or action. Immutability is what makes it evidence.
Written in the moment. Capture is contemporaneous with the action, before the outcome is known — the property that separates a record from a reconstruction.
Decision and rationale. It logs not just what was done but why it was chosen then, preserving the reasoning a later review will need.
Feeds, doesn't judge. The log neutrally preserves the trail; interpreting it is for diagnosis and the after-action review, not for the log itself.

Tuning parameters¶

Capture granularity — how much is logged. Fine granularity preserves a richer trail but taxes responders mid-incident; coarse logging is cheap but may miss the entry that later matters.
Burden placement — whether responders self-log or a dedicated scribe records for them. A scribe keeps hands free and the log consistent but adds a person; self-logging scales but competes with the work.
Automated vs. manual — how much is captured automatically (system events, command history) versus written by hand. Automation is complete and unbiased but misses the why; manual captures reasoning but is lossy under load.
Immutability strictness — how hard edits are locked out. Strict append-only maximizes evidentiary value; any edit affordance invites tidying that destroys it.

When it helps, and when it misleads¶

Its strength is that it creates an outcome-blind record — decisions captured before anyone knows how they turn out — which is exactly what makes it trustworthy for later diagnosis, accountability, and learning. It also frees the live response from having to remember: the board can be overwritten freely because the history is safe in the log.

Its central failure mode is that logging competes with acting, so under load the log thins out precisely when the incident is most interesting — the gaps fall exactly where the record was most needed. And the classic misuse is the reverse of the log's purpose: writing or "cleaning up" it after the fact to construct a defensible narrative, which converts evidence into story. The discipline that guards against this is contemporaneous, append-only capture — ideally offloaded to a scribe or an automated stream so the record survives the busiest minutes — and treating any post-hoc edit as destroying the very property that gives the log its worth.^[1]

How it implements the components¶

decision_and_action_log — the running, timestamped ledger of decisions, actions, and their rationale, as they happen.
evidence_preservation_path — by being immutable and contemporaneous, the log is the preserved evidentiary trail later analysis draws on.

It records but does not display the current state (Common Operating Picture Board), does not hand the preserved trail into a formal investigation (Root Cause Analysis Handoff), and does not run the after-action learning it feeds (Post-Incident Review Hotwash).

Instantiates: Acute Stabilization Command — the immutable trail that makes stabilize-before-diagnose accountable and learnable.
Sibling mechanisms: Common Operating Picture Board · Root Cause Analysis Handoff · Post-Incident Review Hotwash · Incident Command System · Containment or Rollback Action · Incident Response Runbook · On-Call Rotation Activation · Severity Matrix Activation · Triage and Prioritization Protocol · Status Update Cadence · War Room or Incident Channel · Reversible Service Degradation · Deactivation Checklist

Notes¶

The log is written for a reader who does not exist yet — the investigator or reviewer weeks from now. That future-reader test is the quickest way to judge whether an entry is worth making: if it would help someone reconstruct why, log it now.

References¶

[1] A contemporaneous record — one made at the time of the events it describes — carries more evidentiary weight than a later reconstruction precisely because it cannot have been shaped by knowledge of the outcome; fields from medicine to aviation to law treat "written at the time" as a distinct, higher class of evidence. ↩