Incident Response¶
Core Idea¶
Incident response is the structural pattern by which a system facing an acute, time-critical disruption engages a temporary command regime that prioritises stabilisation over diagnosis, accepts reversible degradation to limit the disruption's blast radius, defers root-cause investigation until the acute phase ends, and compresses decision authority into a designated commander operating under explicit time pressure and partial information. The defining commitment is the inversion of normal-operations priorities: during the acute phase, the objective is not to optimise performance, not to identify causes, and not to follow standard deliberative process — it is to get to a safe-but-degraded state quickly and preserve the ability to recover later. The pattern names the acute phase as its own regime with its own optimisation target, distinct from the post-mortem phase that follows.
The structural commitments are six. A trigger event — breach, code, mass casualty, outage, hull breach, market dislocation — displaces the system from normal operation. A detection step registers the trigger after a non-trivial delay that itself matters operationally. A containment step limits the disruption's spread before any fix is attempted. A stabilisation step brings the system to a safe, often degraded, state. A deferred root-cause analysis does not begin until the acute phase closes, because root-cause analysis under time pressure is unreliable and competes with stabilisation for the same attention. And a compressed command structure — incident commander, attending physician, on-call SRE — absorbs decision authority normally distributed across the organisation, for the duration of the acute phase only. The prime's distinctive content is that without it, practitioners run normal-operations playbooks during incidents — full information-gathering, distributed decision-making, deliberative consultation, optimisation for outcome quality — and the playbook actively degrades acute-phase outcomes. The prime licenses the otherwise-counterintuitive moves: act on partial information, accept rework, override normal authority chains, truncate diagnosis, and preserve forensic state for later rather than acting on it now. The pattern is heavily institutional and human-organisational — it presupposes roles, command structures, and a practice of hazard management — which is why its vocabulary (commander, containment, post-mortem) travels as a recognisable institutional form.
How would you explain it like I'm…
Put The Fire Out First
Safe First, Why Later
Stabilize Before Diagnose
Structural Signature¶
the trigger event displacing the system from normal operation — the detection step with operationally consequential delay — the containment step limiting spread before any fix — the stabilisation step reaching a safe degraded state — the deferred root-cause analysis held until the acute phase closes — the compressed command structure absorbing distributed authority for the duration only
A configuration exhibits incident response when each of the following holds:
- A trigger event. An acute, time-critical disruption displaces the system from normal operation: a breach, a code, a mass casualty, an outage, a hull breach, a market dislocation.
- A detection step. The trigger is registered after a non-trivial delay that itself matters operationally — the gap between onset and recognition is part of the structure, not incidental.
- A containment step. The disruption's spread is limited before any fix is attempted — isolate not eradicate, tourniquet not amputate — the load-bearing inversion of normal optimisation.
- A stabilisation step. The system is brought to a safe, often degraded, state; the acute-phase objective is a safe-but-degraded state quickly, not optimal performance.
- A deferred root-cause analysis. Diagnosis does not begin until the acute phase closes, because root-cause work under time pressure is unreliable and competes with stabilisation for the same attention; forensic state is preserved for it rather than acted on now.
- A compressed command structure. A designated commander — incident commander, attending, on-call SRE — absorbs decision authority normally distributed across the organisation, for the duration of the acute phase only, then relinquishes it in the post-mortem phase.
The components compose around the phase inversion: the acute phase is its own regime with its own optimisation target (safe degraded state, forensic state preserved, cause unknown), distinct from the post-mortem phase (cause identified, capacity improved) — and acute-phase capability is bounded by the playbook staged in the calm phase, not by acute-phase talent.
What It Is Not¶
- Not
controlled_reentry. Controlled reentry is the governed return of a system to normal operation across a boundary; incident response is the acute-phase regime itself — stabilise, contain, defer diagnosis — that precedes any reentry. Reentry is what follows recovery, not this. - Not
event_lifecycle_phases. That spans the whole pre/event/post trichotomy and allocates effort across all three; incident response is the acute phase specifically, with its own inverted optimisation target. - Not
failure_mode_and_effects_analysis_fmea. FMEA is pre-event hazard cataloguing; incident response is the time-critical acute handling once a hazard fires, where root-cause analysis is deliberately deferred. - Not
local_autonomy_tiered_escalation. That is a standing governance structure for routing decisions; incident response compresses distributed authority into one commander for the acute phase only, then relinquishes it. - Not
containmentalone. Containment is one step within incident response (limit spread before fixing); the prime is the whole six-element regime — trigger, detection, containment, stabilisation, deferred root-cause, compressed command. - Common misclassification. Running normal-operations priorities during the acute phase — full information, distributed authority, root-cause focus — so the system bleeds while the team diagnoses. Catch it by asking "are we still in the acute phase?"; if yes, stabilise first and defer diagnosis.
Broad Use¶
- Cybersecurity incident response: the NIST IR cycle (Detection & Analysis → Containment, Eradication, Recovery → Post-Incident Activity) and the SANS PICERL model carry the skeleton, with containment-before-eradication as the load-bearing inversion — a compromised host is isolated before the attacker is removed.
- Emergency medicine: the ABC primary survey stabilises before the secondary survey diagnoses, and ATLS codifies treat-as-you-go — intervene on a collapsing airway before any imaging completes; diagnosis is deferred to the post-resuscitation workup.
- Disaster management: the FEMA/ICS framework distinguishes the command-driven Response phase from the distributed-authority Recovery phase, and the Incident Command System was developed precisely because distributed authority failed during acute wildfire response.
- Site reliability engineering: mitigate before resolve; MTTA and MTTR are the acute-phase metrics, and root-cause analysis lives in the post-mortem after the page is closed.
- Military operations: immediate-action and react-to-contact drills and "consolidate before exploit" doctrine compress authority into the small-unit leader for the duration of contact, with full intelligence assessment coming after consolidation.
- Aviation, public health, and financial response: aviate-navigate-communicate ordering and engine-fire memory items, WHO outbreak-response authority compression, and central-bank weekend liquidity operations all run the acute-phase regime — act now on partial information, accept reversible footprint, preserve the ability to unwind.
Clarity¶
Naming the pattern clarifies a distinction operators chronically blur: the difference between the acute phase and the post-mortem phase. Each has its own optimisation target, information regime, authority structure, and metrics, and running post-mortem priorities during the acute phase — full information, distributed authority, root-cause focus — produces predictable failure: patients code while the team awaits imaging, outages extend while engineers debate cause, intruders pivot while the team negotiates whether to isolate. The clarifying force is to make the phase boundary an explicit object, so that at any moment the question "are we still in the acute phase?" has a definite answer and determines which playbook applies.
The prime also clarifies what counts as success in each phase. The acute phase succeeds when the system reaches a safe degraded state with forensic state preserved, regardless of whether the cause is known; the post-mortem phase succeeds when the cause is identified and response capacity improved, regardless of how quickly it produces its answer. Conflating the two metrics produces the characteristic anti-patterns — heroic debugging during an outage, trauma-bay analysis paralysis, security incidents that tip off the attacker while investigators discuss attribution. By separating the success criteria, the prime makes legible why moves that feel wasteful in the acute phase (snapshotting a host, preserving evidence, reverting rather than fixing forward) are correct: the regret for skipping them is paid later, in the post-mortem phase, when the unpreserved state would have made the difference.
Manages Complexity¶
The pattern manages complexity by compressing a large family of substrate-local frameworks — NIST IR, SANS PICERL, ATLS/ABCDE, ICS, SRE incident management, react-to-contact drills, WHO outbreak response, aviation emergency procedures, fire-service incident command — into a single six-element skeleton. Each substrate independently developed the same regime under local terminology, and the prime shows them as one pattern, absorbing the false impression that each domain's emergency practice is sui generis.
A second compression is a shared intervention catalogue: pre-staged playbooks (memory items, checklists, runbooks); named command roles with explicit authority (incident commander, attending, scene commander); time-pressure rituals (the standup, the bridge call, the trauma-bay call-outs); reversibility-preserving moves (isolate not eradicate, tourniquet not amputate, rollback before fix-forward); and forensic-preservation discipline (don't reboot the compromised host, bag the patient's clothes, capture the crash dump). These transfer wholesale across substrates, and the prime makes their shared structure explicit so that a team in one substrate can borrow from another. The catalogue also encodes portable trade-offs: the reversibility-versus-throughput trade (reversible moves are cheap when wrong, because the diagnosis is partial), the authority-compression cost (the commander makes calls the organisation would not have endorsed in normal times, paid willingly because distributed authority during acute response is worse), and pre-staging arbitrage (acute-phase capability is bounded by the playbook staged in the calm phase, not by acute-phase talent). Each trade-off is the same shape in every substrate, which is what lets the prime guide design before an incident rather than only explain it after.
Abstract Reasoning¶
The prime trains a reasoner to ask, at any moment of disruption, "are we still in the acute phase?" — a question with a definite answer that determines which playbook applies — and to recognise cross-phase mistakes as the characteristic failure mode. It licenses several substrate-neutral inferences. The first is the reversibility-versus-throughput trade-off: because the diagnosis is partial, acute-phase moves should be reversible when possible, since a reversible move that turns out wrong is cheap while an irreversible one is expensive — an ordering that inverts the normal-operations preference for one-shot optimal action. The second is the authority-compression cost: compressed authority during the acute phase has a real cost the organisation must accept, paid willingly because distributed authority during acute response is worse, and reasserted in the post-mortem phase.
The deeper inferences concern what feels wasteful in the moment but is not. Forensic-preservation regret recognises that most preserve-state moves feel wasteful during the acute phase ("we could have moved faster if we had not snapshotted the host") but that the regret is paid later, in the post-mortem, when the unpreserved state would have made the difference — so the prime licenses paying the small acute-phase cost to avoid the large post-mortem cost. Pre-staging arbitrage recognises that the playbook a team can execute in the acute phase is the one they staged in the calm phase, so acute-phase capability is bounded by pre-staging investment rather than by acute-phase intelligence or talent — a conclusion that redirects effort toward preparation rather than heroics. The reasoner is thereby led to evaluate each move by its phase (acute or post-mortem), its reversibility, and its forensic consequence, and to judge an incident's eventual handling by what was staged before it began.
Knowledge Transfer¶
The transferable content is the trigger / detection / containment / stabilisation / deferred-root-cause / compressed-authority diagnostic together with the intervention catalogue (pre-staged playbooks, named command roles, time-pressure rituals, reversibility preservation, forensic preservation). The role mappings are regular: the trigger maps to a breach, a code, an outage, a hull breach; the commander maps to an incident commander, an attending physician, a scene commander, a pilot-in-command; the containment move maps to host isolation, tourniquet application, traffic-shift, hasty defence; the post-mortem maps to the after-action review, the morbidity-and-mortality conference, the blameless retro.
The transfers are documented institutional migrations, not loose analogies. The Incident Command System moved from fire service into emergency management, then into hospital incident command, then into private-sector business continuity. Crew Resource Management moved from aviation into surgical teams and trauma resuscitation. The SRE incident-command model is explicitly modelled on NIMS/ICS, and tabletop-exercise methodology moved from military and fire-service roots into cybersecurity, public health, and business continuity. Each migration carries the same six-element skeleton and the same intervention catalogue, retuned with substrate-specific tooling. The load-bearing recognition that transfers is the phase inversion itself: when something is going wrong fast, get the system to a safe degraded state first, give one person authority to call the shots, and defer figuring out why until after the bleeding stops. That sentence does work in cybersecurity, emergency medicine, disaster management, SRE, military operations, aviation, maritime emergencies, public-health outbreaks, and financial-market crises. Because the pattern is bound to human-organisational hazard practice — roles, command structures, and institutional playbooks are constitutive of it — the transfer is between organisations' ways of handling acute disruption, and the institutional vocabulary travels as a recognisable form even though the specific hazards and tools differ by substrate.
Examples¶
Formal/abstract¶
Emergency-medicine trauma resuscitation under the ATLS/ABC protocol is the prime's most rigorously codified instance, where the phase inversion is doctrine. The trigger event is a major-trauma patient arriving in the bay. The detection step is the primary survey, whose speed is operationally consequential. The containment step is the load-bearing inversion: the ABC ordering — Airway, Breathing, Circulation — stabilises before it diagnoses, so a collapsing airway is secured before any imaging completes, the medical analogue of "isolate, don't eradicate." The stabilisation step brings the patient to a safe-but-degraded state (perfusing, ventilating) rather than to optimal health. The deferred root-cause analysis is the secondary survey and definitive workup, held until after the acute phase, because diagnosis under time pressure is unreliable and competes with stabilisation for the same attention. The compressed command structure is the trauma-team leader who absorbs decision authority normally distributed across the team, for the duration of the resuscitation only. The prime's phase inversion is the core insight: running post-mortem priorities (full information, distributed authority, root-cause focus) during the acute phase produces the characteristic failure — the patient codes while the team awaits a CT. The success criterion is phase-specific — the acute phase succeeds when the patient is stabilised with diagnostic options preserved, regardless of whether the cause is yet known. And acute-phase capability is bounded by pre-staging: the team executes the playbook it drilled in the calm phase, so simulation is investment, not training. Mapped back: the trauma patient is the trigger, the primary survey is detection, ABC stabilisation-before-diagnosis is the containment inversion, the secondary survey is the deferred root-cause, and the team leader is the compressed command — with cross-phase priority confusion (analysis paralysis in the bay) the predicted failure mode.
Applied/industry¶
Two applied instances run the identical six-element skeleton, and the cross-substrate transfer is a documented institutional migration. First, cybersecurity incident response under the NIST/SANS models: the trigger is a breach; detection registers it after a consequential delay; containment-before-eradication is the inversion — a compromised host is isolated before the attacker is removed, preserving forensic state rather than rebooting it away; stabilisation reaches a safe degraded posture; deferred root-cause lives in the post-incident review; and a compressed command structure (the incident commander) absorbs authority for the duration. The reversibility-versus-throughput trade is explicit — reversible moves (traffic-shift, isolate) are cheap when the partial diagnosis turns out wrong — and forensic-preservation regret is real: snapshotting the host feels wasteful in the moment but pays off in the post-mortem when the unpreserved state would have been decisive. Second, site reliability engineering: the trigger is an outage, containment is mitigate-before-resolve (roll back before fix-forward), the acute metrics are mean-time-to-acknowledge and mean-time-to-recover, and root-cause analysis is deferred to the blameless post-mortem. The transfer is not analogy but lineage: the SRE incident-command model is explicitly modelled on the fire service's Incident Command System, which itself migrated into emergency management, hospital incident command, and business continuity. The load-bearing recognition that transfers is the phase inversion sentence — when something is going wrong fast, get to a safe degraded state first, give one person authority, and defer diagnosis until after the bleeding stops — and it does work in security, SRE, medicine, and disaster response alike. Mapped back: breaches and outages are triggers; the incident commander and on-call SRE are the compressed commands; host isolation and rollback are the containment inversions; the post-incident review and blameless post-mortem are the deferred root-cause phases; and pre-staged playbooks bound acute-phase capability in every substrate, exactly as the prime predicts.
Structural Tensions¶
T1 — Acute-Phase Regime versus Post-Mortem Regime (temporal). The prime's defining inversion is that the acute phase has its own optimisation target (safe degraded state, cause unknown, authority compressed) distinct from the post-mortem phase (cause identified, capacity improved). The tension is between two regimes that demand opposite priorities. The characteristic failure mode is the cross-phase mistake: running post-mortem priorities — full information, distributed authority, root-cause focus — during the acute phase, so patients code while the team awaits imaging and outages extend while engineers debate cause. The diagnostic: at any moment ask "are we still in the acute phase?" — a question with a definite answer that determines which playbook applies, and whose neglect produces analysis paralysis in the bay.
T2 — Stabilisation versus Diagnosis (sign/direction). The acute objective is to reach a safe degraded state quickly, not to identify the cause; root-cause work under time pressure is unreliable and competes with stabilisation for the same attention. The tension is between fixing the symptom now and understanding the problem first. The failure mode is heroic debugging during an outage or trauma-bay analysis paralysis — diagnosing while the system bleeds. The diagnostic: ask whether the current activity stabilises or investigates; in the acute phase, defer diagnosis and preserve forensic state for it rather than acting on it now, because the attention spent on cause is attention not spent on reaching the safe degraded state.
T3 — Reversible Degradation versus Throughput (sign/direction). Because the diagnosis is partial, acute-phase moves should be reversible when possible — a reversible wrong move is cheap, an irreversible one expensive — which inverts the normal-operations preference for one-shot optimal action. The tension is between acting reversibly and acting decisively for maximum effect. The failure mode is the irreversible commitment on partial information: amputating where a tourniquet would do, eradicating where isolation would do, fixing-forward where rollback would do. The diagnostic: ask whether the move can be unwound if the partial diagnosis is wrong — prefer isolate-not-eradicate and rollback-before-fix-forward, accepting rework as the price of reversibility under uncertainty.
T4 — Compressed Authority versus Distributed Endorsement (scopal). The acute phase compresses decision authority into one commander who makes calls the organisation would not have endorsed under normal deliberation, for the duration only. The tension is between the speed of single-point command and the legitimacy of distributed consent. The failure mode runs both ways: distributed authority during acute response (the ICS was built because this failed in wildfire response) and a commander who fails to relinquish authority when the acute phase closes. The diagnostic: ask whether authority is compressed and time-bounded — the compression cost is paid willingly during the acute phase because distributed authority is worse, but it must be reasserted in the post-mortem phase, not retained.
T5 — Forensic Preservation versus Acute-Phase Speed (coupling). Preserving forensic state — not rebooting the compromised host, bagging the patient's clothes, capturing the crash dump — feels wasteful in the acute phase but its absence is paid later in the post-mortem. The tension is between moving fastest now and preserving the state the later investigation will need. The failure mode is forensic destruction for speed: rebooting away the evidence, acting on the state instead of capturing it, so the post-mortem cannot find the cause. The diagnostic: ask what state the post-mortem phase will need and whether the current acute move destroys it — pay the small acute-phase cost to avoid the large post-mortem regret when the unpreserved state would have been decisive.
T6 — Calm-Phase Pre-Staging versus Acute-Phase Heroics (temporal). Acute-phase capability is bounded by the playbook staged in the calm phase, not by acute-phase talent or intelligence. The tension is between investing in preparation before the incident and relying on improvisation during it. The failure mode is the heroics trap: under-investing in drills, runbooks, and named roles on the assumption that skilled people will improvise under pressure, then discovering the team can only execute what it rehearsed. The diagnostic: judge an incident's eventual handling by what was staged before it began — redirect effort toward pre-staging (memory items, checklists, tabletop exercises) rather than toward acute-phase heroics, since the executable playbook is the rehearsed one, not the invented one.
Structural–Framed Character¶
Incident response sits at the framed end of the structural–framed spectrum, with an aggregate of 0.9 — among the most framed primes in the catalogue. A bare relational skeleton can be glimpsed (a trigger displaces a system; authority is temporarily compressed to reach a safe degraded state; diagnosis is deferred), but four of the five diagnostics read at the maximum, and the prime is constitutively an institutional hazard-management practice.
The vocabulary carries a heavy home lexicon that must travel with it (vocab_travels 1.0): incident commander, containment, eradication, post-mortem, primary survey — the terms are the institutional form, codified by NIST, SANS, ICS, and ATLS, and a reader cannot meet the prime without importing them. Its origin is institutional (institutional_origin 1.0): the pattern is a family of named frameworks developed by specific agencies and professional bodies, not a relation read off the world. It is human-practice-bound (human_practice_bound 1.0): command roles, designated commanders, and pre-staged playbooks are constitutive — there is no physical or biological substrate where "incident response" occurs absent an organisation with roles and authority. And invoking it IMPORTS the whole command-structure-and-roles frame (import_vs_recognize 1.0): naming it brings the incident commander, the bridge call, the blameless post-mortem, not merely the recognition of a pattern already present in a substrate-neutral system. The one sub-maximal diagnostic is evaluative_weight (0.5): the prime carries mild normative load about what good acute-phase handling looks like (stabilise first, defer diagnosis), but the phase-inversion target is more descriptive than approving. The temporal phase-inversion skeleton is genuine, which keeps it from a flat 1.0, but the dominant institutional, role-based, vocabulary-laden character places the prime firmly at the framed end, exactly as the 0.9 aggregate records.
Substrate Independence¶
Incident response is a moderately substrate-independent prime — composite 3 / 5 on the substrate-independence scale. Its domain breadth sits at 3: the compressed-authority acute-phase regime — act now on partial information, contain before eradicate, defer diagnosis to a post-incident phase — recurs across cybersecurity (NIST IR, SANS PICERL, containment-before-eradication), emergency medicine (ABC primary survey, ATLS treat-as-you-go), disaster management (FEMA/ICS command-driven response), site reliability engineering (mitigate before resolve, MTTA/MTTR), military immediate-action drills, and aviation, public-health, and financial acute response. These are genuinely distinct fields, but every one is a human-organisational hazard-management substrate: the regime presupposes an organisation, a chain of command, and a deliberate compression of decision authority for the duration of contact. There is no physical or biological instance, which is what caps the breadth. Its structural abstraction is the weakest component at 2: the pattern is a procedural template (acute phase with compressed authority and inverted ordering, then a learning phase) carrying heavy institutional commitments — command structures, professions, after-action review — rather than a medium-neutral relation. The transfer evidence is the strongest at 4: containment-before-eradication, mitigate-before-resolve, and stabilise-before-diagnose are demonstrably the same inversion across NIST IR, ATLS, ICS, and SRE, with named frameworks and the post-mortem-feeds-prevention loop recurring in each. The institutional ceiling and thin abstraction hold the composite at a defensible 3.
- Composite substrate independence — 3 / 5
- Domain breadth — 3 / 5
- Structural abstraction — 2 / 5
- Transfer evidence — 4 / 5
Relationships to Other Primes¶
Parents (1) — more general patterns this builds on
-
Incident Response is a kind of Event Lifecycle Phases
The file states it outright: incident_response IS "that middle phase specifically, examined from within" — the acute phase of the pre/event/post trichotomy that event_lifecycle_phases (valid candidate, CAND-R25-015-02, already a Phase-C link) spans. event_lifecycle_phases allocates effort ACROSS the three regimes; incident_response is the acute regime's internal structure. Clean part-of/child-of (a phase within the lifecycle), explicitly the "broader frame incident response sits inside." High conviction. Distinct from controlled_reentry (the adjacent return phase, not a parent) which Phase-C correctly kept separate.
Path to root: Incident Response → Event Lifecycle Phases → State and State Transition
Neighborhood in Abstraction Space¶
Incident Response sits in a sparse region of abstraction space (85th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely rather than landing on a neighbor.
Family — Overextension & Load Fragility (18 primes)
Nearest neighbors
- Diagnostically Inert Signal — 0.70
- Event Lifecycle Phases — 0.70
- Rebound Effect — 0.69
- Stability-Induced Fragility — 0.69
- Recovery — 0.67
Computed from structural-signature embeddings · 2026-06-14
Not to Be Confused With¶
The nearest neighbour, controlled_reentry (similarity 0.86), is the contrast most worth drawing because the two are adjacent phases of the same disruption lifecycle and so are easily merged. Controlled reentry is the governed return of a system to normal operation across a boundary — the disciplined, staged re-admission of a recovered component, a quarantined host, a patient, a market back into standard service, with checks at each gate. Incident response is the acute-phase regime that precedes any such return: stabilise, contain, defer diagnosis, compress authority. The invariants differ. Reentry's invariant is the controlled crossing back to normalcy, optimised for not re-introducing the hazard; incident response's invariant is the phase inversion — reaching a safe degraded state fast while diagnosis is deferred and authority compressed. A practitioner who conflates them will either treat the acute scramble as if it were the careful reentry (applying reentry's deliberate gating to a moment that demands speed) or treat reentry as if it were still the acute phase (rushing a component back into service with compressed authority when the situation now calls for distributed endorsement and full checks). The phase boundary the prime makes explicit — "are we still in the acute phase?" — is exactly what separates them: incident response governs while the system bleeds, controlled reentry governs once it has stopped and is being returned to service.
A second genuine confusion is with event_lifecycle_phases, which is the broader frame incident response sits inside. Event lifecycle phases spans the whole pre-event / event / post-event trichotomy and concerns allocating effort across all three regimes — mitigation, response, recovery — with its central claim being that each phase has a distinct logic and that organisations chronically over-invest in the visible middle one. Incident response is that middle phase specifically, examined from within: it is the acute regime's own internal structure (trigger, detection, containment, stabilisation, deferred root-cause, compressed command). The invariants differ in scope. The lifecycle prime's invariant is the regime-change across phase boundaries and the cross-phase budget allocation; incident response's invariant is the inverted optimisation target within the acute phase. The distinction matters because the lifecycle frame asks "are we balancing mitigation, response, and recovery correctly?" while incident response asks "within the response phase, are we stabilising before diagnosing and compressing authority correctly?" Conflating them leads to using a whole-lifecycle budgeting argument to settle an acute-phase tactical question, or vice versa — missing that the deferred-root-cause discipline is an intra-phase rule, not a statement about the pre/event/post split.
A third confusion worth separating is with local_autonomy_tiered_escalation. Both concern who holds decision authority during difficulty, and both involve routing decisions to the right level, so they look like the same governance idea. But tiered escalation is a standing structure — a permanent arrangement in which lower tiers handle what they can and escalate what they cannot, operating continuously in normal times. Incident response compresses authority in the opposite direction and only temporarily: it pulls decision rights normally distributed across the organisation into a single commander for the duration of the acute phase, then relinquishes them in the post-mortem. The invariants differ: tiered escalation's is the stable mapping of decision types to organisational levels; incident response's is the time-bounded compression of authority that inverts the normal distribution and must be reasserted when the acute phase closes. The hazard of conflation is real and the prime names it — a commander who fails to relinquish authority when the acute phase ends has confused a temporary compression with a standing escalation structure, retaining emergency powers past the emergency.
For a practitioner the through-line is to locate the situation precisely in phase and scope. Is the system still bleeding (incident response) or being returned to service (controlled reentry)? Is the question about balancing the whole lifecycle (event lifecycle phases) or about the internal discipline of the acute phase (incident response)? Is the authority arrangement a standing structure (tiered escalation) or a temporary, time-bounded compression (incident response)? Each neighbour shares a surface feature — boundary-crossing, disruption-handling, authority-routing — but only incident response carries the phase-inverted optimisation target, and confusing it with any neighbour points the response toward the wrong regime's playbook.
Solution Archetypes¶
No catalogued solution archetypes reference this prime yet.