Postmortem Incident Commander Decision Review Prompt

You are a senior incident commander and blameless-postmortem facilitator. You
review command decisions using the principle of LOCAL RATIONALITY: every decision
made sense to the person making it given what they knew, saw, and felt pressured
by at that moment. Your job is to reconstruct that context, not to grade the human.

I will paste:
[INCIDENT_TIMELINE] — timestamped events, alerts, and signals.
[COMMAND_DECISIONS] — key IC decisions: escalate, roll back, page more people,
declare/downgrade severity, hand off command, invoke DR, etc.
[INFO_AVAILABLE] — what dashboards, runbooks, and signals existed at each decision.

For EACH decision:
1. Restate the decision and the exact time it was made.
2. Reconstruct the information the IC had (and did NOT yet have) at that instant.
3. Assess whether the decision was locally rational given that information.
4. Identify what tooling, signal, runbook, or process would have made a better
   decision easier — NOT what the IC "should have known."
5. Note any decision that worked out but was luck, and any that looked wrong but
   was sound given the fog of the moment.

Output format:
- Per-decision cards (decision, time, info-at-hand, local-rationality verdict, systemic fix)
- Cross-cutting themes (recurring gaps in decision support)
- Prioritized list of process/tooling improvements

Guardrails: Stay strictly blameless — critique the decision environment, never the
commander. Never use "should have" about a person; use "the system made X hard."
Mark any reconstructed motive or belief as [ESTIMATE] unless the timeline states it.
A human IC owns all conclusions; you surface options, not verdicts on people.

Why this prompt works

The hardest thing about reviewing incident-command decisions is resisting hindsight bias. Once you know the rollback caused a second outage, or that paging the database team ten minutes earlier would have halved the duration, it feels obvious — but it was not obvious to the commander standing in the fog with three dashboards contradicting each other. This prompt is built entirely around the concept of local rationality: the idea, drawn from safety science and Sidney Dekker’s work, that people do what makes sense to them at the time given their goals, knowledge, and focus of attention. By forcing the model to reconstruct the information available at each decision instant before judging the decision, it structurally prevents the review from grading choices against knowledge nobody had yet.

The per-decision structure matters because command decisions are discrete, high-stakes, and reversible in memory but not in the moment. Escalate or wait. Roll back or push forward. Declare SEV1 or hold at SEV2. Each of these is a fork where the commander weighed incomplete signals against real pressure, and each deserves to be examined on its own terms rather than blurred into a general “the response was slow” narrative. Asking the model to separate what the IC knew from what they did not yet know is the core move — it reframes almost every apparent mistake as a missing signal, an ambiguous runbook, or a dashboard that buried the one metric that mattered.

Two of the numbered steps exist specifically to counter opposite distortions. Step four insists on translating every finding into a systemic or tooling fix rather than a lesson the person is supposed to have learned, because “the IC should have known” is not an action item — it is blame wearing a costume. Step five asks the model to flag decisions that succeeded only by luck and decisions that looked wrong but were sound, which protects against the survivorship bias where good outcomes launder bad process and bad outcomes indict good process. A blameless review that only examines what went wrong will happily reinforce a dangerous habit just because it happened to work this time.

The guardrails are strict on purpose. Blameless postmortems are a fragile cultural achievement; a single review that names and grades the commander teaches everyone to be defensive, to under-document, and to avoid the IC role. Forbidding “should have” about people and requiring systemic framing keeps the psychological safety intact. And because so much of decision reconstruction is inference — we rarely have a transcript of what the commander was thinking — the prompt requires that any reconstructed belief or motive be marked [ESTIMATE] and validated with the real responders before publishing. A confidently wrong reconstruction of someone’s reasoning is not just inaccurate; it can quietly implicate a colleague, which is exactly what the blameless discipline exists to prevent.