Strategy
Strategy documents for SRE work: plain markdown rules and checklists for incidents, deploys, access, cost, and automation. Generic, with no company data.
Start here
The map of these strategy documents for AI agents and humans, what each page covers, and the order to read it in.
Foundations
The default rules an AI agent follows before it touches any production system, so it is useful without being dangerous.
How to pick SLIs, set an SLO, alert on burn rate and use the error budget to decide between shipping features and fixing reliability.
A blameless postmortem template and a fully worked fictional example, so an agent can draft one from an incident timeline in minutes.
Operations
How an agent takes the first fifteen minutes of an incident, from alert to a clear status, a likely cause and a human-approved mitigation.
How to audit monitors so every alert is actionable, owned and routed, and nothing important is silently muted or stuck in No Data.
How an agent explores AWS accounts safely with read-only roles, explicit profiles and copy-paste recipes for the questions SREs ask most.
How to work an SRE queue end to end, from classifying new tickets to closing stale review and blocked piles with evidence.
How to check that every data store is backed up to policy, and how to prove it by restoring on a schedule.
Monitors and dashboards as code
How to export, audit and manage monitors, downtimes and dashboards as code, with read-only recipes an agent can run.
Scheduled jobs and file transfers
How to triage a failed scheduled job or file transfer, recover the missed run safely and stop it failing silently next time.
A short, structured handoff at every rotation change so the next on-call knows what is burning, what is fragile and what is scheduled.
Delivery
Blue-green deploys with one-click rollback
Deploy a candidate next to the live version, smoke-test it, promote on success, and keep the previous version one button away; a worked example on a container service and your CI provider.
How to move a repository's pipeline from one CI system to another, one repo at a time, with parity checks and no big-bang cutover.
Short-lived cloud credentials for CI
Replace stored cloud access keys in CI with short-lived credentials from your CI provider's OIDC issuer, scoped per project, branch and environment.
Repo governance and branch protection
The minimum controls every repository needs (protected default branch, required review, CODEOWNERS, no force-push, clean group structure) and how to audit them.
Terraform changes via merge request
How to change infrastructure safely with Terraform or OpenTofu, with plan in the MR, apply after approval, and routines for drift, state and imports.
The production-readiness checklist a new service passes before it takes real traffic, from repo and pipeline to monitoring, backups and on-call.
Security & Access
Access requests and least privilege
How to turn "please give me access" into a time-bound, least-privilege grant through code, with an approver, an expiry and evidence for audit.
Certificate renewal and expiry tracking
How to find every certificate before it expires, renew the managed ones automatically and run a safe, rehearsed renewal for the ones that are not.
Secret rotation and exposed secrets
What to do in the first hour after a secret is exposed, and how to rotate keys, tokens and passwords routinely without an outage.
AWS account and resource decommissioning
How to prove something is unused, retire it in reversible stages and close an AWS account without breaking a hidden dependency.
Vulnerability and patch response
How to go from a CVE or scanner finding to a patched, verified fleet, with severity-based deadlines and a fast path for actively exploited bugs.
Change control in regulated environments
How to plan, approve, ship and evidence a production change inside a compliance scope, including release tickets, change windows and emergency changes.
How to run a cloud security sweep (flow logs, HTTPS-only load balancers, public databases, dead event targets, plaintext build secrets, broad IAM) and fix findings in safe batches.
Cost
A repeatable monthly sweep that finds idle and oversized cloud spend, proves it is safe to cut, and books the savings.
Automation
Setting up herdr for agent jobs
Install herdr, organise workspaces, tabs and panes for agents, and run headless Claude jobs at low priority with logs you can read later.
Connect an agent to Jira through the Atlassian MCP server or a CLI with an API token kept in a secret store, then read with JQL and write comments and transitions only behind approval.
Set up Claude Code so it is useful on infrastructure repos and safe around production, with a CLAUDE.md, tight permissions, a secret filter, headless mode and changes only through merge requests.
Automation blueprint for SRE toil
A step-by-step design for automating routine SRE toil with scripts, headless agents and one daily approval queue, while humans keep every decision that matters.
Human-in-the-loop approval patterns
Patterns that let agents do the work while a human keeps control: dry-run by default, draft-then-post, approval queues, two-key changes and kill switches.