Start here

The map of these strategy documents for AI agents and humans, what each page covers, and the order to read it in.

Updated 2026-11-11Raw markdown

Strategy sections
On this page

These strategy documents teach an AI agent (and a new human SRE) how to do day-to-day site reliability work safely: triage incidents, work the ticket queue, change infrastructure through review, keep alerts honest, and automate the repetitive parts. Every page is generic. Placeholders such as <account-id>, <service>, example.internal and PROJ-123 stand in for real values.

Each page follows the same shape: when to use it, prerequisites, steps, how to verify, how to roll back, and pitfalls.

Read these first, in order

  1. Agent operating rules: read-only by default, dry-run first, changes through review, secrets never leave.
  2. Human-in-the-loop approval patterns: how agents act without acting alone.
  3. AWS read-only investigation: the safe way to get facts.
  4. Ticket triage and closeout: where most work arrives.

Pick a page by task

flowchart TD
  A[What is the task?] --> B{Something broken now?}
  B -- yes --> T[Incident triage]
  B -- no --> C{Change to infrastructure or a pipeline?}
  C -- yes --> D[Terraform via MR / pipeline migration / blue-green]
  C -- no --> E{Security, access or secrets?}
  E -- yes --> F[Access / secrets / certificates / security sweep]
  E -- no --> G{Cleanup or cost?}
  G -- yes --> H[Decommissioning / cost cleanup]
  G -- no --> I[Ticket triage, then the matching page]

Respond

Page Use it when
Incident triage An alert fires or users report a problem
Postmortems After a SEV1 or SEV2 or a near miss
On-call handoff A shift or rotation changes
Scheduled jobs and file transfers A scheduled job or file transfer failed or never ran

Observe

Page Use it when
Alert and monitor hygiene Alerts are noisy, muted, unowned or stuck in No Data
Monitors and dashboards as code Exporting, auditing or coding monitors and dashboards
SLOs and error budgets Setting reliability targets and burn-rate alerts

Change

Page Use it when
Terraform changes via merge request Any infrastructure change, drift or import
Blue-green deploys with one-click rollback Designing a deploy pipeline or rolling back
CI/CD pipeline migration Moving repos between CI systems
Short-lived cloud credentials for CI Removing static cloud keys from CI
Repo governance and branch protection New repos, audits, group structure
Change control in regulated environments Production changes under a compliance standard, release tickets
Onboarding a new service A new or newly containerised service goes live

Secure

Page Use it when
Access requests and least privilege Someone needs access, or an access review is due
Secret rotation and exposed secrets A secret leaked, or keys are old
Certificate renewal and expiry Expiry sweep or renewal
Vulnerability and patch response CVEs and scanner findings
Security baseline remediation Hundreds of posture findings to work down

Clean up

Page Use it when
AWS account and resource decommissioning Retiring stacks, VPCs or accounts
Backups and restore testing Coverage audits and restore drills
Cost cleanup Monthly cost sweep

Automate

Read these in order to automate most routine toil.

  1. Setting up herdr for agent jobs: where jobs run, at low priority, with logs.
  2. Connecting Jira for agents: MCP or CLI, tokens in a secret store, writes behind approval.
  3. Claude Code for SRE work: CLAUDE.md, permissions, hooks, headless mode, MR-only changes.
  4. Automation blueprint for SRE toil: intake, classify, draft, approval queue, daily and weekly reports.
  5. Human-in-the-loop approval patterns: the guardrails that make it safe.

Rules that apply to every page

  • Read-only unless a human approved this specific change.
  • Explicit profile, region and environment on every command.
  • Changes as merge requests or drafts, never direct to production.
  • No secrets, account IDs, hostnames or customer data in output, tickets or prompts.
  • When unsure, stop and ask.
Raw markdown All strategy pages