---
title: Start here
slug: start-here
summary: The map of these strategy documents for AI agents and humans, what each page covers, and the order to read it in.
order: 0
updated: 2026-11-11
status: ready
---

These strategy documents teach an AI agent (and a new human SRE) how to do day-to-day site reliability work safely: triage incidents, work the ticket queue, change infrastructure through review, keep alerts honest, and automate the repetitive parts. Every page is generic. Placeholders such as `<account-id>`, `<service>`, `example.internal` and `PROJ-123` stand in for real values.

Each page follows the same shape: when to use it, prerequisites, steps, how to verify, how to roll back, and pitfalls.

## Read these first, in order

1. [Agent operating rules](./agent-operating-rules.md): read-only by default, dry-run first, changes through review, secrets never leave.
2. [Human-in-the-loop approval patterns](./human-in-the-loop-approvals.md): how agents act without acting alone.
3. [AWS read-only investigation](./aws-read-only-investigation.md): the safe way to get facts.
4. [Ticket triage and closeout](./ticket-triage-and-closeout.md): where most work arrives.

## Pick a page by task

```mermaid
flowchart TD
  A[What is the task?] --> B{Something broken now?}
  B -- yes --> T[Incident triage]
  B -- no --> C{Change to infrastructure or a pipeline?}
  C -- yes --> D[Terraform via MR / pipeline migration / blue-green]
  C -- no --> E{Security, access or secrets?}
  E -- yes --> F[Access / secrets / certificates / security sweep]
  E -- no --> G{Cleanup or cost?}
  G -- yes --> H[Decommissioning / cost cleanup]
  G -- no --> I[Ticket triage, then the matching page]
```

## Respond

| Page | Use it when |
| --- | --- |
| [Incident triage](./incident-triage.md) | An alert fires or users report a problem |
| [Postmortems](./postmortems.md) | After a SEV1 or SEV2 or a near miss |
| [On-call handoff](./on-call-handoff.md) | A shift or rotation changes |
| [Scheduled jobs and file transfers](./scheduled-jobs-and-file-transfers.md) | A scheduled job or file transfer failed or never ran |

## Observe

| Page | Use it when |
| --- | --- |
| [Alert and monitor hygiene](./alert-and-monitor-hygiene.md) | Alerts are noisy, muted, unowned or stuck in No Data |
| [Monitors and dashboards as code](./monitors-and-dashboards.md) | Exporting, auditing or coding monitors and dashboards |
| [SLOs and error budgets](./slos-and-error-budgets.md) | Setting reliability targets and burn-rate alerts |

## Change

| Page | Use it when |
| --- | --- |
| [Terraform changes via merge request](./terraform-changes-via-merge-request.md) | Any infrastructure change, drift or import |
| [Blue-green deploys with one-click rollback](./blue-green-deploys-with-rollback.md) | Designing a deploy pipeline or rolling back |
| [CI/CD pipeline migration](./ci-cd-pipeline-migration.md) | Moving repos between CI systems |
| [Short-lived cloud credentials for CI](./oidc-from-ci-to-cloud.md) | Removing static cloud keys from CI |
| [Repo governance and branch protection](./repo-governance-and-branch-protection.md) | New repos, audits, group structure |
| [Change control in regulated environments](./change-control-in-regulated-environments.md) | Production changes under a compliance standard, release tickets |
| [Onboarding a new service](./onboarding-a-new-service.md) | A new or newly containerised service goes live |

## Secure

| Page | Use it when |
| --- | --- |
| [Access requests and least privilege](./access-requests-and-least-privilege.md) | Someone needs access, or an access review is due |
| [Secret rotation and exposed secrets](./secret-rotation-and-exposed-secrets.md) | A secret leaked, or keys are old |
| [Certificate renewal and expiry](./certificate-renewal-and-expiry.md) | Expiry sweep or renewal |
| [Vulnerability and patch response](./vulnerability-and-patch-response.md) | CVEs and scanner findings |
| [Security baseline remediation](./security-baseline-remediation.md) | Hundreds of posture findings to work down |

## Clean up

| Page | Use it when |
| --- | --- |
| [AWS account and resource decommissioning](./aws-account-and-resource-decommissioning.md) | Retiring stacks, VPCs or accounts |
| [Backups and restore testing](./backups-and-restore-testing.md) | Coverage audits and restore drills |
| [Cost cleanup](./cost-cleanup.md) | Monthly cost sweep |

## Automate

Read these in order to automate most routine toil.

1. [Setting up herdr for agent jobs](./herdr-setup-for-agents.md): where jobs run, at low priority, with logs.
2. [Connecting Jira for agents](./connecting-jira.md): MCP or CLI, tokens in a secret store, writes behind approval.
3. [Claude Code for SRE work](./claude-code-for-sre.md): CLAUDE.md, permissions, hooks, headless mode, MR-only changes.
4. [Automation blueprint for SRE toil](./automation-blueprint.md): intake, classify, draft, approval queue, daily and weekly reports.
5. [Human-in-the-loop approval patterns](./human-in-the-loop-approvals.md): the guardrails that make it safe.

## Rules that apply to every page

- [ ] Read-only unless a human approved this specific change.
- [ ] Explicit profile, region and environment on every command.
- [ ] Changes as merge requests or drafts, never direct to production.
- [ ] No secrets, account IDs, hostnames or customer data in output, tickets or prompts.
- [ ] When unsure, stop and ask.