- A published commitment is at risk
- Anything on a public page — a wave plan, an exit right, a response time — that we may not be able to honour. This goes up the same day.
- A security or data event
- Suspected or confirmed, before it is understood. The Head of Security owns the disclosure decision and the clock starts immediately.
- An agent acted outside its scope
- Treated as a production incident regardless of whether it caused harm, because the scope is the product.
- A customer is being managed rather than helped
- If the plan for an account has become communications rather than engineering, that is a leadership problem and not an account one.