Incident role restrictions

We know that there are certain incidents that require experienced hands to manage them throughout the whole process. They can ensure that proper steps are followed and essential workflows like paging your CEO or notifying regulators only happen if absolutely required. So, to keep these types of incidents under the control of users you specify, we’ve added new permissions including:

• Limiting who can be assigned an incident role
• Limiting what an incident role can do
• Limiting who can set an incident severity

Incident role restrictions

Organizations can now set restrictions on incident roles based on incident type. This can be helpful if you need to ensure certain incident steps are done in a certain way, so should only be done by those trained and know the correct procedures to follow.

This allows configuration such as:

• Only the Security team can act as an incident lead for Security incidents. The incident lead can be the only one that can set the incident severity, create updates and change the status of Security incidents.
• Only the incident management team can act as the Debrief facilitator role in Production incidents. This role can be the only ones to create (or delete) debriefs for Production incidents.

Generally, we suggest keeping incident roles open to allow anyone to be able to jump in and quickly help during an incident. However, if you are on our Enterprise plan and you need to keep things locked down to a specific set of individuals or teams, you can follow configuration steps in our help docs.

Restrict who can set incident severities

In addition to restricting what incident roles can do within an incident, we’ve released the ability to restrict who can set particular incident severities. For example, organizations can now say only the incident management team can set Production incidents to a Critical severity.

This is helpful as it can avoid unnecessarily triggering workflows, pages, and more that may be tied to a certain severity of incident. Keeping this locked down to experienced individuals can avoid these steps triggering unless required.

This feature can be enabled per incident type, not in the general severity configuration, and is available for our Pro and Enterprise customers. Please refer to our help docs for more details.

What else we've shipped