Incident	Service	Severity	Detect	Total
INC-107	checkout	SEV1	1h 15min	3h 45min
INC-113	billing	SEV1	1h 15min	3h 45min
INC-103	auth	SEV2	1h 10min	2h 25min
INC-106	search	SEV2	50min	2h 15min
INC-101	checkout	SEV1	42min	2h 10min

What to do this week

Invest in runbooks and rollback for the longest fixes (checkout, billing, auth).
Run a service review for checkout: 4 incidents and 9h 05min of downtime.

Write a blameless postmortem for the longest incident, INC-107, and record its cause beside these timestamps.

Don't

Don't judge these times against a target the data does not contain: set response targets per severity first.

How to improve

Add a "first customer report" time so detection and reporting can be told apart.
Add cause and customer impact to each row so the next report can group by cause.

Demo

Try it now — free

Type your figures (or fill in samples) and get the answer in a minute.

Start from a template

IncidentsOne incident per line: id, service, severity, started, detected, acknowledged, resolved. Times as YYYY-MM-DD HH:MM.

Make it decision-readyWhat decision is this for? (optional)Written for

No card · no API key · your figures are not stored

Overview

Everyone agrees postmortems should be blameless, and most are not. Not from bad intent: at midnight, "the config push at 17:40" is the easiest true sentence to write, and once a person is on the page the document stops being about the system.

This agent cannot name a person. It reconstructs the timeline from your logs, alerts and chat, separates what happened from what was believed at the time, and asks the questions that find systemic causes — why the alert did not fire, why the rollback took nine minutes, why the config could be pushed unreviewed at all.

Its action items are specific and testable, and it marks the ones that are really wishes. "Be more careful" is not an action item; "require review on production config changes" is. And it separates what is known from what is assumed, so next month nobody mistakes a theory in the document for an established fact.

Benefits

Written the same day

A postmortem written a week later is a reconstruction.

Safe to circulate

Nothing in it can be read as an accusation.

Actions that change something

Testable items instead of resolutions.

What it does

Cannot name a person
A hard rule, not a tone preference. It refers to roles and systems, which is what keeps it blameless.
Separates fact from belief
What was true, and what responders thought at the time. Both matter, and confusing them is how myths start.
Finds systemic causes
Not what triggered it — what made a trigger sufficient to cause an outage.
Action items you can test
Each one has an owner role and a check for whether it worked. "Be more careful" is marked as a wish.
Detection and recovery gaps
How long until anyone knew, and what made recovery slower than it needed to be.
Marks what is unknown
An unresolved question is a finding, not a hole to fill with a theory.

What this changes

What this changes about your week

It takes over: Turning an incident channel into a document with causes and actions.
Done today by: An engineer at midnight, or a week later from memory.
How often: Every incident.
Typical manual effort: A proper postmortem is half a day while everything is fresh.

Why IT & Service Management in particular. It cannot name a person. If one engineer could cause the outage alone, the system allowed it — and that is the finding that prevents the next one.

Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Incident Postmortem Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.

How it runs

This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.

1InputValidated against the agent input schema
2Modelclaude-sonnet-5 with automatic fallback
3Toolsextract_structured_data
4PermissionsRuns READ actions automatically; anything higher waits for approval
5OutputStructured result matching the output schema
6LoggingTokens, duration and every step recorded

Requirements

Integrations

No integrations required.

Before you start

The incident timeline — alerts, logs, chat, deploy history
Requires the Starter plan or higher

Use cases

After an outage

Turn the incident channel into a document in minutes.

Recurring incidents

Find the cause the last three postmortems missed.

Customer-facing summaries

A factual basis for what you tell customers, without internal detail.

Pricing

Starter

Billed monthly through your PROMIVO subscription. Cancel at any time.

Runs consume your plan allowance for agent executions and tokens. See plan limits

FAQ

Why will it not name who caused it?

Because if a person can cause an outage alone, the system allowed it, and that is the finding. Naming them ends the investigation early and teaches everyone else to be quieter during the next incident.

Can it write the customer-facing note?

It can draft the factual basis, without internal system detail. Whether and how to communicate an incident is a decision with commercial and legal weight, and stays with a person.

What if the timeline is incomplete?

It marks the gaps as unknown and lists what to check. A postmortem with a confidently invented middle is worse than one with an honest hole.

Reviews

Reviews open once customers have run this agent.

Need this agent to work differently?

Tell us what to change and our team will scope a customised version for your business.

Customize this agent

Incident Postmortem Agent

Fixing is where the time goes: 63% of an average incident is spent after acknowledgement.