incident-containment-planning

name	Incident containment planning
description	Create a prioritized, reversible containment plan based only on observed evidence. Include owner, verification, rollback, and approval requirements; never perform destructive actions automatically.

Incident containment planning

Create a prioritized, reversible containment plan based only on observed evidence. Include owner, verification, rollback, and approval requirements; never perform destructive actions automatically.

Output requirements:

• Cite observed evidence from the ticket.
• Mark unknown values as unavailable.
• Return structured JSON fields when requested.
• Do not change ticket status or execute commands.