> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

Self-healing incidents

Most teams already have alerting. Something fires when a metric crosses a threshold or a check fails. The hard part is what comes next.

Too many alerts can point at the same problem, or no single signal is enough to tell a real incident from noise. A person still has to work out what changed, decide what to do, and fix it. Then they write up what happened so it does not happen the same way again. Most of that work is manual.

What this costs you​

Delayed resolution. Responders lose time assembling context from dashboards, chat, and tickets before they can act.

Time on low-severity noise. Pages and tickets pile up for alerts that never needed a full incident response.

Thin incident records. Ownership, diagnosis, and remediation live in Slack threads instead of a structured record the next responder can use.

Inconsistent response quality. The same failure gets a different investigation path depending on who is on call and what they remember under pressure.

The five stages​

Port breaks incident response into five stages. Most incidents move through them in order, and each stage has its own page with diagrams and implementation detail:

  1. Detect - build confidence that something is actually wrong, not just noisy.
  2. Diagnose - work out what changed and how bad it is.
  3. Recommend - weigh a few options, not just the first idea.
  4. Act - carry out the response inside limits set in advance.
  5. Learn - turn the outcome into a change to those limits.
Self-healing incidents five-stage flow: Detect, Diagnose, Recommend, Act, Learn
Not a strict cycle

These stages are not a fixed sequence. New evidence during Diagnose can send you back to Detect. An action that fails in Act can trigger another pass through Recommend.

Maturity levels​

Incident response maturity progression from Reactive (humans do all steps) to Systemic (learning runs continuously)

The five stages stay the same as you mature. What changes is how much of each stage an agent handles instead of a person:

  • Reactive - humans do all five steps by hand.
  • Augmented - agents diagnose and recommend, humans act. Most teams doing this today sit here.
  • Bounded - agents act on their own for a pre-approved set of low-risk, reversible actions.
  • Adaptive - eligibility and ranking update with live confidence and impact, not only that fixed pre-approved set.
  • Systemic - the Learn stage runs often enough that incidents get rarer, smaller, and more instructive over time.

Readiness work is how teams move up that ladder: a clear catalog, ownership, scorecards, SLOs, and on-call visibility. See ensure production readiness for the checks that harden services between incidents.

See it in Port​

The self-healing incidents pattern moves defined parts of incident response to agents, inside boundaries your team sets. Your team decides which steps an agent handles alone and which need a person to sign off.

On the incident record, Port:

  • Scores confidence from converging signals before an incident is declared.
  • Ranks eligible responses and explains the tradeoffs behind each option.
  • Runs workflows inside the approval gates you defined, and escalates when verification fails.
  • Records outcomes and proposes changes to thresholds and gates for human review.

This walkthrough of the incidents agentic workflow shows how that moves a team along the maturity ladder:

These guides help you implement parts of the model in Port today. More stage-specific guides will follow.

Start here

Detect

Diagnose

Act

Readiness

Communicate