What counts as an incident?
An incident is any action by a Digital FTE that should not have happened: a published claim that was wrong, a reply sent to the wrong category of customer, an entry proposed that misread the evidence, an auto-approved action that should have been gated. Near-misses caught at approval are worth recording too, because they show where the remit is thin.
Most incidents are not dramatic. They are a send-back that reveals a pattern, or an auto-approved class that produced one bad result. The plan is the same in every case, and it is short.
How do you stop?
Stop by stepping the affected class of action back to gated on the autonomy ladder, which is one change in the Setup tab and takes effect immediately, or by pausing the Digital FTE entirely if the scope is unclear. Both are logged with who did it and when.
If a connection is implicated, disconnect it from the workspace; that revokes the FTE's access to that tool at once. The wallet's hard stop is the last resort: an empty wallet pauses everything, though it is rarely needed when the finer controls exist.
How do you trace?
Trace by reading the audit trail for the action: the proposal the FTE made, the evidence it attached, whether it was approved by a person or auto-approved under a promoted class, who approved and when, and what effect it had. For a published page, that includes the fact-gate result; for a match, the documents; for a reply, the article cited.
The trace usually shows one of four causes: the remit did not cover the case, the connection allowed more than intended, a knowledge source was wrong, or a class was promoted before its approval history justified it. Each has a different fix.
- Remit gap: the case was not covered, so the FTE guessed or acted
- Connection scope: the tool allowed an action the role should not have
- Source error: the knowledge base or document the FTE relied on was wrong
- Premature autonomy: the class was promoted too early
How do you fix?
Fix the cause rather than the symptom. A remit gap gets a new rule or an addition to the always-escalate list. A connection scope problem gets a narrower credential at the tool. A source error gets a corrected article or document, which the FTE will then cite correctly. Premature autonomy gets the class stepped back until the approval record justifies it again.
Then revise the specific output if it is still live: unpublish or correct the page, follow up the reply, reverse the entry through the normal accounting process. The Digital FTE can draft the correction for approval, which keeps the fix in the trail too.
How do you record and rehearse?
Record the incident with the date, the action, the cause from the trace, and the change made. Keep it with the FTE's quarterly review, where the pattern of incidents and near-misses is the evidence for whether the remit and autonomy settings are right.
Rehearse once, before you need it, with a harmless example: pick an approved action, walk through the trail as if it were wrong, step the class back and forward, and confirm you know where each control is. An hour of rehearsal is what makes the plan usable on a bad day.
What does a rehearsed incident look like on the day?
On the day, a rehearsed incident is quiet. A support lead notices in the morning brief that a promoted reply category sent a reply that mentioned a refund it should have escalated. Within a minute they step that category back to gated in Setup, and the change is logged. Within five they have traced the reply in the audit trail: the ticket, the article the FTE cited, the note that it was auto-approved under the category's grant made three weeks earlier, and the reply text. The cause is visible: the ticket used a phrase the always-escalate rule did not catch.
Within the hour the rule is widened in the remit, the customer is followed up by a person with the FTE's draft of the follow-up attached for approval, and the incident is recorded with the date, the cause, and the change. At the next monthly review the category's record starts again from the step-back, and the lead decides whether a longer clean run is required before it is promoted a second time. Nobody reconstructs anything from memory and nobody has to find a credential to revoke, because the plan was rehearsed once with a harmless example and every step is a workspace action.