Operational Triage: Framework, Review, and Communication.

You're designing the operational framework for Thabo Molefe, Cloud Infrastructure Lead at Thrive Digital Bank -- a Johannesburg retail bank, two million mobile customers, a six-person team, and a South African Reserve Bank audit that could happen at any time. He has theory and experience. He does not have a written framework, and the ad hoc response is starting to cost him.

The discipline skills: triage across competing priorities with named trade-offs (customer impact, fixed deadlines, deferral-with-communication); running a post-incident review that produces specific preventive measures, not "be more careful"; drafting stakeholder communication templates calibrated to audience (developer vs VP vs customer support lead); implementing one preventive measure as infrastructure -- a CloudWatch alarm for certificate expiration 30 days in advance plus the runbook that points at it; sketching an on-call rotation that fits a small team without burning engineers out.

The AI-direction lesson is that AI does not triage. Ask it "how should we handle this week" and it returns a sequential task list. The week has three priorities arriving at once. AI drafts a post-incident timeline from logs but stops at what happened -- the root cause asks why the system allowed it, and that requires context AI cannot infer. AI writes stakeholder communication in neutral corporate English; you calibrate to the banking register. You direct AI to structure each artifact, then judge the output against a context AI does not have.

Your Role

You're the dedicated hands Thabo does not have. He is pulled into incidents every week and cannot sit down for four days to design the framework, the templates, the alarm, and the rotation. He brings the context -- six engineers, fifteen dev teams, SARB audit expectations, the specific Tuesday when three things happened at once. You produce the framework, run the review with him, draft the templates, wire the preventive measure, and sketch the rotation. He reviews and signs off.

The collaborative register with AI continues but sharpens on judgment. AI can draft any single artifact. You supply what AI cannot infer and calibrate the draft to Thabo's team, Thabo's regulator, and Thabo's register.

What's New

Last time in Bengaluru you audited inherited infrastructure for Ananya, fixed a fragile state backend, imported a payment Lambda and two resized production EC2 instances, investigated load-bearing drift, renewed a TLS certificate, and produced a handover. The work was technical execution on a messy account.

This time the work is not technical. The repo at the end is small -- one CloudWatch alarm and a handful of markdown documents. What changes is how the team operates. You are designing processes for people, not resources for an account.

The hard part: nothing in the week is wrong to prioritize. The latency incident, the expiring certificate, the dev teams waiting on environments -- every triage choice has defensible alternatives. AI will give you a severity matrix from a textbook. It will not tell you whether a certificate expiring in 48 hours outranks an active customer-facing incident for Thabo's specific team. That call is yours, and you have to defend it.

Tools

• Claude Code -- drafting the framework, post-incident template, communication templates, alarm Terraform, and rotation sketch. Meta-prompting continues from P9 -- you direct AI to structure artifacts rather than hand you answers.
• Terraform CLI -- light use; a for_each CloudWatch alarm module covering every production-region certificate. No IAM (CloudWatch alarms don't reference a role for SNS notifications).
• AWS CloudWatch -- new usage pattern: reading metrics as post-incident evidence, and writing the certificate-expiration alarm.
• AWS Certificate Manager, AWS SNS -- the certificate evidence and the SNS topic the alarm publishes to.
• AWS CLI v2, AWS Console -- evidence gathering for the review.
• Markdown and a team wiki convention -- the framework, runbook index, templates, and handover are publishable documents.
• Git and GitHub -- new commit prefixes ops: and incident:.
• checkov, tflint, VS Code -- carrying forward.

PagerDuty and Slack are referenced in the rotation sketch and communication templates. You do not configure either in this project.

Materials

In the project folder:

• Kickoff-meeting notes (kickoff-meeting-notes.md) -- the entry artifact. Thabo's voice, his requirements, his team composition, the SARB constraint, and the concrete Tuesday. First meeting-notes medium in the track.
• AWS and CloudWatch evidence snapshot -- metrics showing the latency spike, Certificate Manager state at the time, the dev-team support tickets. Raw material for the review.
• Triage framework exemplar -- structure only. You write Thrive's version.
• Post-incident review template -- Google SRE-flavored. You adapt it to SARB's documentation expectations.
• CLAUDE-reference.md -- reference exemplar for operational-framework projects; structure only, you write your own CLAUDE.md.

No severity levels, no preventive measures, no communication templates, no alarm configuration, no rotation design, and no handover are provided. You produce all of them.