Before running the lab, it helps to see the full structure as a single coherent picture.
| Role | Primary Responsibility | Reports To | Should NOT Do |
|---|---|---|---|
| Incident Commander (IC) | Overall response management, decisions | Nobody (top authority) | Write code, look at logs |
| Operations Lead | Tactical technical execution | IC | Make strategic decisions unilaterally |
| SME(s) | Deep technical investigation and fixes | Operations Lead | Go dark without updates |
| Scribe | Real-time documentation and timeline | IC | Filter or editorialize the record |
| Liaison | External stakeholder communication | IC | Let stakeholders contact engineers directly |
In a small incident (e.g., a single service down, two engineers responding), these roles may collapse. One person might be both IC and Ops Lead. Another might be both SME and Scribe. That is acceptable — the important thing is that the responsibilities are consciously owned, not that each role has a dedicated person.
As incident severity and team size grow, separating these roles becomes increasingly important. A SEV1 incident affecting millions of users with a 10-person response team should have all five roles explicitly staffed.