The Single Source of Authority
The most crucial role in any incident response is the Incident Commander (IC). There can only be one IC at a time, and their authority is absolute during the incident. This is not a suggestion — it is the foundational rule that makes everything else work. When two people share IC authority, you get conflicting decisions, confused responders, and wasted time.
The IC's job is not to fix the technical problem. Their job is to manage the response to the problem. Think of them as the conductor of an orchestra. The conductor doesn't play the violin; they ensure all the musicians are playing together, at the right tempo, and following the same sheet music. A conductor who puts down their baton to play violin has just left the orchestra without direction.
Key Responsibilities of the IC
Situational Awareness: The IC maintains the "big picture" — the current state of the system, what is known, what is unknown, and what is being worked on. They deliberately stay slightly detached from the technical details to preserve this view.
Decision Authority: The IC is the final decision-maker on all response actions. "Do we roll back the deployment or attempt a fix-forward?" "Do we fail over to the secondary region?" These calls belong to the IC. They may consult SMEs, but they own the decision.
Task Assignment and Tracking: The IC assigns work to specific people and ensures every active workstream has a clear owner. Unowned tasks are the most common way critical steps get missed during an incident.
Lifecycle Management: The IC drives the incident through its stages — from detection and triage, through active mitigation, to resolution and handoff to post-incident review. They call the "all clear" when the incident is resolved.
Crucial Rule: If you are the IC, you should not be looking at logs or writing code. The moment you dive into the technical details, you lose situational awareness and the team loses its coordinator. If you genuinely need to investigate something technical, you must formally hand off the IC role to someone else first.