Most post-incident reviews die in a doc nobody reopens. Not because teams don't care — because the template asks for a novel.
Here is the 15-minute version: four fields, one owner each, done before the coffee gets cold.
Field 1 — What the customer experienced
One sentence, in customer words. Not "API latency", but "invoices failed to send for 40 minutes". If you can't write this sentence, you don't understand your own incident yet.
Field 2 — The earliest signal we ignored
Every incident has one. A failed job at 2:14, a retry storm, a dashboard nobody opens. Name the exact signal and where it lived. This is where your paging rules come from — not from a framework.
Field 3 — The fix that actually worked
Not the fix you planned — the one you did. Restart, config flip, rollback. Record it verbatim so the next on-call can copy it under pressure.
Field 4 — One guardrail, shipped this week
Exactly one. An alert threshold, a retry cap, one checklist line. Reviews with five action items ship zero. Reviews with one ship a guardrail every week.
That's the whole review. Four fields, 15 minutes, every incident, no exceptions. After 30 days you have 30 guardrails — most teams have none.
If you want the full kit (paging rules, review templates, runbook starters for small IT teams), I packaged it here: Agent Ops 24/7 kit. More field notes at dev.to/hive80lab.
