Runbooks
Auth Incident Response
Steps for handling authentication and authorization incidents.
Trigger Conditions
- Sudden auth failure spikes
- Unauthorized access signals
- Session/token anomalies
Immediate Actions
- Confirm blast radius and affected surfaces.
- Freeze risky deploys.
- Increase auth logging verbosity.
- Revoke compromised sessions/tokens if confirmed.
Recovery
- Patch root cause.
- Verify via synthetic auth journeys.
- Monitor error and security metrics for at least one release window.