> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Writing the Three Pointer Incident Report > How to write concise incident reports using a three‑point check, identify missing ownership metadata, and use FinOps AI agents to enforce resource labeling and reduce MTTR and operational cost After you resolve an incident, the next critical step is writing a concise incident report that captures the root cause, impact (including any GMV — gross merchandise value — losses), and recommended remediation and follow-up actions. For organizations like SkyLine Air, clear documentation of these details prevents repeat failures and reduces long-term operational cost. A focused root cause analysis helps teams learn and harden systems. The approach we use here is a simple, repeatable three‑point check that surfaces whether the problem was one of access, visibility, or ownership. The three checks 1. Cluster access — Could we identify and log into the cluster? 2. Service and logs — Could we find the service and read its logs? 3. Independent fix — Could we independently fix the issue, and if not, why? ![The image shows a slide titled "A Three-Point Check" with three rounded cards: "01 Cluster access" (steps like identify the cluster and access to log in), "02 Service and logs" (find the service and read its logs), and a greyed-out "03 Independent fix? Coming up..." card.](https://mintcdn.com/kodekloud-c4ac6d9a/rjGeTDj8cr6D5YbW/images/Building-Kubernetes-FinOps-AI-Agent/The-Problem-Statement/Writing-the-Three-Pointer-Incident-Report/three-point-check-cluster-service-logs.jpg?fit=max\&auto=format\&n=rjGeTDj8cr6D5YbW\&q=85\&s=8601690b1fbf7964eb3469d19e8676e4) Applying the three checks to this incident * Cluster access: We identified the cluster and logged in — access was not the issue. * Service and logs: We found the service and read its logs — visibility was sufficient. * Independent fix: This is where the incident failed the test. ![A dark-themed slide titled "The Third Point" asking "Could you fix it independently?" with a highlighted "No." It shows two boxed points: "We know the error — But not what caused it" and "We don't even know which team owns it."](https://mintcdn.com/kodekloud-c4ac6d9a/rjGeTDj8cr6D5YbW/images/Building-Kubernetes-FinOps-AI-Agent/The-Problem-Statement/Writing-the-Three-Pointer-Incident-Report/third-point-no-fix-unknown-team.jpg?fit=max\&auto=format\&n=rjGeTDj8cr6D5YbW\&q=85\&s=797106bcbcdf4cb8d1e929cc79808e32) Summary table: checks and outcomes | Check | Outcome | Why it matters | | - | - | - | | Cluster access | Success | You can reach the control plane and run diagnostics. | | Service & logs | Success | Logs show symptoms, but not always root cause. | | Independent fix | Failure | No ownership metadata — could not assign a durable fix or contact the right team. | What happened and why it matters We patched the symptom to restore service availability, but we could not implement a durable fix. The immediate reasons: * The error message was visible, but it did not indicate the underlying cause. * The service lacked ownership metadata, so responders could not determine which team to involve for a long‑term resolution. Patching a symptom is a valid short‑term incident response action, but it should be followed by a root cause remediation and ownership assignment to prevent recurrence. ![A dark blue status screen that reads "Patched, Not Solved" with a highlighted message saying "Incident patched — Short-term fix only." Below it is a circular cartoon avatar labeled "You" and a small KodeKloud logo in the corner.](https://mintcdn.com/kodekloud-c4ac6d9a/rjGeTDj8cr6D5YbW/images/Building-Kubernetes-FinOps-AI-Agent/The-Problem-Statement/Writing-the-Three-Pointer-Incident-Report/patched-not-solved-short-term-fix.jpg?fit=max\&auto=format\&n=rjGeTDj8cr6D5YbW\&q=85\&s=6589bfec8e9726dee5ad64b8549d63b0) Root cause: missing ownership metadata In this incident the primary root cause was simple: services did not include basic owner/contact labels. When resources are missing `owner` or `communication` tags, responders waste time hunting for the right team — time that increases customer impact and GMV exposure. A minimal set of labels significantly improves incident response speed and accountability. Example Kubernetes service metadata: ```yaml theme={null} kind: Service metadata: name: payment-gateway labels: slack-channel: "payments-team" owner: "payments-oncall" ``` Adding and enforcing standard labels such as `owner` and `slack-channel` (or `pagerduty`/`oncall`) on Kubernetes resources makes incident response faster and enables better accountability. How FinOps + AI agents help A FinOps / AI agent can automate enforcement and remediation of labeling and tagging best practices across clusters. Key capabilities include: * Automated scanning for untagged or mis‑tagged resources. * Ownership lookup and automatic escalation routing (Slack, PagerDuty). * Remediation suggestions and policy enforcement to prevent future drift. ![A presentation slide titled "The Premise of This Course" that lists two points: "What is FinOps?" (with a dollar icon) and "What is an AI Agent?" (with a robot icon).](https://mintcdn.com/kodekloud-c4ac6d9a/rjGeTDj8cr6D5YbW/images/Building-Kubernetes-FinOps-AI-Agent/The-Problem-Statement/Writing-the-Three-Pointer-Incident-Report/course-premise-finops-ai-agent.jpg?fit=max\&auto=format\&n=rjGeTDj8cr6D5YbW\&q=85\&s=7f6bef8fd30fc6597bd8d6d99781f2e5) Why consistent ownership and tagging matter Most modern organizations run critical services on Kubernetes. Without consistent ownership and tagging, common problems emerge: * Orphaned applications with no clear owner. * Incorrect or inconsistent deployments. * Mis‑tagged resources that complicate billing and FinOps. * Increased mean time to resolution (MTTR) due to lack of contact information. ![A dark-blue presentation slide showing the Kubernetes logo with the heading "Why This Matters" and the question "Which company today isn't running Kubernetes?". A small KodeKloud watermark appears in the bottom-left corner.](https://mintcdn.com/kodekloud-c4ac6d9a/rjGeTDj8cr6D5YbW/images/Building-Kubernetes-FinOps-AI-Agent/The-Problem-Statement/Writing-the-Three-Pointer-Incident-Report/kubernetes-why-this-matters-slide.jpg?fit=max\&auto=format\&n=rjGeTDj8cr6D5YbW\&q=85\&s=80ee28a8063189e07eaa60f9ee353871) The operational pain this causes These gaps — unowned apps, wrong deployments, incorrect tags, and missing owners — create sustained pain for SRE and DevOps teams and raise operational cost. ![A slide titled "The Real Pain" showing four rounded cards with red icons labeled "Orphaned apps," "Wrongly deployed," "Wrongly tagged," and "No owner." A small avatar and partial caption reading "A real pain for every" appear below.](https://mintcdn.com/kodekloud-c4ac6d9a/rjGeTDj8cr6D5YbW/images/Building-Kubernetes-FinOps-AI-Agent/The-Problem-Statement/Writing-the-Three-Pointer-Incident-Report/real-pain-orphaned-apps-no-owner.jpg?fit=max\&auto=format\&n=rjGeTDj8cr6D5YbW\&q=85\&s=52651fe76ebacfc59676725ff4037be1) What you will get from this series You will learn practical, implementable measures to prevent and detect ownership and tagging gaps, and how to build an AI‑enabled FinOps agent that enforces those practices. By the end of the course you will have a project you can adapt and deploy in your organization to: * Reduce MTTR by surfacing ownership metadata. * Improve accountability and escalation workflows. * Prevent FinOps leakage caused by mis‑tagged resources. Next steps With this premise established, the following material covers remediation patterns, policy enforcement, and an implementation path for a FinOps + AI agent that closes the ownership gap. References and further reading * Kubernetes Documentation: [https://kubernetes.io/docs/](https://kubernetes.io/docs/) * Incident Response and Postmortem Best Practices: [https://landing.google.com/sre/sre-book/chapters/postmortem-culture/](https://landing.google.com/sre/sre-book/chapters/postmortem-culture/) > **[Watch Video](https://learn.kodekloud.com/user/courses/building-kubernetes-finops-ai-agent/module/5d434b76-bd5d-4526-b9c6-4a994c195994/lesson/ebd4ace8-7f70-4412-940f-6274f5ac6a9a)** This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.