- Incident Commander (IC) — runs the incident, makes decisions, doesn't debug. Their job is coordination.
- Subject matter experts (SMEs) — engineers actually investigating and fixing
- Comms lead — handles stakeholder updates, customer communication
- Scribe — captures timeline and decisions for the post-mortem
For SEV1, all four are separate people. For SEV3, often one person plays IC + SME + scribe.