{"id":"cx-incident-internal-memo-validated-numbers","audience":"operations","category":"support-work","technique":"grounding","track":"support","level":"advanced","title":"Write a post-incident memo that uses only validated numbers","free":false,"task":"Write a memo with exactly three headings on their own lines, \"What happened\", \"Impact\" and \"What changes\", each followed by one short paragraph. Use only validated facts: the support team's deduplicated count, the cause confirmed in the review, and only the changes that were approved. Plain text with no # symbols, under 130 words.","materialLabel":"Your material (attached to your prompt automatically)","material":"POST-INCIDENT REVIEW NOTES - Oct 28\nTimeline (engineering log): errors began 09:12; full recovery 10:05.\nCause: engineer's draft said 'maybe an expired certificate'. Review meeting CONFIRMED the cause: a configuration push that set the wrong database limit. The certificate was checked and was fine.\n\nSupport data\n- Tickets tagged 'outage' in the dashboard: 112.\n- Of these, 28 were second or third tickets from the same customer.\n- Support lead: 'Impact is the number of different customers.'\n\nProposed changes\n1. Canary rollout for config pushes (approved, owner: Platform).\n2. Alert on database error rate (approved, owner: Platform).\n3. Text-message status alerts to all customers (idea only, not approved, no owner).\n\nNOTE: Do not name individual engineers in company-wide memos.","rules":[{"type":"plainText"},{"type":"maxWords","max":130}],"mistakes":[{"title":"Using the raw ticket count","why":"The AI says 112 customers were affected.","fix":"Say: \"Impact is different customers: 112 minus 28 repeats.\"","checks":["r1"]},{"title":"Repeating the draft cause","why":"The AI mentions the expired certificate.","fix":"Say: \"Use the confirmed cause only.\"","checks":["r1"]},{"title":"Including the unapproved idea","why":"The AI lists all three changes.","fix":"Say: \"Only approved changes.\"","checks":["r2"]},{"title":"Missing the headings","why":"The AI uses markdown headings or merges sections.","fix":"Name the three headings on their own lines.","checks":["r0","plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands well over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"promptHints":[{"label":"Names the three headings","patterns":["what happened","impact","what changes"]},{"label":"Uses validated facts","patterns":["confirmed","validated","approved only","only approved"]},{"label":"Says to deduplicate","patterns":["dedup","different customers","unique customers","minus 28"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]},{"label":"Sets a length limit","patterns":["\\d+\\s*words","word (limit|count)","under \\d+"]}],"hint":"Name the headings and say which numbers, causes and changes count as validated.","rubricLabels":["The memo has the headings \"What happened\", \"Impact\" and \"What changes\" on their own lines, in that order, each followed by one short paragraph","What happened says errors lasted from 09:12 to 10:05 (53 minutes) and the cause was a configuration push that set the wrong database limit, not an expired certificate; Impact says 84 customers (not 112)","What changes lists the canary rollout and the database error-rate alert, and does not mention text-message status alerts"]}