I Put a Hard Boundary Between Investigation and Remediation

The most important backend decision in an incident-response system is deciding what the agent is...