3. Who is actually allowed to act at 2 a.m.?

Suggested expert: Eric Foster, with an independent incident leader reviewing the eventual answer. Why it matters: a fast alert can still wait for a slow approval path.

Context: EP271 discusses AI-native MDR and operational workflows.

Good-answer framing — editorial: separate detection, investigation, authorization, containment and recovery. Describe the exact event that starts each service clock, what happens when the customer cannot be reached, and which actions cannot be pre-authorized. Request a sanitized case including a difficult hand-off, not just the best outcome.

Follow-up: “What can your service not do under its standard terms, and how does the buyer discover that before signing?”