BUILD 019. 100 ALERTS ≠ 100 INCIDENTS. Repeated signals may describe one event.
CORRELATE. GROUP EVIDENCE FIRST. Preserve each source and state.
ASSESS. SCORE CONSEQUENCE TRANSPARENTLY. Keep severity, scale, rights, and reversibility visible.
ROUTE. AUTHORITY BEFORE AVAILABILITY. Notify the right owner, with reasons.
ACKNOWLEDGE. MISSED CLOCK → NAMED BACKUP. Record response or escalate.
ESCALATION. CHAIN—NOT VOLUME. Authority, evidence, time, recourse.