GuardCore · Incidents
Incidents with a clock that escalates without being asked
An acknowledgement clock and a response clock, each scaled by severity and measured against the site’s own minutes — swept in the background, escalated once per level.
The problem this solves
An incident register is the easiest thing in this industry to build and the easiest to make worthless. Rows go in, nobody is accountable for any of them, and the monthly report counts incidents rather than answering the only question a client has: when you knew, how long did it take you to do something?
GuardCore runs two clocks. Acknowledgement comes from an organisation setting; response comes from the site’s own SLA minutes, so a site that bought a five-minute response is not judged against a company-wide fifteen. Both are scaled by severity — critical gets half the time, low gets four times — and both are swept by the background worker, which escalates once per level and stamps the level it reached.
Acknowledgement means something because only the person it was given to can do it: the assigned investigator, the login behind the named guard, or an administrator. Everybody else is refused. And once an incident is closed, nine fields of the account of record refuse to change and it cannot be moved back out of closed — the record is finished being written.
One caveat worth stating before an evaluation finds it: "assigned" means an assigned investigator. An incident that has only a guard on it is not held to the SLA, because nobody has been given it yet.
Worked example
A high-severity incident is raised at a site with a ten-minute response SLA.
- 1
The number is allocated under a lock
Sequential per organisation, inside the same transaction as the incident and its audit event, so two operators cannot mint the same one.
- 2
Both deadlines are computed
Acknowledgement from the organisation setting, response from the site’s own minutes, each scaled by the severity.
- 3
Nobody acknowledges
The background sweep escalates: the organisation’s rules fire, a critical notification goes to the assignee, a broadcast goes out, the deliveries are recorded and the level is stamped on the incident.
- 4
It is investigated and closed
From closure, the account of record is locked — nine fields refuse to change, and the incident cannot be reopened. Only whether the customer can see it stays editable.
The response time on the monthly report is the one the system measured, not the one somebody remembered.
Capabilities
What incidents gives you
7 of these 8 are in the product today; the rest carry a badge saying what they actually are. Each one names what it is built on.
Incident register
LiveEvery incident with its severity, site, status and the guard who raised it, over quick filters and a saved-view expression — and a client role is served a narrower column list in the query rather than a hidden column in the page.
Incident numbers that cannot collide
LiveINC-0001 upward, sequential per organisation, allocated under the organisation’s own row lock in the same transaction as the incident and its audit event — so two control-room operators cannot mint the same number.
Two SLA clocks, scaled by severity
LiveAn acknowledgement clock and a response clock, each scaled by severity — a critical incident gets half the time, a low one four times — measured against the site’s own response minutes rather than one organisation-wide number.
Acknowledgement by the person it was given to
LiveOnly the assigned investigator, the guard it belongs to, or an administrator may acknowledge — anybody else is refused, a second acknowledgement is harmless, and an incident already resolved cannot be acknowledged at all.
A closed incident stops changing
LiveNine fields of the account of record are refused once an incident is closed, and it cannot be moved back out of closed — only the flag deciding whether the customer sees it stays editable.
Photographs and files, served once
LiveEvidence is uploaded to a server-only directory behind a type allowlist, EXIF stripped, and read back only through one authenticated route scoped to the organisation — never from a public path a link could leak.
The incident report, and the shift’s own
LiveA letterhead PDF per incident and a filtered summary built from the same filters as the register, plus the Daily Activity Report that compiles a whole shift — the patrols, the welfare check-ins, the pass-down and any duress.
Countersigned incident closure
RoadmapA named approver signing off a closed incident. The fields exist and the record page shows them unfilled, because the approval step itself is not built.
On the roadmap. It is not built, not scheduled, and not something to plan a contract around.
What backs these claims
Each capability names the decision record, module, route or table it is built on. Ask us for any of them in an evaluation and we will walk you through the code.
- Incident register
- GET /api/imss/incidents · /imss/incidents · OpsIncidents.tsx · imss_incidents
- Incident numbers that cannot collide
- src/server/imss-incidents.ts allocateIncidentNumber · POST /api/imss/incidents
- Two SLA clocks, scaled by severity
- ADR 0047 · src/lib/incident-sla.ts slaDeadlines breachedLevel · src/server/imss-jobs/incident-sla.ts sweepIncidentSla
- Acknowledgement by the person it was given to
- ADR 0047 · src/server/imss-incident-acknowledge.ts isAssignee · POST /api/imss/incidents/:id/acknowledge
- A closed incident stops changing
- src/server/imss-incident-closure.ts LOCKED_AFTER_CLOSURE incidentMutationGuard
- Photographs and files, served once
- ADR 0009 · ADR 0016 · ADR 0023 · src/server/imss-incident-evidence.ts · imss_incident_evidence
- The incident report, and the shift’s own
- src/server/imss-incident-pdf.ts · src/server/imss-dar.ts · GET /api/imss/dar/:shiftId
- Countersigned incident closure
- src/server/imss-incident-closure.ts LOCKED_AFTER_CLOSURE
Where this sits
Back to
GuardCore — every capability in one place
The whole module: what is live, and what is only on the roadmap.
Read next
A control room screen for the shift actually in progress
Unresolved duress at the top, who is on duty from the roster, the open incidents, the patrols under way — and dispatch orders that move through six states, each stamping its own time.
Twenty minutes on a real contract.
Real data, four logins, nothing typed on the day — including the parts we have not built, which we will point out ourselves.