Incident Labels: Tag for Future Search

Tagged incidents are findable. The tag schema.

Schema

The tag schema is the discipline that makes incidents searchable later. Bounded vocabulary; consistent application.

Service tag. Per-incident affected service; drives ownership routing and per-service incident counts.
Severity tag. Per-incident sev 1-5 label; drives prioritisation and SLO impact analysis.
Cause class. Per-incident deploy, vendor, capacity, config category; drives pattern recognition across the quarter.
Custom tags bounded. Per-team small named-extension list; catches tag-sprawl before it dilutes the signal.

The benefit is queryable history. Patterns surface at quarterly review when the tags are consistent.

Quarterly trend queries. Per-quarter "show all deploy-caused incidents" search; tagged data answers in seconds.
Pattern recognition. Per-quarter cause-class concentration; recurring patterns surface early enough to act on.
Trend analysis. Per-year incident-shape evolution; drives the "what should we invest in" decision with evidence.
Per-service incident profile. Per-service sev mix and cause mix; supports targeted investment, not generic reliability spend.

Enforcement is what keeps the schema useful. Required-at-close, gated by postmortem.

Required at incident close. Per-incident tag-or-no-close gate; tags applied before close, not retrofitted weeks later.
Postmortem gate. Per-incident no-approve-without-tags rule; the postmortem template enforces the schema.
Untagged equals lost data. Per-incident visibility cost; untagged incidents disappear from quarterly queries.
Per-quarter schema audit. Per-quarter tag-vocabulary review; catches drift and stale categories before they become noise.