Writing On-Call Runbooks With LLMs in November 2026: Start From a Real Incident, Write Commands You Have Actually Run, and Test Every Step on a System You Can Afford to Break
A runbook is the page an on-call engineer opens at 2 a.m. when a service is already failing. It should name the symptom, list the checks that distinguish causes, and give commands that work on the system you actually run. The usual prompt, "write a runbook for checkout-api," tends to produce a generic outline: check the dashboard, look at the logs, restart the pods, escalate. That reads fine in daylight and falls apart during an incident, because the dashboard URL is invented, the restart command does not match your orchestrator, and the escalation path names a role nobody has. This guide shows a workflow where you collect a real incident and the commands you already trust, let the model organize them into a usable page, and only keep steps you have run yourself on a system you can afford to break. A runbook is a checklist you follow under pressure, not a document you invent after the alert fires. Image: Preflight checklist by U.S. Air Force, Public domain, via Wikimedia C...