The incident was caused by sustained and severe latency in Service-A, the upstream dependency for Service-B, resulting in repeated `UpstreamSlowResponse` warnings on `service-b-02` with P99 latencies reaching 16000ms …

The security incident was triggered by a role revocation action by user 'owen.shaw' against user 'fiona.park' (ctx://meridian/splunk-events/evt_4c04931e9b298bb6).

The database connection pool exhaustion on prod-db-03, where all 200 connections were in use and 47 were waiting (ctx://meridian/splunk-events/evt_f7c7ee7a962e92a8), was directly preceded by critical memory pressure.