Build `incident_severity(error_rate, p99_ms, users_affected)` returning one of `"SEV1"`, `"SEV2"`, `"SEV3"`, or `"SEV4"`: 1. `error_rate > 0.5` OR `users_affected > 10000` → `"SEV1"` (page on-call immediately — blast radius is massive). 2. Else if `error_rate > 0.1` OR `p99_ms > 2000` → `"SEV2"` (degraded; respond within 15 min). 3. Else if `error_rate > 0.01` OR `p99_ms > 500` OR `users_affected > 100` → `"SEV3"` (visible; respond same business day). 4. Otherwise → `"SEV4"` (cosmetic; file a ticket for the backlog). The order matters — higher severity wins on overlapping conditions.