An incident runbook automatically restarts unhealthy workers when an event arrives. What design is essential?

1. Scoped permissions, idempotent actions, bounded retries, and safeguards against restart loops.
2. A tenancy administrator key in each event body.
3. Treating every event as proof the worker is permanently lost.
4. Unlimited restarts with no recorded outcomes.