Troubleshooting

Start with the narrowest failed boundary. Preserve the run ID, timestamp, system and identity before retrying; they are the join keys between the user-facing error, job state and audit evidence.

A connector test succeeds but import fails

1. Open the failed import and record its run ID.
2. Check whether discovery and the configured object type still agree.
3. Verify filters, pagination and permissions with the same credential.
4. Check whether another run is active or a stale run was closed automatically.
5. Correct the configuration and run once.

A connection test proves transport and authentication, not that every paginated object read is valid.

Imported accounts do not correlate

Compare the account's native identifier with the configured correlation field and the identity value actually imported. Check case, normalization and whether the field is included in the connector's read selection.

Do not repair this by broadening a rule until it happens to match. Correct the declared key or mapping, re-import, and confirm the same account now resolves.

Expected and Actual disagree

Open the row explanation. Identify whether the Expected source is a policy, role, approved request or explicit keep. Then confirm the latest import is fresh enough to represent Actual.

• Expected but not Actual: inspect the provisioning job or a held safety limit.
• Actual but not Expected: determine whether it is unmanaged access, a stale import or a missing governance source.
• Attribute mismatch: inspect read/write parity and mapping authority.

A provisioning job is stuck or ambiguous

Do not press retry until the target outcome is known. A timeout can mean the target applied the change but the acknowledgement was lost.

1. inspect the job attempt and target identifier;
2. query or re-import the target;
3. if the target already converged, close the uncertainty through reconciliation;
4. otherwise retry once after fixing the recorded failure;
5. escalate repeated or non-idempotent failures with the job and run IDs.

A safety limit holds work

Read the rule, system, measured value and threshold on the trip. Decide whether the proposed change is expected. Fix the cause before reset. Release is an explicit acceptance of the measured blast radius, not a way to clear a warning.

A hybrid agent is offline

Check the last heartbeat, supervisor state, outbound TLS reachability, token or keypair validity and local vault access. WebSocket loss alone is not an outage: long-poll is the fallback. Do not rotate credentials until you know whether the failure is authentication, transport or local connector execution.

Tier-3 does not claim exactly-once delivery or transparent failover. A timed-out task remains an explicit uncertain outcome and must be reconciled.

A managed deployment is unhealthy

Confirm the environment's provider and region before opening an infrastructure runbook. Preserve the failing health check, deploy identifier, migration state and first failure timestamp. Then use the provider-specific procedure for secrets, certificates, database recovery, monitoring or rollback.

Do not use an AWS RDS, KMS or Route 53 command as generic guidance for a Scaleway environment. Conversely, the current Scaleway compatibility-lab notes are not yet a supported production runbook. Escalate through the environment's agreed support path and include its provider adapter and region in the bundle. See Hosting, regions and deployment status.

Search returns no documentation

Try the product noun rather than a screen label. The search dialog records zero-result queries without identity data and offers a pre-filled feedback message. If the subject is customer-specific, contact support with the page, tenant, run ID and timestamp—but never include secrets.

Escalation bundle

Include:

• environment and tenant identifier;
• page or operation;
• timestamp with timezone;
• system, run and job identifiers;
• expected versus observed result;
• relevant audit or error text;
• whether a retry or manual target change already happened.

Exclude passwords, bearer tokens, client secrets and private keys.