During a major outage, your payment service is returning 503 errors to 40% of users. Your team identifies that a recent config change is the likely cause, but a full root-cause investigation could take an hour. The on-call engineer wants to keep debugging the live system to fully understand the failure before acting. As the SRE lead, which action best reflects sound incident management practice?