Escalation policy

Governance

The stated conditions under which a system must stop and involve a person.

What is an escalation policy?

An escalation policy states the conditions under which a system must stop and involve a person. It names the triggers and the role that receives the case, along with the information travelling with it. The policy is agreed before deployment, since an escalation route invented during an incident is no route at all.

Also called: Escalation path

Why a stopping condition has to be chosen in advance

Systems without an escalation policy do not stop. They continue, confidently, into territory nobody intended them to enter, and the first person to notice is usually the customer. A policy written afterwards describes what should have happened. What makes escalation real is that the system itself refuses to proceed, rather than flagging a case while completing it anyway.

  • A stated trigger makes the decision to stop independent of the operator's mood.
  • Escalation that completes the task anyway is a notification rather than a control.
  • The receiving role needs the context and the authority to decide differently.
  • Escalation rates are the clearest indicator of whether the boundary was set correctly.
  • Conditions have to be few enough to be honoured and specific enough to be tested.

How an escalation policy works

  • The categories reserved to a person are defined before the system is deployed.
  • Each trigger is expressed as a condition the system can evaluate itself.
  • On a trigger the work halts at a safe point and the state is preserved.
  • The case is routed to a named role with the evidence gathered so far.
  • The person's decision is recorded against the case with its stated reason.
  • Escalation volumes are reviewed so that triggers can be tightened or relaxed.

How an escalation policy is evaluated

An escalation policy is assessed on whether it fires when it should and on what happens next. Measure the following on live traffic:

  • escalation rate per trigger against the volume expected
  • share of cases halted at a safe point rather than completed
  • median time from escalation to a human decision
  • proportion of escalated cases where the decision was changed
  • count of incidents reached without any trigger firing

Limitations, risks and common failure modes

  • Triggers are defined so narrowly that nothing ever satisfies them.
  • Escalation routes to a shared mailbox nobody owns during a holiday period.
  • The system proceeds while the escalation is pending, defeating the purpose.
  • Volume pressure leads to triggers being relaxed without a recorded decision.
  • The receiving role lacks the authority to reverse what the system proposed.

Related terms

Human on the loopA person supervising a system that acts on its own, intervening by exception rather than by default.GuardrailsEnforced limits on what a system may do or say, applied outside the model rather than requested of it.Human in the loopA person inside the decision path, whose approval is required before the outcome stands.Data driftThe input distribution shifting away from what a system was evaluated on, which usually precedes model drift.Jailbreak resistanceHow well a system holds its constraints under deliberate attempts to remove them.RollbackReturning a system to its previous state after a change, which has to be planned rather than improvised.

All 315 terms