Designing an Escalation Path That Works Before You Need It
The worst time to figure out who to wake up is at 2am with a system down. An escalation path is the decision you make calmly, in advance, so nobody has to make it in a panic.
An escalation path is a predefined sequence: if a problem is not resolved or acknowledged within a set time, it moves to the next person or level with more authority or context. It exists to remove judgment from the moment of stress - so nobody has to decide, mid-incident, whether this is "bad enough" to bother a senior person.
A good path answers three things before anything breaks: what triggers an escalation, who it goes to at each level, and how long each level has before it moves up. Vague on any of the three and the path collapses into "someone messages whoever they can find".
Severity first, path second
Escalation only works if severity is defined. A shared, blunt scale - customer-facing outage versus degraded feature versus cosmetic bug - lets the path branch sensibly: a severity-one wakes people; a severity-three waits for business hours. Without severity levels, every issue either over-escalates (and people learn to ignore alerts) or under-escalates (and real fires smolder).
The most common design mistake is a single path for everything. That guarantees the path either cries wolf on minor issues or moves too slowly on major ones. Branch by severity and the same framework serves both.
Time-boxes and acknowledgement
- Every level has a clock. "Acknowledge within 15 minutes or it escalates" is a path; "escalate if it seems stuck" is a hope.
- Acknowledgement is distinct from resolution. The first level has to confirm they are on it, or the clock keeps running - otherwise a busy responder silently absorbs an incident nobody else knows is unhandled.
- The top of the path is a named human, not "management". Under pressure, ambiguity about who is at the top is where escalations die.
Testing it before the fire
An untested escalation path is a document, not a capability. Run a drill: trigger a mock severity-one and watch whether the acknowledgement actually happens, whether the next level actually gets pulled in, whether contact information is current. Most paths fail on something mundane - a stale phone number, a person who left, a channel nobody watches.
In Atlas, an escalation path can be encoded as an automation: an unacknowledged high-severity item reassigns and notifies the next level on a timer, so the escalation happens even when the first responder is heads-down or asleep, rather than depending on someone remembering the runbook.