station 4 · the judgment layer
Escalation policy: who owns what when things break
Ownership is decided here, before the incident exists — not in the incident channel while the clock runs. This is the routing table I work from as the CSE on this book: what I resolve alone, what becomes an engineering ticket, and what pages engineering right now. The thresholds are the same ones the board and the three cases run on.
The routing table
| Incident class | Detection threshold | First owner | Reasoning |
|---|---|---|---|
| Customer webhook endpoint failing | 6 consecutive terminal failures · 24h success < 97% | CSE resolves solo | Fault is customer-side; the fix is outreach plus re-sync, not code (Case 1). |
| Stuck orders concentrating in one zone | ≥5 unassigned 20 min past pickup window, one zone, one hour | CSE resolves solo | Re-dispatch and fallback config are console operations (Case 2). |
| Stuck orders saturating a zone | ≥10 stuck in one zone | CSE + call the customer | Past this point their substitution decisions beat our routing decisions. |
| Provider capacity drop across accounts | ≥2 accounts affected in one metro | CSE opens eng ticket | Routing-weight changes need engineering review; the CSE notifies every affected account meanwhile. |
| Provider integration returning malformed or unmapped statuses | any unmapped status payload | CSE opens eng ticket | Status-taxonomy mapping is code. |
| Delivery API 5xx / dispatch jobs erroring platform-wide | 5xx rate above baseline, cross-account | page engineering now | Nothing a console can fix; every minute is cross-book. |
| Webhook events missing while endpoints return 2xx | endpoint success ≥ 99.5%, event volume falling | page engineering now | The one webhook failure mode that is not customer-side; misclassifying it as Case 1 wastes the customer’s time and ours. |
| Provider-mix / cost anomaly flagged by customer finance | customer-reported · no console alert | CSE resolves solo | Analysis and a recommendation (Case 3); routing changes ship only with customer sign-off. |
Webhook health bands per the endpoint-health rubric (ASSUMPTIONS.md A9); stuck-order and zone-alert thresholds are illustrative operator policy (A12). Those thresholds render from the dataset; the remaining triggers (cross-account capacity, unmapped statuses, 5xx baseline) are illustrative policy with no dataset counterpart.
What this role should never touch
- Code deploys or hotfixes. A CSE shipping code is untested code in production; the fix belongs to whoever owns the pipeline.
- Provider contract terms and rate cards. Commercial terms are negotiated, not triaged.
- Unilateral SLA credit commitments. The exposure analysis is this desk’s job; the commitment is a finance decision.
- Routing changes without customer sign-off. It is their delivery spend — this desk brings the math, they make the call.
- Raw-data exports beyond the account’s own book. One account’s incident is never a reason to see another account’s data.
Why the policy holds
The CSE absorbs everything that is configuration, communication, or analysis — which is most of what breaks. Engineering receives only what is genuinely code. The discipline in the middle column is what keeps a two-pizza platform team shipping roadmap instead of triaging noise.