the judgment layer · knowing where to stop
Escalation policy: who owns what when things break
In plain terms: this is the decision table for who handles what when something breaks — written down before anything breaks, so nobody has to improvise at 2am.
Ownership is settled here, before the incident exists — not in the incident channel while the clock runs. This is the table I work from as the Customer Success Engineer (CSE) responsible for this set of accounts: what I fix alone, what becomes an engineering ticket, and what wakes an engineer up right now. The thresholds are the same ones the board and the three cases run on.
The routing table
| Incident class | Detection threshold | First owner | Reasoning |
|---|---|---|---|
| The automatic status messages we send stop landing on the customer’s own software (webhook endpoint failing) | 6 consecutive terminal failures · 24h success < 97% | I handle it | The break is on the customer’s side; the fix is a call plus a re-send of the missed messages, not code (Case 1). |
| Orders nobody has picked up pile up in one ZIP code (stuck orders concentrating in a zone) | ≥5 unassigned 20 min past pickup window, one zone, one hour | I handle it | Handing the orders to another courier, and changing which courier is tried next, are both things I can do from the console (Case 2). |
| That whole ZIP code jams up (stuck orders saturating the zone) | ≥10 stuck in one zone | I handle it + call the customer | Past this point the customer choosing what to substitute or cancel beats anything our routing can do. |
| A courier — the company that actually drives the packages — stops taking jobs, and it hits several customers (provider capacity drop) | ≥2 accounts affected in one metro | I open an engineering ticket | Changing how much work each courier gets needs engineering review; meanwhile the CSE tells every affected account. |
| A courier sends back a status word our system does not recognize (unmapped or malformed status) | any unmapped status payload | I open an engineering ticket | Teaching the system a new status word is code. |
| Our own system answers “I crashed” when asked to hand orders to couriers, for everyone at once (delivery API 5xx, dispatch jobs erroring platform-wide) | 5xx rate above baseline, cross-account | wake up an engineer now | Nothing a console can fix, and every minute hits every customer at once, not just one. |
| Status messages go missing even though the customer’s side keeps answering “got it” (events missing while endpoints return 2xx) | endpoint success ≥ 99.5%, event volume falling | wake up an engineer now | The one webhook failure mode that is not customer-side; misclassifying it as Case 1 wastes the customer’s time and ours. |
| The customer’s finance team spots delivery costs climbing (provider-mix or cost anomaly) | customer-reported · no console alert | I handle it | Analysis and a recommendation (Case 3); routing changes ship only with customer sign-off. |
A message that fails is re-sent on a widening schedule; “terminal” means the last attempt failed too. Webhook health bands per the endpoint-health rubric (ASSUMPTIONS.md A9); stuck-order and zone-alert thresholds are illustrative operator policy (A12). Those thresholds render from the dataset; the remaining triggers (cross-account capacity, unmapped statuses, 5xx baseline) are illustrative policy with no dataset counterpart.
What this role should never touch
- Code deploys or hotfixes. A CSE shipping code is untested code in production; the fix belongs to whoever owns the deploy pipeline.
- Courier contract terms and rate cards. Commercial terms are negotiated, not triaged.
- Promising money back on my own (SLA credits). Working out what a missed on-time promise costs is this desk’s job; promising the money is a finance decision.
- Routing changes without customer sign-off. It is their delivery spend — this desk brings the math, they make the call.
- Pulling raw data beyond the account’s own book. One account’s incident is never a reason to see another account’s data.
Why the policy holds
The CSE takes everything that is settings, a phone call, or analysis — which is most of what breaks. Engineering gets only what is genuinely code. Holding that line in the owner column is what keeps a small platform team shipping roadmap instead of triaging noise.