Escalation goes wrong two ways: things sit too long before someone senior is pulled in, or everything gets escalated and senior people drown. A clear escalation tree fixes both — it defines the tiers, the severity that sets the path, the time triggers that force escalation, and who owns each step. This skill designs that, so the right person is on the right issue at the right time.
Required Inputs
Ask for these only if they aren't already provided:
- The context — customer support, incident/on-call, or both.
- The tiers/teams available — tier-1/2/3, engineering on-call, management, exec.
- Severity meaning — what counts as critical vs. high vs. normal in your context.
- Constraints — hours of coverage, SLAs/contractual response times, key roles.
Output Format
Escalation Tree: [support / incident]
1. Severity levels — define each (SEV1/P1 … or Critical/High/Normal/Low) with concrete criteria — what qualifies, blast radius, and the response & resolution targets per level. Ambiguous severity is why escalation fails.
2. The tiers — who owns what:
| Tier | Owns | Can resolve | Escalates when |
|---|---|---|---|
| Tier 1 | first response, known issues | runbook items | unresolved in [time] or sev ≥ [x] |
| Tier 2 | deeper diagnosis | most issues | needs code/infra change |
| Eng on-call | code/infra | the system | — |
3. The tree (routing) — by severity, the path and the time triggers:
SEV1 → page eng on-call immediately + notify manager; if unacked in 5 min → secondary; if 15 min → eng lead. Normal → tier-1; if unresolved in 1 business day → tier-2.
Show the branch logic clearly (who, after how long, to whom).
4. Contacts & roles — by role (not just names — names change): who fills each, primary/secondary, and how they're reached per severity (page vs. Slack vs. ticket).
5. Customer communication — the update cadence per severity (e.g. SEV1: status-page + update every 30 min; normal: reply within SLA). Who owns the customer comms vs. the fix.
6. After — for high-sev, the handoff to a postmortem (pair with incident-postmortem).
Quality Checks
- Severity levels have concrete qualifying criteria + response/resolution targets
- Each tier's ownership and "escalate when" condition is explicit
- Escalation triggers are time-boxed (after N minutes/days), not "when needed"
- Routing is defined by role with primary/secondary and the contact method per severity
- Customer-communication cadence is specified per level, with an owner
- High-severity paths hand off to a postmortem
Anti-Patterns
- Do not leave severity fuzzy — if "critical" is subjective, everything becomes critical (or nothing does)
- Do not write "escalate when needed" — time-box it so issues don't rot waiting on judgement
- Do not route to named people only — use roles with primary/secondary; people leave and go on holiday
- Do not forget customer comms in the tree — internal escalation without customer updates still feels like neglect
- Do not over-escalate everything — tiers exist so seniors see only what truly needs them
Based On
Support & incident-management practice — severity matrices, tiered ownership, time-based escalation, on-call routing.