Exception and Escalation Protocol¶

Coordination protocol — instantiates Distributed Coordination Architecture

The pre-agreed path for when normal coordination fails — declare the exception, contain harm, hand time-limited interim authority to a named role, route the decision, then review and close.

An Exception and Escalation Protocol is the designed-in path for the cases normal coordination does not cover: a defined trigger declares an exception, harm is contained before anything else, time-limited interim authority is handed to a named role, the decision is routed to whoever can actually make it, dissent and review are preserved, and the exception is formally closed. Its defining move is the deliberate, temporary suspension of the standing decision rights — a break-glass that concentrates authority just long enough to act and then restores the normal envelope. It is not the everyday decision-rights grid (that governs routine choices) and not the crisis itself; it is the pre-agreed procedure that turns a moment where the rules break into an ordered response instead of a scramble for control.

Example¶

A payments service at a SaaS company starts failing during peak checkout. The normal change process — two approvals and a 24-hour window — is now useless; every minute is lost revenue and eroded trust. The protocol triggers on a defined severity (SEV-1): an incident is declared, and a named incident commander receives time-limited authority to bypass normal change control, pull engineers off their planned work, and speak for all the involved teams. Harm is contained first — the failing path is feature-flagged off — before anyone debates root cause. The decision routes fast through the commander; dissent is still logged, not silenced. When the service recovers, that authority reverts automatically and a review follows. The point is that none of this was improvised: the authority to act decisively existed before the crisis, so no one had to seize it.

How it works¶

Define the triggers that flip the system out of normal mode — thresholds, severities, or conflict conditions — so an exception is declared by rule, not by whoever panics first.
Contain before deciding. Limit the blast radius as the first act, buying time for a considered decision instead of a rushed one.
Grant time-limited interim authority to a named role. Emergency power must have an expiry, or it silently becomes permanent.
Route the decision and preserve voice — dissent, safety objections, and appeal survive the shortcut, so speed does not erase judgment.
Close explicitly and return to the normal decision-rights envelope, with the exception logged for review.

Tuning parameters¶

Trigger sensitivity — how easily an exception is declared. Too twitchy and everything becomes an emergency, eroding the normal rules; too stiff and harm compounds before anyone is empowered to act.
Interim-authority scope and duration — how much power the incident role holds and for how long. Broad-and-short concentrates decisiveness; narrow-and-long risks a creeping shadow authority.
Containment-versus-resolution priority — whether the protocol stops the bleeding first or drives at root cause first, which differ sharply under time pressure.
Voice preservation — how much dissent and appeal survive under speed; the floor below which the shortcut is no longer legitimate.
Return criteria — what counts as "over," so emergency authority cannot quietly outlive the emergency.

When it helps, and when it misleads¶

Its strength is that it prevents both failure modes of a broken plan at once — the deadlock where no one is empowered to act, and the chaos where everyone acts independently — and the built-in expiry keeps emergency power from hardening into permanent rule. Its central failure mode is informal escalation by status alone: the most senior or loudest person simply takes over, which is exactly the ungoverned reflex the protocol exists to replace. The mirror failure is the "temporary" war room that never stands down, becoming shadow governance under an emergency banner. Its classic misuse is declaring an exception to route around a control someone finds inconvenient — using break-glass as a routine backdoor. The discipline that keeps it honest is that every exception is logged, time-boxed, reviewed, and closed, and its interim authority is anchored in a real named model of bounded emergency command rather than improvised on the spot.^[1]

How it implements the components¶

An Exception and Escalation Protocol fills the break-glass components — the parts a conflict-and-exception path can own:

exception_escalation_and_conflict_path — it is that path: trigger, containment, interim authority, routing, review, appeal, return, and closure.
decision_rights_and_local_autonomy_envelope — it fills the emergency-exception slice of the envelope: the good-faith safety exceptions and time-limited interim authority that the standing rights must reserve for when normal rules fail.

It does not define the standing decision rights for routine operations (that is the Coordination Decision Rights and Autonomy Matrix), mine the closed exception for structural lessons (that is the After-Action Coordination Review), or track health signals such as unowned or recurring exceptions (that is the Coordination Health Review).

Instantiates: Distributed Coordination Architecture — the protocol is the architecture's resolution path for when normal coordination breaks.
Consumes: the Shared Coordination Board surfaces the raised flag that triggers escalation; the Coordination Decision Rights and Autonomy Matrix defines the normal envelope the protocol temporarily suspends.
Sibling mechanisms: Shared Coordination Board · Joint Operating Agreement · Coordination Decision Rights and Autonomy Matrix · After-Action Coordination Review · Synchronization Checkpoint · Coordination Health Review

Notes¶

The protocol's legitimacy depends on being pre-agreed — ideally ratified in the Joint Operating Agreement — before the crisis. Interim authority that is negotiated mid-incident is precisely the failure the mechanism exists to prevent: if the parties are still arguing about who is in charge while harm spreads, there is no protocol, only a scramble.

References¶

[1] The Incident Command System (ICS) is a real, widely adopted emergency-management framework built on exactly this principle — a named commander holding clearly bounded, time-limited authority during an incident, dissolving on return to normal operations. It is the model behind the "incident commander" role used in software operations and many other domains. ↩