Decision Rights, Change Authority and the Incident Commander

All courses / AI Operations / Module 5 / Chapter 22

Learning objectives

After the lesson the participant can:

• Specify a decision right with holder, deputies, response time, evidence standard, record and ceiling for AI
• Apply the four rules about the position of the decider to a described situation
• Determine the concurrence needed for a failover from the status of its claim in the register
• Build a decision-rights matrix for the first ten decisions of a bad night

Key concepts

Decision right

The authority to take a defined decision and to be obeyed, written as a requirement with six fields: a holder role filled from a rota, two deputies, a response time, an evidence standard, a record and a ceiling for AI.

Position governs

Four rules: the authoriser does not run, the requester does not approve, the acceptor of a risk neither authors nor closes, and a conflicted holder passes the decision to a deputy and says so in the record.

Incident commander

The role that holds the incident by a written, pre-assigned authority, decides class and severity, hands over by a recorded briefing and has deputies who are as qualified. An assistant files what the commander approves and never classifies or speaks externally.

Change authority

The decision rights over what enters production: a standard change approved once as a class, a normal change approved by a peer and a gate, a small forum for exceptions, and an emergency change declared by a person and approved by the commander, never the requester.

Stop right

The right to stop an agent or hold a pipeline, held by listed roles including one reachable out of hours, without approval, through a mechanism outside the platform, drilled within 90 days. Restart is a separate decision by the agent owner at a lower level.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter does not forbid a failover on a failed claim. What does it require instead, and why is forbidding it the worse design?
2. A prohibition of Chapter 4 is not a risk to be weighed and cannot be accepted by anyone. What is the difference between that and a risk a named person may accept with an expiry?
3. At Hansa Mutual the night commander is also the agent operator. Which decisions become conflicted in that arrangement, and how should the profile resolve them?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. The failover claim for a service is expired. Under the chapter's table, what does the incident commander need before authorising the failover?

   1. Nothing further; the commander decides alone as for a verified claim
   2. A new passing restore test, run before the failover begins
   3. Approval by the change advisory board at its next meeting
   4. Concurrence by the head of SRE or deputy, by telephone, with the status stated
   Show the answer

   D. Concurrence by the head of SRE or deputy, by telephone, with the status stated
   For an expired or implemented but unverified claim the commander decides with the status stated and concurrence from the head of SRE or deputy, recorded with a time-boxed acceptance that ends with the incident.

2. What is the highest level at which AI takes part in breaking a freeze, according to the table of ten decisions?

   1. Level 0 Advisory: it reads and flags the conflict; never an agent
   2. Level 2 Supervised: it drafts the exception and files it after approval
   3. Level 3 Bounded: mandate circuit breakers lift the freeze and page a person
   4. Level 1 Assisted: it prepares and checks the target for the release
   Show the answer

   A. Level 0 Advisory: it reads and flags the conflict; never an agent
   Breaking a freeze is held by the commander and the head of SRE with a recorded exception. AI only reads and flags the conflict at Level 0 Advisory, in line with the Level 4 prohibition on acting inside a freeze.

3. Who approves an emergency change under the chapter's change authority?

   1. The agent that drafted it, if the gate computes the class as low risk
   2. The requester, since the requester knows the urgency best
   3. The incident commander, who is never the requester
   4. The weekly board, convened by telephone during the incident
   Show the answer

   C. The incident commander, who is never the requester
   An emergency change is declared by a person and approved by the commander, and the requester does not approve. An agent may draft the change at Level 2 but never chooses emergency or approves it.