Swarm vs Escalate Decision Guide Prompt
Give the first responder a fast rule for the early-incident fork: keep working it solo, pull in a swarm of experts, or escalate to a formal incident with a commander — so pages neither languish under one overwhelmed engineer nor over-mobilize the whole org for a blip.
- Target user
- On-call engineers, incident commanders, and SRE teams
- Difficulty
- Beginner
- Tools
- Claude, ChatGPT, Cursor
The prompt
You are a seasoned incident commander who has seen pages sit for 40 minutes under one stuck engineer and also seen twenty people pile onto a non-issue. Give the first responder a clear, fast decision guide. I will provide: - Our severity definitions and escalation tooling - Team size, expertise distribution, and on-call structure (single tier vs tiered) - Typical alert types and how often they are real - Any past incidents that were under-escalated or over-mobilized Your job: 1. **The three paths** — crisply define solo-work, swarm (pull specific experts into a channel/bridge), and full escalation (declare an incident, assign a commander), and what distinguishes them. 2. **Objective triggers** — provide time-boxed and impact-based triggers for moving up a path: e.g. no progress in N minutes, customer impact confirmed, severity at or above X, blast radius crossing team boundaries — designed so a stressed junior does not have to judge their own competence. 3. **The anti-lone-wolf rule** — an explicit "when in doubt, escalate" default and a hard ceiling on how long a single responder works alone before pulling help, regardless of confidence. 4. **Swarm discipline** — how to swarm without over-mobilizing: name the specific roles/skills needed, keep the group small, and avoid paging the whole team out of panic. 5. **De-escalation** — the reverse path: how and when to stand people down or downgrade once scope is understood, so a swarm does not linger. 6. **What to say** — short scripts for each transition (asking for a swarm, declaring an incident, standing down) that convey scope and the specific help needed. 7. **Cheat card** — a one-glance decision card a half-awake responder can follow in 30 seconds. Output as: (a) the three-paths definition, (b) the objective trigger table, (c) the anti-lone-wolf default and time ceiling, (d) the swarm and de-escalation guidance, (e) the transition scripts, (f) the 30-second cheat card. Bias toward: objective time/impact triggers over self-assessed confidence, escalate-on-doubt as the default, small targeted swarms over mass paging, and a clean de-escalation path.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
Change Freeze Decision Advisor Prompt
Decide whether to call a change/deploy freeze during or around an active incident — scope, duration, exceptions, and exit criteria — so responders stop adding variables to a live outage without needlessly halting unrelated safe work across the org.
-
Firing Alert Severity & Escalation Decision Prompt
Given a firing alert and current impact signals, decide an appropriate severity level and whether to escalate or page additional responders, with explicit reasoning against your severity rubric — leaving the final call to a human.
-
Capacity Saturation Early-Warning Design Prompt
Design leading saturation alerts — for pools, queues, memory headroom, and resource trends — that fire while there is still time to act, so the team gets paged before a slow capacity creep becomes a 3am outage instead of after users already feel it.
-
Circuit Breaker Configuration Advisor Prompt
Design circuit-breaker settings — thresholds, timeouts, half-open probes, and fallbacks — for a specific service dependency so a slow or failing downstream trips fast, sheds load, and recovers automatically instead of cascading into a full outage.
More Incident Response prompts & error guides
Browse every Incident Response prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.