A useful AI agent runbook does not only say what the assistant may do. It also says when the assistant should stop. Escalation notes give automation a clear boundary for uncertainty, repeated failure, missing permissions, risky side effects, and evidence that needs human review.

The goal is not to make every small task require approval. The goal is to keep autonomous work inside a safe lane and make handoff cheap when the lane ends.

What belongs in an escalation note

  • Stop condition: the exact signal that means the agent should not continue, such as destructive impact, unclear target, failed auth, or conflicting evidence.
  • Evidence bundle: the minimal logs, command outputs, URLs, diffs, counts, and timestamps needed for a human or next agent to resume.
  • Allowed diagnostics: read-only checks the assistant may still run while preparing the handoff.
  • Forbidden actions: state-changing steps that require explicit approval, such as deleting data, publishing, rotating credentials, or restarting critical services.
  • Success definition: the verification signal that would close the incident or maintenance task.

Runbook checklist

  1. Write escalation criteria before scheduling unattended automation.
  2. Separate temporary errors from true blockers with retry limits and backoff rules.
  3. Collect evidence without printing secrets, personal data, private paths, or account identifiers.
  4. Make no-work runs silent and escalation runs concise.
  5. After a human resolves the issue, update the runbook with the new verification signal or stop condition.

Copyable safe delegation prompt

Review this runbook for escalation safety. Identify stop conditions, read-only diagnostics, forbidden state changes, evidence to collect, and verification signals. Do not execute publishing, deletion, credential changes, restarts, migrations, purchases, or external messages. Return a concise handoff note that contains only privacy-safe evidence.

A compact handoff format

Escalation notes work best when they are short enough to paste into an issue, ticket, or follow-up prompt:

Status: blocked / needs review
Target: generic service, page, job, or file class
Observed signal: privacy-safe error summary
Diagnostics run: read-only checks only
Evidence: summarized counts, timestamps, and sanitized snippets
Do not do: listed state-changing actions
Suggested next step: human approval or specific manual check
Verification: signal that proves the fix worked

Rule of thumb: if an AI assistant has to guess whether an action is safe, the runbook needs an escalation note.