Post-Release & Learning · master area
De-escalation
De-escalation is as important as escalation. Lingering war rooms drain energy and create alert fatigue. Stand down deliberately — archive, check on the people who took the page. Not implicit. Not forgotten about.
Owners: On-call, Tech Lead, Incident Commander Phase it lives in: After We Build (Volume V) The corpus principle this enacts: Burnout from incident response is cumulative.
Where it lives in the chain
When to stand down
The incident is not over by feeling — it is over by named conditions:
- The issue is resolved — confirmed by monitoring, not by the absence of alerts.
- A stable workaround is deployed — if the full fix is staged for later.
- Investigation reveals lower impact than assessed — the page was right, the scope was smaller.
The commander stands the team down with an explicit message to the war room and the escalation chain.
What good de-escalation looks like
- Stand-down message — "Incident GR-INC-204 de-escalated at 10:47. Status: resolved, monitoring stable. War room closing. Postmortem scheduled for Wednesday at 14:00."
- Status page updated to resolved. The public timeline closes.
- War room archived — not deleted. The postmortem needs the record. The channel goes read-only, gets a "resolved" tag.
- Check on the people involved — "How are you doing?" not just "What happened?" The on-call who took a midnight page is a person before they are a resource.
- Postmortem on the calendar before anyone leaves the channel. Otherwise it slides.
The cost of unannounced de-escalation
A war room that just goes quiet leaves the team wondering whether the incident is actually over. The on-call stays anxious into the next cycle, sleeps badly, reads every monitoring spike as the same incident returning. Cumulative burnout shows up as silence in retros and slow review. De-escalation is the discipline that makes the team's next cycle viable.