Route by rule.
Escalate by SLA.

Alerts route to the post-holder by rule, not by who happened to be on the email thread. Acknowledgement clock starts at send. Breach the SLA and the escalation cascade is structural, not cultural — same engine for regulator notifications, crew briefings, and operational warnings.

Apply to be a partner Walk through an escalation

RULE ENGINE · LIVE

SAMPLE

ALERTS / 24h

142

+18 vs last 24h

SLA BREACH

0.8%

within target

AVG ACK TIME

6m 14s

tier 1 median

01THE RULE ENGINE

Every alert is a rule.
Every rule is a record.

Trigger, condition, routing, SLA — declared as structural records, not buried in a script. The post-holder sees the rule that paged them. The auditor sees the rule that fired. The accountable manager sees the rule the cascade follows.

OCCURRENCEseverity ≥ 4 · runway environment
Head of Flight Ops
fallback: Duty Officer
ack ≤ 15m
SPI BREACHunstable approach > UCL
SPI Owner · Flight Ops
cc: Safety Manager
ack ≤ 1h
REGULATORreportable per Annex 13
Accountable Manager
cc: Compliance Manager
send ≤ 72h
TRAININGqualification expiry T-30d
Training Standards
cc: line manager
send ≤ 24h

02FIVE MOMENTS NTF ANSWERS FOR

Five moments.
No paging the wrong person.

When a critical occurrence opens.
The post-holder is paged before the inbox refresh.
Severity 4 or above triggers a structural alert: routed to the right post-holder by role, location and on-duty status. Acknowledgement clock starts at send. No paging the wrong person at 03:00; no relying on someone seeing an email thread.
When an SPI threshold breaches.
Statistical drift becomes a routed event, not a chart annotation.
The SPC engine flags the breach; the rule engine routes it to the SPI owner with the affected runway, fleet or station already attached. The alert IS the record — not a screenshot pasted into a chat thread.
When a regulator notification is required.
The clock starts at the trigger, not at the meeting.
A reportable event opens with the regulator notification draft pre-formatted, the deadline known, and the accountable manager on the cc list before the briefing pack lands. Compliance is the default path, not an extra step.
When crews need a briefing distributed.
Same engine, different lane.
Operational notices, NOTAM-aware briefings, recurrent training reminders — same rule engine, same delivery model, same audit trail. Acknowledgement is per-recipient and tracked.
When an alert goes unacknowledged.
Escalation is structural, not cultural.
T+15 minutes without an acknowledgement and the backup is paged. T+30 and the accountable manager is on the call. The escalation chain is declared in the rule, not improvised under pressure.

03WHERE THIS CONNECTS

One engine.
Every escalation lane.

Whatever the source, the routing rule, the acknowledgement clock and the escalation cascade are the same model. Four examples that matter when the on-call phone rings.

SMS

Safety Management

Critical occurrences route to the post-holder by role and on-duty status; acknowledgement clock starts at send.

AIA

AI Analytics

Pattern-detection alerts arrive with the cluster attached — not "an issue may be emerging" prose.

CAP

Action Plans

SLA breach on a corrective action escalates structurally; the verifier is on the same alert as the owner.

OUT

Outsourcing

Provider SLA drift fires the same rule engine; the accountable manager owns the outcome, not the inbox.