One-Person On-Call Is Not a Rotation

The answering behaved. The only one behaved. The chain between them is where working as designed stopped meaning working.

This is the thesis: one-person on-call is not a rotation, because a rotation requires someone to rotate to, and the absence of a second human means the first is the last, and the last is the failure point, and the failure point is the person, and the person is the system's weakness.

This is an opinion, and the constraint that makes single-person on-call common is real, and the rule of thumb at the end is where I land.

Why single-person on-call happens

The team is small, and the small is two or three engineers, and the rota with two people is alternate weeks, and the alternate is half the year on call, and the burden is the reason the third person is never added, so the single person becomes the default, because the default is the cheapest.

The reasoning is that the incidents are rare, and the rare is the low cost, and the low cost is the acceptable, and the acceptable is the single person. The reasoning holds right up to the outage that lands while the one person is asleep, and the missed page is the duration, and the duration is the cost, and the cost is the reason the rare is the wrong assumption.

The reasoning is also that the second person is the expense, and the expense should be compared to the incident's cost, and the incident's cost is the outage, and the outage is the revenue, and the revenue is the comparison that decides it.

Why the second human is the control

The second human is the escalation, and the escalation is the backup, and the backup is the asleep person's replacement, and the replacement is the coverage, and the coverage is the fix, because the incident does not wait for the person to wake, and the not waiting is the duration, and the duration is the cost, and the cost is the coverage's value.

The second human is also the second opinion, and the opinion is the check, and the check is the wrong path's catch, and the catch is the hour saved, and the saved is the duration, and the duration is the cost, and the cost is the opinion's value, because the alone person has no one to say try the other thing, and the no one is the tunnel, and the tunnel is the vision, and the vision is the hour, and the hour is the incident.

The second human is also the blame's removal, and the removal is the culture, and the culture is the system's property, and the property is the incident's cause, and the cause is the system rather than the person, and the rather is the fix, because the single person makes the incident personal, and the personal is the fear, and the fear is the hiding, and the hiding is the unreported, and the unreported is the undetected, and the undetected is the worse incident.

This is the same distinction as the estimate that is not a commitment, and the common root is the property, not the platform.

The constraint that makes it hard

The honest constraint is the team size, because a team of two cannot have a rotation with a second person on call without both being on call, and the both is the no rotation, and the no rotation is the reality, and the reality is the constraint, and the constraint is the legitimate case.

The legitimate case is narrower than it looks, because the second person does not have to be an engineer on the team, and the not engineer is the founder, the contractor, the managed service, the peer team, and the options are the escalation, and the escalation is the coverage, and the coverage is the fix, and the fix is the arrangement rather than the hire, and the arrangement is the cheaper control, and the cheaper is the argument.

Where no second human exists at all, the honest answer is that the system has no coverage, and the no coverage is the risk, and the risk should be stated rather than hidden behind a rota of one, and the stated is the decision, and the decision is the owner's, and the owner should know the coverage is absent.

The thumb rule I use

On-call needs a second human reachable within the escalation window, and the second human is the backup, the second opinion and the blame's removal, and the three are the coverage, and the coverage is the control.

Define the escalation window. The window is the minutes before the second person is paged, and the minutes are the contract, and the contract is the coverage, and the coverage is the fix, because the undefined window is the no escalation, and the no escalation is the alone.

Make the escalation automatic. The page escalates if the first person does not acknowledge, and the automatic is the coverage, and the coverage is the fix, and the fix is the configuration, and the configuration is the pager's, and the pager's is the one setting, and the setting is the control.

Write the runbook so the second person can act. The runbook is the knowledge, and the knowledge is the second person's ability, and the ability is the coverage, and the coverage is the fix, and the fix is the document, and the document is the discipline, because the second person without the runbook is the second person who cannot help.

Review the incidents for the coverage gap. The review asks whether a second person would have shortened the incident, and the ask is the measurement, and the measurement is the argument, and the argument is the hire, and the hire is the fix, and the fix is the evidence-based decision.

Where I land

A team of two can have coverage without a third hire, through an escalation arrangement, and the arrangement is the minimum. A team that has no second human reachable should say so plainly, because the rota of one is not a rotation, it is a single point of failure with a schedule attached.

The pager went off at three and one person carried it for four hours alone, and the hour lost to the wrong path was the hour a second opinion would have saved. Get that property wrong and every layer above it lies to you politely.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud