Standing orders: who decides when you're off the grid

Every small team has a moment where the on-call engineer faces a decision, the person who normally makes it is on a plane, and the incident clock is running. Without written authority, the choice collapses into one of two bad modes: improvise (and hope), or wait (and watch the damage compound). Standing orders fix this the way the military fixed it centuries ago: pre-authorized decisions, in writing, with limits. The leader's intent is on paper, so the person on the spot can act fast within it — and knows exactly where the line is. This page is the one-page template that pairs with the severity matrix (which says how loud an incident is) and the paging policy (which says who gets woken); standing orders say what that woken human may do before anyone else answers.

Standing orders are not a RACI. A RACI matrix assigns owners for planned work. Standing orders govern the unplanned: they answer “while the owner is unreachable, what is already approved?” If your RACI says the CTO decides on customer refunds and the CTO is asleep, your incident needs a refund decision at 3 a.m., standing orders are the only thing standing between your on-call and a coin flip.

1. The five sections of one page

One page. If it takes two, it will not be read at 3 a.m.

• Scope and duration. Which situations the orders cover (production incidents, sev1–sev2, customer-impacting events) and when they lapse. Standing orders without an expiry are how a improvisation from one bad Friday becomes permanent policy.
• The decision-rights ladder. Four tiers, written as verbs: Tier 0 — act alone, no notice needed (restart the stuck worker). Tier 1 — act, then notify within 30 minutes in the incident channel (fail over to the replica). Tier 2 — ask first if anyone is reachable within 15 minutes, act alone if not (drop the feature-flag default, extend a maintenance window). Tier 3 — never act alone; escalate and contain (issue customer refunds, take the whole service offline, communicate a breach).
• Spend and blast-radius caps. The numbers that make the ladder real: up to $200 emergency spend without approval; up to 10% of customers affected before consulting; data deletions are always Tier 3, no exceptions. A ladder without caps is a slogan.
• Comms commitments. Who is told what, within how long, in which channel. The on-call's duty does not end at acting — an action taken under Tier 1 that nobody hears about until standup is a trust debt with interest.
• Expiry and review trigger. Every order carries a review date (quarterly is enough) and an automatic review trigger: any use of a Tier 1/2 authority gets ten minutes in the next post-mortem, and any order used twice in a month is either promoted into process or killed.

2. Wiring it in one afternoon

• List the last 90 days of on-call decisions from incident channels and post-mortems. You already have the real list — standing orders just formalize what people did anyway. Ten rows is a good start.
• Write the ladder for your five most common calls. Restart/retry/rollback are usually Tier 0–1. Anything touching money, data, or customer communication starts at Tier 2–3 until proven otherwise.
• Name the caps with the person who owns the money (spend) and the person who owns the customers (blast radius). Caps written without them will be overridden in the first real incident, and overridden limits teach everyone that limits are suggestions.
• Publish where the incident runs. Link it from the severity matrix, the on-call handbook, and the incident template. Orders that live in a doc nobody can find are essays.
• Drill once. Fifteen minutes in the next game day: hand the on-call a scenario, no decision-maker reachable, watch them find the ladder. The drill is not for them — it is for the page, which will fail the first drill in an embarrassing and useful way.

3. The traps

• The hero clause. “Use your judgment” everywhere is not delegation, it is abdication with a nicer name — and it lands hardest on your most junior on-call, who will choose “wait” every time. Real limits are kinder than fake freedom.
• Orders that contradict the RACI. If the RACI says the platform lead decides rollbacks and the standing orders say Tier 1, the on-call will lose that argument mid-incident. Reconcile the two on the same day you publish.
• Silent expiry. Orders written for a migration that finished in March still authorizing database changes in December is how authority drifts. Review dates are not bureaucracy; they are the difference between standing orders and stale ones.
• Caps so low they are theater. A $0 spend cap means every real decision escalates and the ladder gets ignored. Set caps slightly wider than comfortable — the review trigger catches abuse better than a straitjacket does.

4. Worked example: a nine-person payments team

A nine-person payments company ran on-call with no written authority. A Friday-night incident (duplicate charges appearing on a subset of transactions) needed exactly one decision: pause the charging job. The on-call waited 40 minutes for the CTO, who was driving. The job ran 40 more minutes; 212 customers were double-charged instead of ~60, and the apology + refund batch took two weeks. The standing orders page they wrote afterwards was 1.5 pages: pause/rollback = Tier 1 (act, notify within 30 min), refunds = Tier 3 (never alone), emergency comms to affected customers = Tier 2 with the template pre-drafted. Six weeks later a similar incident ran the other way: on-call paused the job in 4 minutes under Tier 1, 19 customers affected, refunds done the same night, CTO read about it in the incident channel at 7 a.m. — exactly as designed.

5. Metrics

• Share of incident decisions made under written authority: target >90% by the second month — the ladder should cover the decisions that actually recur.
• Median time-to-decision for Tier 0–1 calls: minutes, not hours. Track it before and after; the delta is the whole ROI of the page.
• Orders past their review date: 0. An expired order is worse than none — it has the aura of authority without the validity.
• Escalations that come back as “you should have just decided”: every one is a missing row in the ladder. Log them; that is your backlog.

From the HIVE80lab kit

• The First 30 Minutes — free incident quick-start
• Ops Starter Kit — incident response for small teams — $14
• Ops Starter Kit Vol. 2 — advanced incident response & communications — $27
• Ops Mega Bundle — all 5 kits in one download — $49

Related: the RACI matrix template assigns owners for planned work — standing orders cover the gap when that owner is unreachable, the severity matrix sets how loud the incident is, and the paging policy decides which human gets woken and sees the ladder first.