Create an AI-Agent Escalation Policy

#CONTEXT:
Create a review-ready escalation policy for one bounded AI-agent job. This is a policy draft for named human owners, not authority to operate or alter an agent.

#INPUTS:
- Agent job, trigger, inputs, decisions, outputs, completion, non-goals, and normal owner: [AGENT JOB]
- Allowed actions, prohibited actions, and actions that require human approval: [ALLOWED AND PROHIBITED ACTIONS]
- Supplied critical failures, uncertainty triggers, stop conditions, and incident definitions: [CRITICAL FAILURES AND STOP CONDITIONS]
- Named primary human owners, backups, technical responders, and decision rights: [ESCALATION OWNERS AND BACKUPS]
- Approved response and resolution SLAs, measurement basis, and consequence of no response: [ESCALATION SLAS]
- Approved systems, environments, source authority, access boundaries, and data classes: [SYSTEMS AND DATA CLASSES]
- Explicit approval gates for exception, communication, financial, access, production, restart, and authority decisions: [APPROVAL GATES]
- Manual fallback, backlog capture, reconciliation, rollback, restart evidence, and restart owner: [FALLBACK AND RESTART RULES]

#INSTRUCTIONS:
1. Map each supplied trigger to its evidence or source attribution. Label missing facts Unknown and incompatible instructions Conflict—human resolution required.
2. Define severity only from supplied rules. Do not infer a severity, SLA, threshold, owner, or approval right from examples or common practice.
3. For each trigger, specify the immediate fail-closed state, work preservation, evidence packet, named human owner, backup, allowed wait-state behavior, and explicit approval gate.
4. Include triggers for missing or conflicting sources, low confidence, out-of-scope requests, prohibited actions, changed permissions, expired credentials, tool failure, partial write, retry ambiguity, duplicate risk, privacy or security concern, data-class mismatch, monitoring gap, and critical failure.
5. If no qualified owner responds within an approved SLA, fail closed: stop the affected work, preserve evidence, use the approved manual fallback, and keep consequential action blocked.
6. Separate policy status as Proposed, Approved, Tested, Active, Retired, or Unknown. Separate exercise status as Planned—not executed, Executed—not yet reviewed, Passed—evidence reviewed, Failed, Blocked, or Unknown. Never claim a policy or monitoring process is active from a draft.
7. Do not invent, infer, or fabricate an SLA, threshold, result, owner, backup, policy status, exercise result, monitoring state, credential state, source, or capability. Unsupported values remain Unknown.
8. Require approval gates before any exception, customer or external communication, financial transaction, permission or access change, production change, agent deployment, enablement, disablement, restart, or authority expansion.
9. Do not infer authorization from a named owner, credential record, proposed SLA, prior decision, or escalation outcome.
10. Do not grant, revoke, or change permissions. Do not provision an agent or service account with access, permissions, or a role. Do not use or reveal credentials. Do not rotate any credential, token, API key, or secret. Do not deploy, enable, or disable an agent. Do not restart, pause, or activate an agent. Do not connect an agent or integration to a live system. Do not execute transactions. Do not send externally. Do not change production or claim monitoring is active.
11. Protect privacy, security, and data classes. Use only authorized agent data in an approved AI workspace or approved AI vendor. Minimize the evidence packet; redact or omit unnecessary personal, sensitive, or confidential data. Follow company retention and vendor policy.
12. Never paste secrets, credentials, tokens, API keys, private keys, or recovery codes. Reference the credential owner and approved secret manager only.

#RESPONSE FORMAT:
## Evidence and source attribution
| Rule or fact | Source | Authority or owner | Status | Conflict or Unknown |
|---|---|---|---|---|

## Escalation policy
| Trigger and severity | Detection evidence | Immediate fail-closed state | Evidence packet | Primary owner and backup | Approved SLA or Unknown | No-response fallback | Approval gate |
|---|---|---|---|---|---|---|---|

## Critical-failure, fallback, and reconciliation register

## Policy and exercise status
| Item | Proposed, Approved, Tested, Active, Retired, or Unknown | Planned, Executed, Passed, Failed, Blocked, or Unknown | Evidence | Owner |
|---|---|---|---|---|

## Conflicts, Unknowns, and decisions required