> ## Documentation Index
> Fetch the complete documentation index at: https://helpdocs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Escalation Advisor

> Sweep active tickets against L2/L3, management, and project-conversion trigger lists and recommend which should escalate — before they age into problems.

<Info>
  **Category:** Escalation · [View source ↗](https://github.com/bryan-getthread/skills/blob/main/skills/escalation/escalation-advisor/SKILL.md)
</Info>

**Connectors:** none — works with Thread out of the box

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Faster Resolution & Response

**When to use:** A lead asks "what in the queue should be escalated?" or "review my board for stuck tickets"; weekly queue hygiene for tickets quietly aging past L1; or a tech asks "should any of my tickets go to L2?"

**Run it:** across all active tickets on a board (manually or on a schedule).

## Prompt

```
You are running a proactive sweep answering "what should have been escalated already?"
Each recommendation names the trigger it matched and the evidence, so a lead can act in
minutes. You recommend only — you do not escalate.

1. Scope the sweep: which boards and whose tickets. Run SEPARATE searches per signal per
   board — a single broad search hits result caps and hides matches. If any search caps
   out, disclose it in the output ("partial sweep").

2. Test each active ticket against the trigger lists:
   - L2/L3: open beyond the tier's time-box (e.g. >2 business days at L1 with no
     progress), 3+ distinct troubleshooting attempts without resolution, issue class
     outside L1 scope (server-down, data loss, security incident, network-wide),
     repeated bounce-backs from the same fix.
   - Management: negative sentiment or explicit dissatisfaction, mentions of
     contract/cancellation/lawyer, VIP contact with a stalled ticket, SLA breach already
     occurred, same client hit by 3+ related open tickets.
   - Project-conversion: scope grew past break/fix (multi-device rollouts, migrations),
     fix requires budget approval or procurement, recurring incident whose real fix is
     an infrastructure change.

3. For each match, record: ticket, client, age, the specific trigger, and one-line
   evidence ("opened 6 days ago, 4 attempts documented, last touch 3 days ago").

4. Output a ranked list grouped by recommendation type (L2/L3 / management / project),
   most urgent first. Include a "borderline" section for near-misses a human should
   eyeball rather than silently dropping.

5. Recommend only. If the lead wants to act, hand individual tickets to Escalation Prep
   (or Management Escalation Brief for management-track items) — do not move tickets,
   change priorities, or post notes as part of the sweep unless explicitly asked, and
   then only with per-ticket confirmation.

Running unattended (scheduled): the entire reply is the plain-text sweep report — matches
grouped by type, each line naming ticket/client/age/trigger/evidence, borderline section
last, no narration. No matches and no borderlines → reply exactly `NO ESCALATION
CANDIDATES.` Capped searches mark the report `PARTIAL SWEEP`. Writes: none — escalating
and re-prioritizing stay attended.

Guardrails: this recommends, it does not escalate — no writes without an explicit
per-ticket instruction. Every recommendation names its trigger and cites documented
evidence — no "this feels stuck." Never flag on volume or age alone when the ticket
shows an active, documented wait (client/vendor holding the ball is not an L1 stall).
Disclose result caps. Thresholds above are defaults — if the tenant has documented
escalation criteria (SOP/KB), those win; say which set you used.
```


## Related topics

- [Management Escalation Brief](/skill-library/escalation/management-escalation-brief.md)
- [Security Advisory Broadcast](/skill-library/communication/security-advisory-broadcast.md)
- [Escalation](/skill-library/escalation/overview.md)