Escalation Design: From Agent to Officer

A district supply office ran an agent that drafted allotment replies. On a Friday it hit a case that mentioned a court order. The model, trained on helpfulness, wrote a confident paragraph that ignored the stay. There was a button marked Escalate. It opened a mailer to a retired consultant whose contract had ended in March. The mail bounced. The draft sat in the officer's inbox over the weekend. On Monday a lawyer arrived with the stay and the draft.

Escalation is not a button. It is a ladder of posts that still exist, a clock, and a packet. Indian administration already knows this ladder: dealing hand, section officer, under secretary, competent authority. Agents do not get a new constitution. They get a mapping onto the one you have, including the Delegation of Financial Powers Rules, 2024 for money.

Guide for CIOs who must wire the ladder before go-live. 16 August 2026. Not legal advice.

The ladder, named in posts not in products

Map your own designations. Do not import a vendor's 'tier-2 AI specialist'.

Rung	Who	What they may do
0 — Agent	The registered workflow	Retrieve, draft, refuse; never spend; never close a legal or child case
1 — Desk	Section officer / dealing assistant on the roster	Accept, edit, reject drafts; open the system of record; request JIT approval
2 — Competent authority	The post that holds the DFPR or administrative delegation for this act	Sanction, reject with reasons, change the workflow's standing order
3 — Grievance / appellate	Existing FAA, appellate authority, CPGRAMS cell — not a new AI court	Hear the citizen after the department has acted

Rung 0 to 1 is automatic on refusal, on low-confidence if you have a real score you trust (most departments should not fake one), on specified keywords (court, death, child, media, minister), and whenever the citizen asks for a human. Rung 1 to 2 is automatic when the act would spend, create a right, or contradict a stay. Rung 2 to 3 is the citizen's path, not the agent's.

Clocks and rosters, or the bounce wins

A ladder without a roster is the retired consultant. Maintain an official roster in the same identity system that logs the eight fields. When the section officer is on casual leave, the next post on the roster is the dealing hand. When the whole cell is at a training, the agent refuses new citizen-facing drafts and says so, rather than mailing the void.

Give each rung a clock that matches the work, not a SaaS default. A FAQ draft can wait a working day. A court-order flag cannot. Write the clock on the register row. Breach of the clock is an internal-audit sample, not a vendor uptime metric.

The packet climbs with the case

The human who receives the escalation should see the reconstructable packet: who approved the workflow, what was retrieved, what was proposed, why it stopped. They should not have to prompt the model with 'what did you mean'. If the packet cannot climb, the case cannot climb. That is a release blocker.

Do not escalate into a personal WhatsApp. The official identity is the only identity that will survive CAG and RTI. If your eOffice or ticket tool is ugly, it is still the system of record. Beauty is not a rung.

Two Fridays

Objections

Officers say they will drown in escalations. Answer: then the agent is on the wrong work. Narrow the purpose until the ladder is quiet enough to staff.

The vendor offers 'automatic resolution above 0.8 confidence'. Answer: unless you have a calibrated score on your own cases, that number is theatre. Escalate on facts (court, money, child), not on a decimal.

A secretary wants every escalation on her desk. Answer: that is not how DFPR works and it is not how evenings work. She holds the residual class, not the FAQ queue.

IT says the roster cannot join eOffice. Answer: then the agent is not ready. Integration is the product.

A four-week playbook

• Week 1: draw the four rungs with real post names and the DFPR citations for money acts.
• Week 2: wire roster and clocks in the official ticket tool. Kill mail-to-person as the only path.
• Week 3: force the packet to travel with the ticket. Test a leave-day failover.
• Week 4: tabletop court, child, payment, and 'citizen asked for a human'. Time each climb.

File note you can paste

Subject: Escalation ladder for agent workflows.

Each registered agent shall escalate to the section officer on the official roster, and from that post to the competent authority wherever the act exceeds the desk's delegation, including all money acts under DFPR 2024 or the applicable state rules. Vendor channels are support, not escalation. The reconstructable packet shall travel with the ticket.

Triggers include refusal reason codes, court or child markers, citizen request for a human, and any payment-adjacent ask. Clocks and leave failovers will be stated on the register row. This note is not legal advice.

Rosters that survive transfer season

Indian desks change names in May and June. An escalation ladder that points at a person rather than a post will bounce the week after orders are issued. Bind the ticket queue to the post, and bind the post to the current incumbent through the same identity system that already does joining and leaving. If your identity system cannot do that, the agent is not the first problem.

Night and weekend cover is a political choice. Write it. A citizen-facing money-class workflow with no Saturday roster must refuse new irreversible acts after hours and say so. Hope is not a roster. A collector's personal mobile is not a roster.

Measure climb time, not 'AI containment rate'. Containment is how vendors hide missed clocks. If court-flagged tickets sit eighteen hours, you do not have a ladder. You have a queue with a decorative button. Put climb-time breaches on the Board folio next to grievances. They are the same citizen, earlier.

Do not escalate to a minister's office because the prompt contained the word urgent. Ministers hold residual political risk, not the section's inbox. If a case is truly that class, a human already knows how to put up a note. The agent does not get a skip-level.

• Tabletop transfer week: the incumbent leaves Friday, the new officer joins Monday, a court flag arrives Saturday.
• If the ticket tool cannot attach the packet, stop the workflow, not the complaint about the tool.
• Vendor Slack remains support. Write that on the architecture page in ink.

Informational field guidance. Confirm your office procedure manual, DFPR 2024 or state analogue, and grievance routes before you freeze a ladder.

How this survives CAG, RTI or the Board

“Escalation Design: From Agent to Officer” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

An agent that cannot find a human is not autonomous. It is abandoned. Write the ladder: agent to section officer to the person who actually holds the delegation, with clocks and a record. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI escalation workflow” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Escalation Design: From Agent to Officer” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI escalation workflow” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.