Write the L2-Ready Escalation Note

Tier: Foundation · Workflow area: Ticket handling & triage · ~20 minutes

The trick is separation of labor: you gather evidence and make the judgment calls; AI does the structuring, the completeness check, and the translation from scratchpad to professional note.

When to use

• Any escalation to L2/L3 or a vendorespecially vendors, where a weak first note costs you a full support-queue round trip measured in days.
• Handovers across time zonesthe receiving engineer starts in six hours and cannot ask you anything.
• When your own notes are chaostwenty terminal commands, three screenshots and a hunch. That is normal; structuring it is exactly what the model is for.

When NOT to use

• Active P1 bridgesduring a live major incident, escalate by voice first, paperwork second. Use pb-18-style timeline reconstruction afterwards.
• When you have not actually investigatedAI cannot structure evidence you never collected. An eloquent note wrapped around "I tried nothing" makes the ping-pong worse, because now it looks deliberate.

The recipe

1. 1.

   Adopt the six-section template. Escalations bounce when one of these is missing, so make all six mandatory: Environment (who/what/where, versions), Symptom (exact behavior, exact errors, since when), Reproduction (steps, and whether you reproduced it), Evidence (command output, log lines, screenshots — with timestamps), Ruled out (what you eliminated and how), Ask (the specific thing you need from L2).

2. 2.

   Collect evidence as you work, not at the end. Paste command output into the ticket's work notes raw as you go. Typical L1 evidence set for an auth/device issue:

   Copy

   # Device identity and join state
   dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|DeviceId|TenantName"
   
   # Recent auth failures on the endpoint
   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-AAD/Operational'; Level=2; StartTime=(Get-Date).AddHours(-6)} |
     Select-Object TimeCreated, Id, Message -First 10
   
   # Network path to the service
   Test-NetConnection login.microsoftonline.com -Port 443
   

   Raw output beats your summary of it — L2 will spot things in the raw text that you did not know were significant.

3. 3.

   Prompt AI to assemble the note from your raw material.

   Copy

   Turn my raw investigation notes into an L2 escalation note.
   
   Use exactly these sections:
   ENVIRONMENT / SYMPTOM / REPRODUCTION / EVIDENCE / RULED OUT / ASK
   
   Rules:
   - Use only what is in my notes. Anything the template needs that my notes
     don't contain, list under "MISSING BEFORE ESCALATION" at the top instead
     of inventing it.
   - In RULED OUT, pair every eliminated cause with the evidence that
     eliminated it ("cause — ruled out because <evidence>"). If I ruled
     something out without evidence, flag it as "asserted, not verified".
   - Keep command output verbatim in fenced blocks. Do not paraphrase errors.
   - The ASK must be one specific request, not "please investigate".
   
   My raw notes:
   [paste work notes, command output, timeline scraps]
   

4. 4.

   Read the MISSING list — it is the real product. The model's gap list is your pre-escalation checklist. A typical first pass returns something like:

   Copy

   MISSING BEFORE ESCALATION:
   - Outlook build number (you say "latest" — L2 will ask for the exact build)
   - Whether the issue reproduces for a second user on the same device
   - Timestamp of the failed sign-in to correlate with server-side logs
   
   RULED OUT:
   - Local profile corruption — ruled out because issue follows the user to a
     loaner laptop (evidence: work note 14:32)
   - Network path — asserted, not verified (no test from user's VLAN recorded)
   

   Go collect the two missing facts and turn the "asserted, not verified" into either evidence or an honest open question. This loop — model flags gap, you close it with a real command — is where escalation quality actually comes from.

5. 5.

   Set the Ask yourself. The single highest-leverage sentence is a precise Ask: "Please check server-side sign-in logs for user X between 09:10–09:20 IST for correlation ID abc123" gets a same-day answer; "escalating for further investigation" gets a queue position. AI can propose the Ask; you own it, because it encodes your actual hypothesis.

6. 6.

   Paste, label, escalate. Final note goes in the ticket labeled [Escalation note — L1 investigation by <name>], evidence blocks intact. If your ITSM tool mangles code formatting, attach a text file rather than let timestamps and IDs get reflowed.

Make it yours

• Vendor escalations (Microsoft, Cisco, SaaS support)add a rule: "Format for an external vendor: no internal hostnames or employee names; include product versions, license tier, and our case-severity justification." Vendors triage on completeness even more brutally than your L2 does.
• MSP contextadd the client name, contract tier and the client's own change-freeze calendar to ENVIRONMENT; half of "mystery" escalations die when someone notices the client froze changes on Friday.
• ServiceNow shopssave the six-section template as an incident template or a Now Assist prompt so the structure is one click; the evidence-gathering discipline stays manual because it must.

Quality check

• The zero-questions testsuccess is measured one way: did L2 start work without asking you anything? Track your bounce rate per month; it should approach zero.
• Every RULED OUT has evidence"probably not the network" is not ruled out. The pairing rule in the prompt exists to make this failure visible, not to let the model paper over it.
• Verbatim means verbatimspot-check that error strings in the note match your raw output character-for-character; a paraphrased error code sends L2 searching for something that does not exist.
• Sandbox your reproif reproduction involves anything invasive (registry edits, policy changes), reproduce on a test device or VM, never on the user's machine "just to confirm."