Method · Technical support engineering · by Ayman Sbeiti — I support high-trust software platforms · Hiring?
Method
How I communicate during incidents.
Send the holding message before you know the cause, scope claims to what monitoring can actually support, and hand engineering a diagnosis instead of a mystery.
The shape of the sequence
- Holding message01
Sent before the cause is known: what we know, what we're doing, and what to watch meanwhile.
- Engineering update02
The diagnosis package: reproduction steps, comparisons, findings, suspected cause.
- All-clear03
What was validated, and when normal procedure resumes.
The principles
- Send the holding message earlySend it before the cause is known. The message sent under uncertainty is the one that shows composure, and it buys the investigation room to work.
- Tell every affected audienceNot just customers. Support teams, engineering, and operational stakeholders each need a different slice of the same truth.
- Scope every claim to its evidence"No known interruption, as far as monitoring could tell" survives scrutiny; absolutes don't.
- Put interim containment in the messageWhat's being watched manually, what to flag, and what to do differently until the all-clear.
- Hand engineering a diagnosis, not a mysteryReproduction steps, comparisons, findings, and the suspected cause. A package, not a symptom report.
- Close the loop explicitlyThe resolution message states what was validated and when normal procedure resumes, so nobody is left operating on stale caution.
Why this matters
The first message doesn't need the root cause. It needs to exist, and to say honestly what is known, what is being done, and what the reader should do meanwhile. In the migration this method draws on, customers were told what was changing before it changed. In the escalation investigation, support was working a temporary manual watch from the moment the signal was characterized.
Two disciplines shape the words themselves. The first is claim-scoping: every statement carries exactly the confidence its evidence supports, which is why the published record says "no known interruption" and names monitoring as the basis. The second is fitting the same truth to each audience. Support needed to know what to watch manually, engineering needed reproduction steps and payload findings, and nobody needed reassurance theatre.
The close matters as much as the open. An incident that ends without an explicit all-clear leaves people quietly double-checking a system that already works. That is the communication equivalent of a silent failure.
The rule
Silence costs more than uncertainty.