How would you handle uncertainty in an agent that has already acted?

Solent Rail runs regional trains along the south coast. Anaya Fitzgerald has led Customer Recovery Operations there for six years. Waypoint is the agent that rebooks a passenger automatically the moment her train is cancelled, without waiting for anyone to approve it first.

How to answer this, stage by stage

The interviewer isn't grading whether you'd add a review step. They're grading whether you know which step actually can't wait.

Let's learn

Waypoint is an agent a regional rail operator lets act on its own. The moment a train gets cancelled, it rebooks every connecting passenger onto the next real service, without waiting for a person to click approve.

Before Waypoint, a dispatcher called ahead to confirm a connecting service before rebooking anyone, about twelve minutes per group. On a bad night, a team could only get through maybe twenty groups before running out of time, so plenty of riders got no help at all.

The whole question lives in that fourth box. Solent Rail had quietly skipped it for partner services.

Now Waypoint moves hundreds of riders in seconds during a major disruption. No queue, no wait, no dispatcher touching a keyboard for the routine cases.

Here's the turn: the occasional wrong rebooking was never really the problem. The real problem only shows up after the agent has already acted, because a rider who trusts a rebooking message has no way to know, in that moment, whether the plan just written for her is actually still true.

At its worst, that silent gap strands a rider at a junction near midnight, holding a message that says her journey is "updated," with no way to reach anyone and no idea the replacement service it named stopped running six hours earlier.

Solent Rail's incident review kept reaching for the right-hand box first. The rank runs the other way.

What I would leave alone: rebooking a rider automatically within Solent Rail's own network, seat to seat, train to train, doesn't need this scrutiny. That's reversible in the time it takes to print a new ticket.

The lesson: an agent that has already acted owes a different kind of honesty than one that's still deciding. It can't ask permission anymore, so it has to make the undo fast and the explanation faster.

Now here is the same thing as a story

The short version above is what you'd say defending this rank to Solent Rail's safety board. Read this one for how close the near miss actually came.

The dispatch floor at Solent Rail gets loud whenever a storm rolls in off the channel, and the night Tarnwick Junction lost its signal feed was no exception. Anaya Fitzgerald has run Customer Recovery Operations there for six years, and can read a service disruption off the board before the first phone call even comes in.

For the first several months after Waypoint launched, it handled routine cancellations cleanly, rebooking riders onto the next train on Solent Rail's own line within seconds, and Anaya's team barely had to touch a keyboard.

As Waypoint's scope grew to include those partner bus routes, not just Solent Rail's own trains, the team quietly stopped double-checking those rebookings too, since months of them had gone fine.

That Tuesday night, a signal fault cancelled the 9:56pm service through Tarnwick Junction. Waypoint rebooked all forty connecting passengers onto replacement bus route 217 in about two seconds. Route 217 had been suspended that morning for road works, a fact sitting in a feed Waypoint's confidence check hadn't refreshed since 6am. Every rider got the same push notice: "Your journey has been updated." Nothing about why, nothing about what to do if it looked wrong.

Nearly two hours between the silent rebooking and anyone finding out it was wrong.

At 11:42pm, a station attendant doing a final round noticed platform three at Tarnwick was empty when forty riders should have been waiting for a bus. She called it in.

Solent Rail dispatched a recovery coach, and every rider made it home, the last one at 1:05am, an hour and forty minutes after they should have been on their way. Nobody was hurt. It could easily have gone differently on a colder night.

Anaya's team found all three signs sitting in Waypoint's own logs once they went looking.

Anaya's team pulled Waypoint's logs after the fact and found this wasn't the first stale-feed rebooking, just the first one anyone happened to catch. With the redesigned response, Waypoint still acts in two seconds, but now sends a real explanation alongside the rebooking, and it holds any partner-service rebooking behind a live status ping before finalizing it.

All four were sitting in Waypoint's own logs already. None of them had ever reached a passenger's phone.

Run the same Tuesday night forward: the stale bus route fails its status ping automatically, Waypoint holds the forty passengers on their original delayed train instead of a phantom bus, and pages Anaya's team directly. They are moved by 10:20pm, not 1:05am.

The old design let the agent's silence stand in for confidence. The new one makes the agent say what it doesn't actually know yet.

I thought the fast rebooking was the whole product. It took forty people standing on an empty platform to see that the message telling them what happened mattered just as much as the decision itself.

ORDER, in one screenNot a generic incident checklist. ORDER is what tells you which step on that checklist actually goes first.

The two most urgent steps are also the two easiest to undo. That's not a coincidence, that's the whole rank.

The recap, one line per letter: outcome is naming what a rider actually needs, not a system-uptime number, reversibility puts telling the rider above touching the model, dependency is the audit gating the threshold change, evidence is thirty days of past cases pulled cheaply before committing to anything bigger, and rank is the order itself, notify first, threshold last.

And if you want to be sure it really works, try it somewhere elseSame five letters, a municipal power utility instead of a rail operator. A different dependency breaks the second story.

Loadwatch is an agent a municipal electric utility uses to cycle down non-critical home loads, like pool pumps and water heaters, during a heat-wave peak, to prevent a wider blackout. Idris Bramwell, the utility's Grid Operations Lead, handles it after Loadwatch cycles off equipment for eleven thousand homes without asking anyone first. Mapped onto ORDER: outcome is keeping the actual neighborhood grid up, not "peak load reduced by X percent"; reversibility puts restoring power and notifying affected homes above adjusting Loadwatch's own trigger threshold, since a family with a medically necessary device losing power for even twenty minutes is far harder to make right than tuning a setting next week.

The dependency here runs in reverse from Solent Rail's case: at Loadwatch, the safety-critical accounts list has to be checked before any cycling happens at all, not audited afterward, because some homes on that grid depend on powered medical equipment and can never be included in an automatic cutoff, no matter how confident the model is about the wider peak. The evidence step there was matching Loadwatch's cutoff list against the utility's own registered medical-equipment accounts, a check that already existed for a different purpose and had simply never been wired into the automated agent.

Same four parts. At a power utility, "how to undo it" means restoring the circuit directly, not offering an apology.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "notify the affected person and offer a real fallback first, log and audit second, only then touch the model," and stop.
Cost: there's no budget for a live status-ping check on every partner rebooking right now. Say so honestly, and start with just the audit, since finding out how often this has already happened costs almost nothing and tells you how urgent the rest actually is.
The model gets better, for real: if Waypoint's confidence calibration genuinely improves and stale-feed rebookings stop happening for six months, that's still not a reason to remove the live status ping, a good track record earns a wider autonomy scope, not a shortcut past checking.

Where people run it wrong.
They treat the incident report and the threshold change as the urgent work, because those feel like "fixing the real problem."
They let an automatic notification count as disclosure, without ever asking whether the person receiving it can actually act on it.
They wait for a complaint to learn an agent's already-taken action was wrong, instead of auditing past actions on their own schedule.

How to use it live. The moment someone describes an agent that's already acted, ask yourself one question before ranking anything: if this turns out to be wrong, what does the affected person lose for every minute nobody tells them? Put that step first.

Flashcards (tap any card to flip it)

Check yourself Score: 0 / 0