ConceptAdvancedShipping & Model Lifecycle / Incident management for AI products / #17
How do you prevent an incident response that overcorrects and breaks quality?
The direct answer
Fix the one flow that actually broke, with a hard rule outside the model that blocks it from happening again, not a shutdown of the whole drafting tool. Go broad only when a fast audit of the other high-risk flows finds the same failure somewhere else, not on a guess that it might.
Do this, in order
Patch the damaged-in-transit refund flow with a hard rule that blocks any refund promise over $150 from sending without a photo and a manager tap, and leave the drafting tool running everywhere else.Why: the broken piece is one flow out of sixty; shutting all of them off punishes about fifteen thousand nine hundred emails a week that were never wrong.
Run a forty-eight-hour audit of the other high-risk flows against the same check.Why: this is what tells you whether the failure is one flow or a shared cause, instead of guessing under pressure.
Set the go-broad kill line before you need it: two or more flows over fifteen percent skipped verification, or a root cause that traces to the model itself instead of one prompt template.Why: without a number, "when do we go broad" turns into a mood, decided by whoever is loudest on the call.
Hold the patch to a weekly pass rate on a sampled eval set, at least 99 percent of drafts blocking correctly, not a claim that it will never slip through again.Why: Draftbench is still a model choosing words; a promise of zero mistakes just gets quietly redefined the first time reality tests it.
Name the alternative that was considered and rejected: routing every draft over a dollar threshold through a second reviewer, company wide.Why: it slows every queue to guard against a failure that only ever showed up in one of them, the same overcorrection dressed up as a compromise.
Tell reps and finance exactly what changed and why, in one message, the day the patch ships.Why: a rep who finds out later that Draftbench had a known gap starts second-guessing every draft, not just the damage claims.
How to answer this, stage by stage
Nobody is grading whether you know the letters P, I, C, K. They're grading whether you can size a fix to where the evidence actually points, on a question built to tempt you toward the biggest, safest sounding response instead. Seven moves get you there.
1
Ground it in one product, one flow, one number
Say it like this
"Let's make this real. Corveth and Yarrow runs about ninety five stores plus an online store, and its customer service floor answers around sixteen thousand emails a week using Draftbench, a tool that drafts the reply and lets a rep review it before it sends. I'm the CX quality lead, and I'm the one who has to decide what happens in the next twenty four hours."
Why this works
Grounds the answer in a real product and a real number before any framework talk starts, so it never turns into a policy lecture.
2
Say your order out loud before you argue anything
Say it like this
"Here's how I'll walk through it. I'll give my position first, and say exactly which flow it covers, not the whole tool. Then who feels the cost on each side, in real units. Then which kind of miss is cheap and which is hidden. Then the exact evidence that would flip me to a full shutdown."
Why this works
Tells the interviewer you have a method before the reasoning starts, so they aren't guessing where you're headed.
3
Give the position, and say exactly which flow it covers
Say it like this
"My position: patch the damaged-in-transit refund flow, the one that broke, with a hard rule that blocks any refund promise over a hundred fifty dollars from sending without a photo and a manager's tap. Leave the drafting tool running everywhere else. Turning it off for every rep, on every queue, fixes a problem that lives in one flow by breaking fifty nine other ones that were never wrong."
Why this works
Names the flow, not the whole system, which is what makes this a real position instead of a mood.
4
Name who feels each side's cost
Say it like this
"The narrow fix costs one weekend of engineering time, and one extra manager tap on roughly fifty five emails a week going forward. A full shutdown is felt by every one of a hundred thirty reps, typing all sixteen thousand weekly emails by hand at three times the speed, and by every customer waiting on an order status question that had nothing to do with a damaged item."
Why this works
Turns "there's a tradeoff" from a claim into two groups the interviewer can actually picture, in real units.
5
Name which miss is cheap and which is hidden
Say it like this
"The engineering weekend and the extra tap are cheap and visible, right there on a ticket today, easy to test and easy to argue about. Slower replies across sixteen thousand emails a week are hidden. Nothing about hour one of a shutdown looks like an emergency. It's hour eighty, when the backlog is thousands of emails deep and tired reps start making new mistakes on categories that were never broken, that it costs more than the incident did. I'm building against the one that's hiding."
Why this works
Says out loud which kind of miss the whole pick is optimizing against, which is the actual center of a tradeoff answer.
6
Give the kill criteria as a real, checkable bar
Say it like this
"I'd only go broad if a forty eight hour audit of the other high-risk flows, price match, loyalty grants, warranty exceptions, turns up the same skipped-verification pattern in two or more of them, above fifteen percent, or if the cause traces back to the model itself instead of one prompt template. Right now, all six of the other flows sit under that line. It's not close."
Why this works
Shows the pick can move, and gives the exact evidence that would move it, not a vibe.
7
Close on the number that actually makes the case
Say it like this
"Here's the number I'd leave them with. The narrow fix costs about six thousand dollars. A two week, company wide shutdown costs about a hundred eighteen thousand dollars in labor alone, on top of the two hundred sixty thousand the incident already cost before anyone caught it. Shutting it all off doesn't feel careful once you price it. It's just a bigger, slower version of the same mistake."
Why this works
Ends on a number the interviewer remembers instead of a general feeling about being careful.
One more thing before the walkthrough ends: this isn't a rule that every incident gets the narrowest possible fix. If Corveth and Yarrow only had two people running customer service instead of a hundred thirty, or if the broken flow touched every single email instead of one narrow slice, the math flips, and going broad might genuinely be the cheaper, faster move. Say which situation you're actually in, and you've shown judgment instead of reciting "always start narrow."
Let's learn
The tool is a draft sitting in a text box, waiting for one click. Corveth and Yarrow's customer service floor uses Draftbench to answer email: a rep opens a ticket, Draftbench writes the reply, the rep reads it, fixes what needs fixing, and sends.
Before Draftbench, a rep typed every reply by hand. About nine minutes an email, across returns, order status, price questions, and damage claims. After Draftbench, that dropped to about three minutes, mostly reading and sending. Across sixteen thousand emails a week and a hundred thirty reps, that's the difference between a floor that keeps up and one that doesn't.
Then, ahead of the holiday rush, someone trimmed one prompt template to make drafts shorter and faster to read. The template covered damaged-in-transit claims on items over a hundred fifty dollars, things like small appliances and furniture. The old version told Draftbench to always ask for a photo and to flag anything over that amount for a manager's approval before promising a refund. The new version dropped both lines to save space.
Here's the turn. What happened next wasn't Draftbench getting things wrong in some random, scattered way a rep would catch on sight. It got confidently, cleanly wrong in one narrow place. Every damaged-in-transit draft over a hundred fifty dollars started reading the same reassuring way: refund's on its way, no need to send anything back. No photo request. No approval flag. It read exactly like every other good draft Draftbench had written for fourteen months, so reps under holiday pressure sent it the way they sent everything else.
We didn't lose one refund policy. We lost the one line in one template that made a refund cost something to promise.
Knowledge spark: what made this an AI mistake, not a policy mistake?
Draftbench didn't ignore the refund policy. It never knew the policy changed, because the instruction that used to enforce it got deleted from its prompt. A model does exactly what its instructions say, confidently, even when the instructions quietly get shorter.
Nine days in, finance's weekly refund reconciliation, a report nobody was specifically watching for this, flagged the damage-claim category as an outlier. Three hundred forty refunds had gone out on items over a hundred fifty dollars with no photo on file, about two hundred sixty thousand dollars total. When finance hand-checked forty of those claims afterward, seven looked like someone had learned the pattern and was gaming it, filing a second claim within days, describing damage that didn't match what had actually shipped.
At its worst, the honest answer is Corveth and Yarrow got both costs at once: two hundred sixty thousand dollars gone before anyone caught it, and a VP ready to shut Draftbench off for every rep, on every queue, while the whole thing got investigated.
The choice I would take back.
The decision that mattered
The old prompt template split refund policy into two places: a short version most drafts used, and a longer version with the photo-and-approval rule buried lower down, easy to trim without anyone noticing what got cut. I'd move the photo-and-approval rule out of the prompt entirely and into a rule that blocks the send button, so no future prompt edit can quietly remove it again.
What I would leave alone. The other fifty nine drafting flows Draftbench runs, from order status updates to loyalty questions, weren't touched by this edit and never showed the pattern. Rewriting or re-checking every one of them on a guess would cost weeks for no reason. The forty eight hour audit exists to prove that, not assume it.
The lesson. A rule that lives inside a prompt is a rule a future edit can delete by accident. A rule that lives outside the model, blocking a send instead of asking nicely, survives the next person who trims a paragraph to make drafts read faster.
Same incident, two very different sized costs. One of them shows up on a ticket today. The other one shows up on a spreadsheet two weeks from now.
Now here is the same thing as a story
The short version sits above. Read this one for the Thursday morning phone call that almost decided this the wrong way.
Selene can read a damage-claim email and tell, before she reaches the second sentence, whether the story holds together. Four years running CX quality at Corveth and Yarrow will do that.
Draftbench arrived fourteen months ago, and for most of that time it was the good kind of boring. Reps stopped dreading the damage-claims queue, the messiest one on the floor, because Draftbench pulled the right policy language every time and got most of the reply right on the first pass.
For the first six months, Selene pulled a real sample every week: forty damage claims over a hundred fifty dollars, checked by hand against the photo on file and the manager sign-off. Every week, the sample came back clean. So she trimmed it. Twenty a week, then ten, then, by month eleven, she'd stopped pulling the sample at all. Draftbench's drafts always read like they knew the policy cold, careful, specific, citing the right dollar threshold. There's only so long you keep checking a thing that keeps being right.
Nobody decided to stop checking. A sample that kept coming back clean just stopped feeling worth forty emails a week.
Then came the week before the holiday rush. An engineer trimmed the damage-claims template to cut boilerplate and speed up drafting for the busiest queue on the floor. The photo-and-approval line came out with it. Nobody flagged it as risky. In the quick test pass, on a handful of low value claims, it never once produced a wrong answer, because none of those test claims were the kind where the missing rule would have mattered.
For nine days, every damage claim over a hundred fifty dollars got the same reply: refund's on its way, no photo needed, nothing to send back. It read exactly like every other confident, well-written draft Draftbench had ever produced. Reps, already moving fast for the holiday queue, sent it the way they sent everything else. Three hundred forty went out that way. Two hundred sixty thousand dollars, before anyone outside finance's own reconciliation report noticed a thing.
Sherrod Hartsdale, VP of Customer Experience, called Selene at eight that Thursday morning with the number already in his hand. His answer was immediate: turn Draftbench off, for every rep, on every queue, until someone could prove the whole thing was safe again.
Selene understood exactly why he wanted that. Two hundred sixty thousand dollars is a real number, and a kill switch feels like the responsible thing to reach for at eight in the morning with a VP on the phone. But Draftbench ran fifty nine other kinds of replies that week, from order status checks to loyalty questions, and not one of them had shown this pattern. Shutting all of it off wouldn't just stop the bleeding on damage claims. It would hand a hundred thirty reps, on all sixteen thousand emails a week, the nine minute version of every reply again, for a problem that lived in exactly one template.
So here is what Selene took back, and what she told Sherrod on the call. Splitting the refund policy into two places in the prompt, a short version most drafts used and the actual enforcement rule sitting lower down, easy to trim without anyone noticing what they'd cut. That's the decision underneath the incident. Sherrod's instinct wasn't wrong to want safety fast. It was wrong to reach for the size of the fix that matched how bad the number felt, instead of the size of the fix that matched where the damage actually lived.
The replay: patch the one flow, block the send button on any refund promise over a hundred fifty dollars without a photo and a manager tap, and run a forty eight hour audit on the other high-risk flows using the same check. All six come back under fifteen percent. Draftbench keeps running for fifteen thousand nine hundred emails a week that were never wrong, and the fix that actually matters ships in a weekend instead of two weeks.
The part Selene would tell Sherrod, and herself: the kill switch would have made the eight o'clock phone call feel better. It wouldn't have made anyone's Tuesday better for the next two weeks.
The four calls, and the numbers behind each one
This is a yes or no between two responses to the same incident, not a rule for every model mistake Corveth and Yarrow will ever make, so PICK carries the weight here.
P
PositionPatch the damaged-in-transit refund flow only: block any refund promise over a hundred fifty dollars from sending without a photo attached and a manager's tap, and leave Draftbench running on the other fifty nine drafting flows. We considered, and rejected, routing every draft over a dollar threshold through a second reviewer company wide, a milder version of Sherrod's shutdown. We rejected it because it still slows every queue to guard against a failure that only ever showed up in one of them.
I
ImpactThe narrow fix is felt by the CS ops team: a weekend of engineering time, and one extra manager tap on roughly fifty five damage claims a week going forward. A company wide shutdown is felt by every one of a hundred thirty reps, typing all sixteen thousand weekly emails by hand at three times the speed, and by every customer waiting on an order status or loyalty question that had nothing to do with a damaged item.
C
Cost asymmetryThe narrow fix's cost is cheap and visible: a ticket, a code review, done by Monday. The shutdown's cost is hidden and it compounds: nothing about hour one looks like an emergency, but by hour eighty the backlog is thousands of emails deep and tired reps are making new mistakes on categories that were never broken. That's the one I'm building against.
K
Kill criteriaGo broad only if a forty eight hour audit of the other six high-risk flows turns up the same skipped-verification pattern in two or more of them, above fifteen percent, or if the root cause traces to the model itself rather than one prompt template. Right now, none of the six clear that bar.
Knowledge spark: what's a verification-skip rate?
Out of a sample of drafts from one flow, the percent that skip a required check, like asking for a photo, before promising money back. A low number means that flow is behaving. A high one means the same failure might be hiding somewhere else too.
Cost of the next two weeks: narrow fix versus full shutdown
The narrow fix is one weekend of engineering time plus a manager tap on about fifty five emails a week. The shutdown number is labor only, extra hours across sixteen thousand weekly emails at triple the handle time, plus SLA penalties on three corporate accounts. It doesn't include backlog, overtime burnout, or the mistakes tired reps make typing everything by hand.
The kill line, charted: verification-skip rate across the other six high-risk flows
All six of the other high-risk flows sample under the fifteen percent kill line, the highest is fraud-hold release at nine percent. Until two or more flows cross that line, the audit itself is the evidence that this failure is isolated, not a guess that it is.
And if you want to be sure it really works, try it somewhere else
Quillfeather County runs a 311 line where residents report non-emergency issues: potholes, noise, missed trash pickup, and hazards like gas smells, downed power lines, or blocked fire exits. A drafting tool writes the acknowledgment and closure replies a caseworker sends back.
A similar bug hit the hazard-report flow. A template update meant to shorten routine closures started auto-drafting "resolved, thank you for reporting" replies for hazard reports too, before dispatch had actually confirmed anyone had gone out.
P
PositionPatch the hazard-report flow only, and require a dispatch confirmation code before any closure reply on that flow can send. Leave the other eleven complaint types running as they were.
I
ImpactThe narrow fix costs one engineer, one afternoon, and one new required field in dispatch's system. Leaving the flow open costs a resident who reported a real gas smell and got told it was resolved when nobody had gone out yet.
C
Cost asymmetryA slower closure email on a pothole report is cheap and visible, a resident calls back annoyed. A false "resolved" on a hazard report is hidden, and it can cost a life, discovered only if something goes wrong before anyone checks. That asymmetry is far sharper here than at Corveth and Yarrow.
K
Kill criteriaGo broad, and pause every auto-closure across all complaint types, the moment a single hazard-flow miss is confirmed, not two. A dollar loss can wait for a forty eight hour audit. A false safe reading on a hazard report can't.
What's different about the stakes here
At Corveth and Yarrow, the kill line is two or more flows over fifteen percent, because the cost of waiting one audit cycle is measured in dollars. At Quillfeather County, the kill line is one confirmed miss, because the cost of waiting is measured in whether someone actually showed up to a real hazard. Same framework, same instinct to stay narrow first. The number that flips it moves with what's actually at risk, not with how the last incident felt.
Swap the trigger and it still runs
Speed: if the VP needed an answer in ten minutes instead of overnight, the position doesn't change, only the patch ships with the crudest version of the block first, a hard refund cap, with the photo requirement following within the day.
Cost: if the fix turned out to need three engineers for a week instead of a weekend, the position still doesn't move. That was never the question. Whether the other flows shared the same root cause was.
The model got better: if the underlying model had genuinely gotten better at holding onto policy instructions, that's evidence for trusting it more broadly over time, not proof the one broken template is safe today. The hard rule outside the model stays either way, since the whole point of it is that it doesn't depend on the model behaving.
Where people run it wrong
Treating "it cost real money" and "it's everywhere" as the same question, when they need separate evidence.
Reaching for the size of response that matches how bad the number feels, instead of the size that matches where the audit actually finds the failure.
Waiting for a second incident to prove the first one was narrow, instead of running the forty eight hour audit that could have proven it the same day.
How to use it live
Say the reframe before reaching for the easy move: "Before I answer where this goes, I want to separate two questions: how bad was this, and how far did it spread. Those aren't the same question, and only one of them tells me whether to go broad." That buys you a beat to find where the fix actually belongs, instead of reaching for the kill switch by reflex.
Flashcards (click a card to flip it)
1 · THE FRAMEWORK
Which framework fits this question, and what's the hardest step to nail?
Tap to flip
ANSWER
PICK, for a tradeoff between two failure modes of an incident response. The hardest step is C, the cost asymmetry: naming why a hidden, compounding shutdown cost outweighs a cheap, visible patch.
2 · THE PERSON
Who is this answer about, and what does she already do well?
Tap to flip
ANSWER
Selene Nazario, CX quality lead at Corveth and Yarrow for four years, who can tell whether a damage claim's story holds together before she finishes the first line.
3 · THE HABIT
What did Selene stop doing once Draftbench kept looking right?
Tap to flip
ANSWER
Pulling a weekly hand-checked sample of forty high-value damage claims. It shrank from forty a week to zero over eleven months, because the sample kept coming back clean.
4 · THE ASYMMETRY
What are the two ways to get this pick backwards, and who gets hurt by each?
Tap to flip
ANSWER
Fixing nothing but the loudest complaint leaves the same failure live elsewhere. Shutting the whole tool off punishes a hundred thirty reps and every customer on fifteen thousand nine hundred emails a week that were never broken.
5 · THE POSITION
State the pick in one sentence, the way you'd say it out loud.
Tap to flip
ANSWER
Patch the damaged-in-transit refund flow with a hard rule outside the model, and leave Draftbench running on every other flow.
6 · THE NUMBER
Fill in the blank: the broken flow ran wrong for ___ days, sent ___ refunds with no photo on file, totaling about $___.
Tap to flip
ANSWER
Nine days. Three hundred forty refunds. About $260,000.
7 · THE KILL CRITERIA
What evidence would flip this pick toward a full shutdown?
Tap to flip
ANSWER
Two or more of the other six high-risk flows crossing fifteen percent on the same verification-skip check, or a root cause that traces to the model itself instead of one prompt template. Right now none of the six clear that bar.
8 · THE TRANSFER
Section 4 runs PICK again on a different product, with a much stricter kill criteria. Which product, and why does the bar move?
Tap to flip
ANSWER
Quillfeather County's 311 hazard-report line. The kill line drops from two flows to a single confirmed miss, because a false "resolved" on a real hazard risks a life, not just a dollar figure that can wait for an audit.
Check yourself Score: 0 / 0
Fill in the blank
1. The damaged-in-transit refund flow ran wrong for ___ days, sent ___ refunds with no photo on file, totaling about $___.
Show hint
Check the numbers in "Let's learn" and flashcard 6.
Show answer
Nine days; 340 refunds; about $260,000. That's the sunk cost that already happened by the time anyone caught it, separate from whichever fix gets chosen next.
Multiple choice
2. Why does the narrow fix stay the position even after a two hundred sixty thousand dollar incident?
A. Because a two hundred sixty thousand dollar loss is too small to justify any engineering work.
B. Because the forty eight hour audit shows the failure is isolated to one flow, so a full shutdown would trade a bounded, visible cost for a much larger, hidden one spread across fifteen thousand nine hundred healthy emails a week.
C. Because Draftbench's engineering team refused to shut the tool down.
D. Because the finance team's reconciliation report can't be trusted.
Show hint
Look at the cost asymmetry step, and what the audit actually proved.
Show answer
B. The dollar figure is real, but the audit is the evidence that decides the scope of the fix, not the size of the loss on its own.
True or false
3. True or false, with why: a company wide shutdown is the safer choice here because it costs nothing while the investigation runs.
True
False
Show hint
Check the "cost of the next two weeks" chart.
Show answer
False. A two week shutdown costs about $118,000 in labor alone, it just doesn't show up as a single line item the way the $260,000 incident did, so it feels free even though it isn't.
Short answer
4. What old decision does this answer take back, and why did it make sense when it was made?
Show hint
Look for the choice buried inside the prompt template, not a person's judgment call.
Show answer
Model answer: Splitting the refund policy into two places in the prompt template, a short version most drafts used and the actual enforcement rule sitting lower down. It made sense when the template was first built, since it kept most drafts short. It stopped making sense once someone could trim the template for speed without realizing the enforcement rule was the part they'd cut.
Short answer, apply it yourself
5. Think of a tool you use yourself that got an update which quietly changed one behavior. What's a hard, outside-the-model rule you wish existed so a future update couldn't quietly remove it?
Show hint
Look for a safety check you'd want enforced by a rule, not by hoping the model remembers it.
Show answer
Model answer: "A budgeting app auto-categorizes purchases, and it used to always flag anything over $500 for me to confirm before filing it. An update once quietly dropped that flag for one category. I'd want the $500 confirmation step to live as a rule the app enforces before saving a transaction, not as an instruction buried in whatever prompt drives the categorizer, so trimming that prompt later can't silently remove it." Any answer works if it names a real feature and a check that shouldn't live only inside a prompt.
Short answer, the number question
6. If the audit had found that two of the six other flows also skipped verification above fifteen percent, would the position still be the narrow fix? Walk through it.
Show hint
Check the kill criteria step directly, not the position step.
Show answer
No. The kill criteria is exactly "two or more flows over fifteen percent." Finding that would be the evidence that the root cause is shared, not local to one template, and it would flip the pick toward pausing the affected flows broadly, or the whole tool, while the shared cause gets fixed. The point of stating the kill line ahead of time is that this isn't a judgment call made in the moment, it's a number that was already agreed on before anyone knew which way it would land.
Before you close the answer
Why this works
Tests whether you'll size an incident response to where the evidence actually points, or reach for the response that matches how bad the number feels. Most candidates either patch quietly and hope, or reach for the kill switch and call it caution.
Follow-up traps
"What if the audit takes too long and the exposure keeps growing while you wait?" Response: the hard rule ships within hours, before the forty eight hour audit even starts, so the exposure on the broken flow is already closed while the audit checks the rest.
"Isn't a forty eight hour audit just picking a number that happens to clear your own position?" Response: no, because the audit's outcome could have gone the other way. If two or more of the six other flows had failed the same check, the position would have gone broad. The number decides the answer, it isn't picked to match one.
If pressed
The photo-and-approval rule now lives as a deterministic check outside the model entirely: it inspects the drafted reply for a refund promise and a dollar figure, and blocks the send button if no photo is attached, regardless of what Draftbench itself believes about the policy that week.
From U2xAI Academy
From answering questions to owning outcomes.
A live workshop where you ship a working AI agent, defend a launch decision, and walk away with a portfolio recruiters can't wave off, not just more questions to study.