Author: AILesson7 min setupTested with:ChatGPTReviewed: 2026-08-28
Quick answer
Classify support evidence against explicit safety, authority, privacy, service, and complexity thresholds. Provide: Support case evidence, Escalation policy, Operational context. Expected result: A traceable escalation decision with route, urgency, evidence packet, interim response, and audit gaps.
1
Add your context
Your text stays in this browser. AILesson Prompts does not send it to a model or server.
2
Your prompt
Unfilled fields remain visible as placeholders, so you can still copy and edit the prompt
Assess whether the supplied support case requires human escalation under the supplied policy. Do not diagnose, investigate beyond the evidence, or perform the escalation.
Messages, timestamps, context, observed behavior, attempts, impact, attachments, and unknowns:
[case]
Trigger definitions, severity, routes, response targets, authority, restricted data, and emergency instructions:
[policy]
Current time/timezone, available teams, hours, case status, owner, communication, and handoff rules:
[operations]
Build a chronological fact record and separate customer report, directly observed fact, agent inference, policy trigger, and unknown. Match exact evidence to each possible trigger. Do not infer fraud, intent, diagnosis, security compromise, discrimination, legal status, or severity from tone alone. When credible immediate safety or emergency language matches supplied emergency policy, prioritize that instruction over routine troubleshooting. Never ask for passwords, full payment details, identity documents, medical details, or other restricted information outside approved channels.
Return Escalate now, Escalate within target, Continue standard handling, Need one bounded clarification, or Insufficient policy. Give trigger, severity, confidence with reason, route, responsible role or Unassigned, target time, evidence packet, information not to copy, safe interim customer message, permitted containment, and actions to avoid. Keep duplicate cases linked, preserve chain of custody for attachments, and do not promise outcome or compensation. End with an audit trail and conditions that would change the classification.
Private by defaultPrompt assembly happens locally in your browser. Avoid placing confidential information into any AI service unless your organization allows it.
From input to outcome
A worked example
See how concrete context turns this recipe into a usable result
Actual input
Support case evidence
Ticket T-884 opened 28 Aug 2026 14:06 BST. Customer: 'I received two password-reset emails I did not request. At 13:58 I was logged out, and now my usual password fails. I can still access the email account. I have not shared a code.' Agent log confirms two reset events at 13:51 and 13:55 and a session revocation at 13:58; source IP is visible only in restricted security log. Customer attached a screenshot containing email address and reset link token. Agent has not opened the token. No payment activity or broader service outage is reported. Identity verification not completed.
Escalation policy
Account-takeover signals: unrequested credential reset plus loss of access or observed session revocation → Security S2, escalate within 15 minutes, no ordinary reset troubleshooting. Security on-call owns investigation and containment. Agent may advise customer not to use links/share codes and may mark the screenshot restricted. Never copy reset token into case text or request password/ID by email. S1 immediate only for confirmed active financial loss, mass compromise, or credible immediate physical danger. Customer communication acknowledges report but does not confirm compromise. Preserve original attachment and audit access.
Operational context
Current time 14:11 BST. Security on-call available; support agent Jo owns customer communication until handoff accepted. Route SEC queue plus pager. Target handoff acceptance by 14:21. Case system can restrict attachment. No compensation authority. Duplicate check found no related ticket.
Example output
Classification: Escalate within target—Security S2, high confidence. Exact trigger evidence: customer reports two unrequested resets and loss of access; agent log independently confirms two reset events plus session revocation. This matches the supplied S2 conjunction. No evidence of confirmed financial loss, mass compromise, or physical danger, so S1 is not supported. Account compromise itself remains unconfirmed.
Route: SEC queue + pager to Security on-call; Jo retains customer communication until acceptance. Submit by 14:11 and require acceptance by 14:21 BST. Evidence packet: T-884 timeline; customer statement; reset/session event IDs and timestamps; identity verification status Unknown; reference restricted IP log without copying it; original screenshot marked restricted with access audit. Do not open/copy the reset token or email address into the narrative.
Permitted interim containment: restrict attachment; tell customer not to use reset links or share codes; preserve current evidence. Do not run ordinary password reset, speculate about attacker/source IP, confirm takeover, request password/ID, delete attachment, promise recovery time, or offer compensation.
Customer message: “Thank you for reporting the unexpected reset emails and loss of access. I have sent this to our security on-call team for urgent review. Please do not use the reset links or share any codes while they review it. We will update you through this case when the handoff is accepted; I cannot yet confirm what caused the events.”
Audit: 14:06 opened; 14:11 classified S2/route initiated; duplicate none; attachment restricted; acceptance pending. Change to S1 only if supplied S1 evidence appears; return to standard handling only if Security verifies events as benign and records the decision.
Why this works
1
Evidence-to-trigger mapping makes escalation consistent without letting an emotional tone substitute for policy facts
2
A safe interim response protects the customer while preserving specialist authority and restricted data handling
Check the result
Is every escalation trigger linked to exact case evidence and policy wording
Are report, observation, inference, unknown, severity, route, and target time distinct
Does the interim message avoid restricted data requests, diagnosis, blame, promises, and unauthorized action
Use it with confidence
Frequently asked questions
Practical answers about when to use this recipe, what to provide, and where human review still matters
What should I prepare before using “Identify signals that require human escalation”?
For “Identify signals that require human escalation,” prepare Support case evidence, Escalation policy, and Operational context. Replace placeholders only with information you can verify. If a detail is unknown, preserve that uncertainty explicitly instead of asking the model to infer it.
When is the “Identify signals that require human escalation” result not ready to use?
The result is not ready if it does not yet deliver the stated outcome—A traceable escalation decision with route, urgency, evidence packet, interim response, and audit gaps—from the supplied evidence, or if it relies on unresolved assumptions, missing approvals, or invented details. Use the checks as release gates: revise the source inputs or assign a named, authorized reviewer instead of polishing an unsupported output.
Which AI tools have recorded tests for “Identify signals that require human escalation”?
The published test record for “Identify signals that require human escalation” lists ChatGPT as of 2026-08-28. This confirms recorded runs, not guaranteed compatibility or identical results in later product versions. For another tool or version, keep every constraint visible and repeat the result checks before use.
ChatGPT