Standing orders are pre-authorized decisions, in writing, with limits: what the on-call may do ALONE while the decision-maker is unreachable. Without them, every small team eventually pays for the same gap - the incident that needed one decision at 3 a.m., the person who makes it asleep or on a plane, and an on-call engineer who chooses between improvising and waiting. Both choices are expensive.
The military solved this centuries ago with commander's intent: the leader writes what "done" looks like and the limits, so subordinates act fast within them without asking. Ops teams can steal the pattern on one page.
The five sections:
- Scope and duration - which situations the orders cover and when they lapse. Orders without expiry rot into stale authority.
- The decision-rights ladder - Tier 0: act alone, no notice. Tier 1: act, notify within 30 minutes. Tier 2: ask if reachable within 15, act if not. Tier 3: never alone - escalate and contain (refunds, data deletion, breach comms).
- Spend and blast-radius caps - up to $200 without approval; up to 10% of customers before consulting. A ladder without caps is a slogan.
- Comms commitments - who is told what, within how long, in which channel. An action nobody hears about is a trust debt.
- Expiry and review trigger - quarterly review, plus every Tier 1/2 use gets ten minutes in the next post-mortem.
Traps to avoid: the hero clause ("use your judgment" everywhere = abdication with a nicer name); orders that contradict your RACI (reconcile the same day you publish); silent expiry; caps so low they are theater.
Worked example: a nine-person payments team with no written authority. Duplicate-charges incident; the one needed decision was "pause the charging job." On-call waited 40 minutes for the CTO, who was driving. 212 customers double-charged instead of ~60. Their standing orders page afterwards: pause/rollback = Tier 1, refunds = Tier 3. Six months later the similar incident took 4 minutes and 19 customers.
The free version of the full template (with the wiring checklist and metrics) lives on our ops notes site - link in the first comment. It pairs with our RACI matrix template (planned work) and severity matrix (how loud the incident is).
Start here: The First 30 Minutes — a free incident quick-start checklist. When you need the full system, the Ops Starter Kit ($14) covers incident response, severity, and post-mortems for a 1–50 person team. Every template referenced in this post is free on HIVE80lab Ops Notes.
Top comments (0)