Introduction

Escalation is how an incident reaches the person who can act on it. In UnifyApps today that happens through assignment and status, and it happens because a human does it. There is no automated notification from AI Governance, and designing your process as though there is one is the most consequential mistake on this page.

Note: Stated plainly: AI Governance does not send notifications. No email, no chat message, no webhook fires when an incident is raised, assigned or escalated. Nobody learns about an incident unless they open the Incidents list or somebody tells them. Plan for that.

What escalation consists of today

Mechanism	What it does	What it does not do
`Assigned to`	Names the person responsible	Tell them
`Status`	Records where the work has got to	Move on a timer
`Note`	Carries context between people	Reach anyone who is not looking
The action itself	Blocks or masks at request time	Announce that it happened

Every one of these is a record, and records are pull rather than push. The gap between the two is the thing your process has to close.

Why the gap matters more than it sounds

A blocking control is self-limiting: the bad thing was stopped whether or not anyone noticed. A flagging control is not. A Flag lets the content through and records it — so the entire value of a flagging control depends on somebody reading the queue.

An unread flag queue is worse than having no control at all, because it produces the paperwork of governance without the effect. Every framework page in this KB makes the same point about evidence; this is where it bites operationally.

"A flag nobody reads is not a control. It is a log entry with ambition."

Designing escalation around what exists

Name a rota, not a role — "The AI governance team reviews incidents" is not a process. A named person, on named days, with a named backup, is. Without notifications the review cadence is the escalation mechanism.
Set the cadence from the worst control, not the average — Ask: if the most serious flagging control you run fired right now, how long is it acceptable for nobody to know? That interval is your review frequency. For most teams running PII or secrets checks on flag, it is daily.
Use assignment as a handoff, and confirm it out of band — Assigning is correct and durable, and it is invisible to the assignee. Pair it with a message wherever your team actually talks.
Do not plan around Block removing the need to notice — Blocking would remove the dependency on a person reading the queue — but Block only executes on a Control · Enforced connection. Check the asset's Connection type before relying on Block; on Observe · Advisory assets every control behaves as Flag. The review cadence below is your only escalation mechanism, not a fallback for one. See Connection Type & Control Mode.
Escalate by severity — Confidence reflects how the control was configured, so it does not tell you how certain a single finding is. See Incident Data Model.

A workable review loop without notifications

Cadence	Look at	Decide
Daily	`Open`, filtered to the highest severity	Anything needing action today; assign it
Weekly	Everything raised in the week, by policy, then the policy's `Controls` tab for per-control counts	Which controls are noisy; tune them
Monthly	Closed incidents, `Resolved` against `False Positive`	Whether the control set is earning its keep

The Incidents list supports all three directly: filter by status and action, narrow by policy, and bound it with the Detected date range.

What is not here, said once more

No notification of any kind on incident creation, assignment or status change.
No SLA timers, no auto-escalation on age, no reminders.
No subscriptions — you cannot follow a policy or an agent and be told when it fires.
No bulk triage, so a large queue is a large amount of clicking.

If automated escalation is a requirement for your programme rather than a convenience, raise it with your UnifyApps account team so it is counted — and until then, write the manual cadence into your own procedure documents, because that cadence is genuinely load-bearing.

Escalation & Notifications