An SLA policy defines a target type, an optional priority filter, response- and resolution-time targets in minutes, and whether the clock only runs during business hours (the default). Every incident matched to a policy gets a running instance tracking elapsed time, pauses, and breach status.
Pausing the clock
Pauses are explicit, not automatic — an agent pauses the SLA clock, typically when moving a ticket to a "waiting on user" or "waiting on vendor" state. Effective elapsed time is wall-clock time minus accumulated pause time, and every pause/resume event is logged for audit.
Breach handling
A watcher job checks for breaches every 5 minutes. On breach, it marks the incident breached, opens a management-escalation record (up to three manager levels), and sends a Slack notification — deduplicated on a 24-hour window so it does not repeat-fire the same alert.
On-call & paging
On-call schedules support daily, weekly, or custom rotations with overrides for vacations or swaps — an active override always takes precedence when resolving who is on call right now. Pages escalate through the rotation automatically: an unacknowledged page past its timeout (default 15 minutes) escalates to the next person; past the max attempt count, it is marked failed. Slack and email are always available as paging channels, with external providers configurable per tenant.
Pausing the SLA clock on a ticket
From an incident, pause the SLA clock when it's legitimately blocked on the requester or a vendor — moving it to a "waiting on user" or "waiting on vendor" state is the usual trigger. Resume it once work can continue. Every pause and resume is timestamped on the timeline, so the audit trail shows exactly how much of the elapsed time was actually yours.
Adding an on-call override
Add a temporary override (vacation, swap) against a schedule when the normal rotation doesn't apply for a stretch of time — an active override always wins over the computed rotation when the system resolves who's on call right now.
Example
A critical incident breaches its 45-minute resolution SLA while the on-call engineer is mid-investigation. The breach watcher marks it breached, opens a management-escalation record, and posts to the configured Slack channel — all within the next 5-minute check cycle, with no one needing to notice the countdown manually.