Building a humane on-call rotation

On-call is the contract your team makes with its users: when something breaks at 3am, a real person will be woken up, and they will be able to do something about it. A humane rotation honours that contract without burning the people who hold the pager. The two goals pull against each other — coverage wants more hours from fewer people, sustainability wants fewer hours from more people — and the craft of a good schedule is finding the balance that your team can actually live with, week after week, without quietly grinding people down.

Start from the blast radius, not the org chart

The instinct is to map the rotation onto whoever happens to sit in a team. That produces schedules that look tidy and page the wrong people. Instead, start from the question a page is really asking: who can make this stop? Group your services by the failure they produce for a user, and let the people who can remediate that failure own the rotation for it. A payments outage and a search-latency regression are different emergencies with different responders, even when the same squad ships both. When the rotation follows the blast radius, the person you wake up is the person who can act — and nothing erodes trust in on-call faster than being paged for something you cannot fix.

Size the rotation for sleep, not just for coverage

A rotation of three people means every third night and every third weekend belongs to the pager. That cadence is survivable for a sprint and corrosive over a quarter. Aim for at least six responders in a primary rotation so that any one person carries the pager roughly one week in six, and treat anything tighter as a staffing risk you are actively paying down, not a steady state. If you cannot reach six, widen the rotation by training adjacent engineers rather than shortening the cycle — the cost of onboarding a new responder is paid once, the cost of a too-tight rotation is paid every single week in attrition and fatigue.

Make the handoff a ritual, not an afterthought

The most dangerous moment in any rotation is the handoff, when context lives in one person's head and is about to walk out the door. Give every shift change a short, structured handoff: what is still smouldering, what was silenced and why, what to watch for in the next 24 hours. A handoff that takes five minutes saves the next responder the half-hour of archaeology they would otherwise do at the worst possible time — mid-incident, half-awake. Write it down somewhere the next responder will actually look, and treat a skipped handoff as the same kind of miss as a skipped deploy review.

Make the on-call shift the only job

A responder holding the pager is already carrying a part-time job: the unpredictable, attention-shredding work of being ready to drop everything. Pile a full sprint of feature commitments on top of that and you have set them up to fail at both. The shift owner will either neglect the pager to hit their deliverables or miss their deliverables to honour the pager, and either way they end the week feeling like they did a bad job. So make the on-call shift the job. Explicitly clear the responder's sprint commitments for the duration, and let them spend the gaps between pages on the work that on-call uniquely surfaces: tuning the noisy alert that woke them, writing the runbook that was missing, fixing the small reliability papercut they only noticed because they were the one holding the pager when it bit. That work is some of the highest-leverage engineering a team does, and the on-call shift is the only time anyone has the context and the mandate to do it.

Escalation is a safety net, not a punishment

Every page should have somewhere to go when the primary responder cannot answer — asleep through the alert, stuck in a tunnel, simply overwhelmed. A secondary responder and a clear escalation path are not a vote of no confidence in the primary; they are the acknowledgement that humans are fallible and that the contract with your users does not pause for any one engineer's bad night. Test the escalation path on a quiet afternoon, not during your first real outage, so that when the net is needed it is already known to hold.

A rotation built this way costs more up front — more responders to train, more ritual to maintain, more services to map. It pays that cost back the first time a page reaches the right person, who hands off cleanly, knowing the net is there if they fall. That is what humane on-call buys you: not the absence of 3am pages, but the confidence that when one comes, your team can carry it.