Operators as People: On-Call, Toil, Trust and Wellbeing

Every function of the operations loop ends, at some hour of the night, in a person. A page from the observability platform (O1 Observe) reaches an engineer who must work out what is wrong (O2 Diagnose), decide whether a change is safe at that hour (O3 Change), bring the service back or stop an agent that is acting on it (O4 Restore), and then, on a later day, help to remove the cause so that the next engineer is not paged for it (O5 Sustain). Earlier chapters designed the loop, its autonomy budget and its observer. This chapter treats the people who carry it: the engineers on call, the duty managers who act as incident commanders, the service-desk staff and the agent operators, and what the research reports about the load on them, the effect of automation on their attention and sense of responsibility, the law that governs their time, and the rights of the employee representatives who must agree to the arrangements.

The argument has four parts. The load on operators is a design property of the loop and not a personal failing, so it is measured for a rota and never for a named engineer. Automation does not remove the operator from the loop. It changes the work into supervision and takeover, which the research on vigilance and complacency describes as hard to do well and which concentrates blame on the nearest person when it goes wrong. On-call time is not free time in law once the constraints on it are heavy enough, and the organisation therefore has to design response times, rest and compensation with the rules in view. And in both of the book's organisations, a charter written with the representatives first is the instrument that carries these decisions.

Figure 25.1: From sources of load through what studies report to the design levers of an on-call charter that is agreed first with employee representatives. The table below pairs them.

The table pairs each source of load with what studies report and the lever in the on-call charter. Every lever is agreed first with the works council or union and reviewed monthly, and the observer and the stop path sit outside the agent.

Source of load	What studies report	Design lever
Pages out of hours	Rest and mood after availability duty; alarm burnout and desensitisation	Page budget and rest rule; team-level metrics only
Night call-outs	Rest and mood after availability duty	Page budget and rest rule
Supervising an agent that acts	Vigilance falls and skill decays; blame lands on the nearest operator	Drills and dark days; delegation record naming owner and delegator; stop right without penalty
Toil that moves to supervision	Vigilance falls and skill decays	Drills and dark days

The chapter builds on conclusions of the earlier volumes. AI Red Team, Chapters 6 and 15, recorded that human command is built and not assumed, with an interruption path outside the system it stops, and that skills erode when AI does most of the work (F52, F53) (298, Nordqvist, 2026). AI Threat, Chapters 6 and 14, collected the evidence that reliance on AI reduces effort and checking and that automating junior work removes the route by which experts are made (F66) (299, Nordqvist, 2026). AI Boss, Chapters 11 to 15 and 26, set out the quiet harms of monitoring and pace, the mixed evidence on whether algorithmic management works, the rule that an approval given in seconds is a signal of failure, and the co-determination of tools that can monitor staff (F84, F86, F89, F90) (301, Nordqvist, 2026). AI Blue, Chapter 21, concluded that the analyst's attention is the scarce resource, that measures concern the system and not the person, and that whether AI relieves or intensifies the load depends on team design (F110) (302, Nordqvist, 2026). AI Purple, Chapter 23, added that a session is safe for the truth when records name roles and not people and no result enters an appraisal (F137) (304, Nordqvist, 2026). The operations chapters before this one supplied the budgets and records to which the charter refers: the noise budget (Chapter 6), the blameless review (Chapter 12), the delegation profile and autonomy budget (Chapter 4), the mandate and stop right (Chapter 16), the observer (Chapter 17), the rule that metrics are about services and teams (Chapter 20) and the operating models in which the rota sits (Chapter 21).

The on-call burden

On-call is the arrangement by which a person is available to respond to a service's alerts outside their working hours, and in many organisations during them as well. Its cost to the person has been studied more in medicine, emergency services and industrial work than in IT operations, and the studies that exist in IT are small. The chapter reports what each measured and keeps what the author concludes separate.

The best-controlled study found is not from IT operations specifically. Dettmers and colleagues followed 132 employees in 13 organisations, with daily surveys over eight days, four with required availability for work outside normal hours and four without, and collected morning cortisol from a subsample of 51. They found that required availability was associated with changes in start-of-day mood and in the cortisol awakening response, and that the person's control over off-job activities explained the mood effect and not the cortisol effect (150, Dettmers et al., 2016). The authors read this to mean that hours of required availability cannot be treated as leisure, because the control and recovery that make time leisure are restricted. The sample is small and the design is within-person over eight days, so the study supports a claim about availability duty in general and cannot give an effect size for an engineer who is paged twice a night.

The practitioner literature of site reliability engineering supplies design numbers and not measurements. The chapter on being on call in Google's book states that at most 25 per cent of an engineer's time should be spent on call, that the maximum number of incidents is two per 12-hour shift, that a single-site rotation needs at least eight engineers and a dual-site rotation at least six, and that the company compensates on-call work with time off or cash; it also states that stress hormones can impair cognitive functions and lead to suboptimal decision making (118, Spadaccini, 2016). These are the targets of one organisation with its own scale and staffing and are used here as reference points for a design discussion, not as thresholds with an evidence base.

A survey and interview study by an engineer at a large cloud provider gives the one finding that bears most directly on design. Barteneva surveyed and interviewed about 240 engineers at different levels about their on-call satisfaction and repeated the study a year later with a larger group. She reports that the number of pages alone did not explain satisfaction, and that team culture, autonomy and the power to drive change contributed significantly, and that teams with high satisfaction shared practices such as hands-on onboarding, blameless retrospectives and an effective feedback loop (151, Barteneva, 2021). The article is a practitioner report in a professional magazine, does not give the second study's sample or any statistics, and is read here as a hypothesis worth testing in one's own rota. A rota with a low page count and no power to fix the causes may be worse to carry than one with more pages and a team that closes them.

Workforce surveys add the scale of the problem and its limits. The 2025 workforce study of ISC2, an online survey of 16,029 cybersecurity practitioners and decision-makers, found that 48 per cent said they felt worn out from trying to keep up with evolving threats and technologies and 47 per cent that they felt overwhelmed by their workload (216, ISC2, 2025). It is a survey of security staff by a professional body, not of operators, and it measures self-reported feeling, not health. The sound conclusion from the whole body of evidence is narrow. Required availability is not free for the person who gives it; the burden depends on the interruptions, the control the person has and the culture of the team; and no study found measures the effect of the page budgets and rest rules proposed below. Those are the author's design conclusions, to be tested by each organisation against its own team-level data.

Alert fatigue and toil

Alert fatigue is the loss of responsiveness to alerts that follows a high volume of alerts that need no action. The research on it is concentrated in security operations centres, which share with operations a pager, a queue and a high ratio of noise to signal, and the chapter applies it to operations by analogy and says so.

Alahmadi, Axon and Martinovic ran a survey of 20 practitioners and then interviewed 21 practitioners from seven security operations centres. Most of the alarms the practitioners called false positives were, on their account, true alarms triggered by benign behaviour in the organisation's environment, which analysts may choose to ignore, and validating alarms was described as a tedious task that can cause alarm burnout and eventually desensitisation (213, Alahmadi et al., 2022). The sample is small and the recruitment non-random, as the authors state, so the study describes mechanisms and does not estimate prevalence. The mechanism matters for operations because it shows that the number of pages is not the whole measure: a page that a person learns to dismiss costs attention and teaches the person to dismiss.

Tariq and colleagues reviewed the research on alert fatigue in security operations centres through the lenses of automation, augmentation and human-AI collaboration, identified four major causes, and anticipated that the research directions it proposes would help in other command and control domains as well (215, Tariq et al., 2025). Sundaramurthy and colleagues studied one corporate security operations centre for six months as anthropologists, built a model of analyst burnout with grounded theory and checked it against the field notes of a second centre. They report that burnout arises from a cyclical interaction of human, technical and managerial factors, that it leads to poor judgement and turnover, and that common coping measures such as career progression address symptoms and not root causes (214, Sundaramurthy et al., 2015). The finding that matters here is the shape: a vicious cycle of noise, tedium and loss of skill that has a managerial component as well as a technical one, which implies that a page budget alone does not break it.

Toil is the operations name for a related cost. Google's book defines it as operational work tied to running a production service that tends to be manual, repetitive, automatable, tactical and devoid of enduring value, and that grows with the service; the company aims to keep it below half of each engineer's time, reports from its own quarterly surveys an average of about a third, and states that too much toil leads to burnout, boredom and discontent (253, Rau, 2017). The last statement is the experience of one organisation, not a measured effect, but it agrees in direction with the studies above. AI changes the form of toil and may not remove it. An engineer who once restarted a service by hand now reviews the proposal of a runbook-runner agent, confirms the observer's check and files the record, so that execution becomes supervision. Whether that supervision is lighter or heavier depends on how often it is needed and on how well the engineer can still judge what is proposed.

The noise budget of Chapter 6 is the instrument against alert fatigue. It sets a ceiling on pages per shift, a floor on the share of pages that a person marked as actionable and a ceiling on non-Tier 1 pages out of hours, and it is a property of a rota and a service reported for the team. A breach of the budget is a finding on the alert rules and the correlation policy, and the rota that carried the pages is not at fault. The same budget appears in the charter below, so that the rule is written in one place that the representatives have agreed.

Automation and the operator

The ironies of automation are the oldest and best-supported part of this chapter. Bainbridge argued in 1983 that automating a process leaves the operator with the tasks the designer could not automate, usually the hardest and rarest; that skills which are not exercised deteriorate; that people are poor at sustained monitoring for rare events; and that designers who regard the operator as unreliable and try to remove them create a system in which a person must nevertheless take over when the automation fails, without the practice to do so (217, Bainbridge, 1983). The paper concerned process plants and aircraft and predates AIOps by four decades. The same structure recurs in the operations of 2028: an agent restarts, scales and renews certificates, and the engineer is called when the agent's runbook does not fit.

The empirical work since has refined the mechanism. Parasuraman and Manzey reviewed studies of complacency and automation bias and proposed an integrated model with attention at its centre. They report that complacency tends to appear when operators have several tasks at once and manual tasks compete with automated ones for attention, that it affects novices and experts alike and does not disappear with simple practice, and that automation bias, the omission and commission errors that follow from an imperfect decision aid, is not prevented by training or instructions (218, Parasuraman & Manzey, 2010). The implication for an operations rota is that an engineer who supervises an agent while also holding the pager for three other services is in the condition the review describes, and that exhortation to stay alert is not a control. The controls are structural: fewer concurrent tasks for the person who supervises, an observer independent of the agent so that the engineer is not the only check (Chapter 17), and seeded faults that test whether the supervision catches errors. AI Boss recorded the same rule from the management side, that an approval given in seconds signals that oversight is not real (F84), and AI Threat that reliance on AI reduces checking among those who trust the tool (F66) (218, Parasuraman & Manzey, 2010).

Responsibility follows the same path. Elish named the pattern the moral crumple zone: responsibility for an outcome may be misattributed to a human operator who had limited control over the behaviour of an automated system, so that the person absorbs the consequences as a crumple zone absorbs the force of a crash. Her cases, drawn from the partial meltdown at Three Mile Island and the crash of Air France Flight 447, concern nuclear and aviation systems (149, Elish, 2019). The concept has not been tested in operations studies, and its application here is the author's reasoning: where an agent acts with delegated authority and a person is on call, a post-incident review that asks who was on call, and not who delegated the action, reproduces the structure. A stop path that took 17 minutes against a target of 5, as in the first drill of Hansa Mutual's IT-operations agent, is a design fault, and an incident commander who is asked why the agent was not stopped sooner is being asked about a design that someone else chose.

Three design rules follow, each written into the charter. The first is that the delegation record names the delegator and the owner. The rule of this book is that a system "decides" only where a decision was formally delegated, and the record then says who delegated it; the delegation profile of Chapter 4 and the mandate of Chapter 16 therefore identify the owner of an agent's action class, and the on-call engineer is the person who stops it, not the person who answers for it. The second is that the stop right is exercised without approval and without penalty. An engineer who stops an agent on suspicion and is wrong has used the right as designed, and the review treats it as a data point for the observer's thresholds. The third is that reviews name roles and not people, as the series' earlier volumes require, and attribute an action to its mandate and its record.

Whether AI relieves or intensifies the load on operators is open. It is observable that observability and incident tools now summarise alerts and propose causes, and that the page-reduction effect of correlation can be measured against a golden incident set (Chapter 6). It is observable that no independent study of operators' wellbeing under autonomous operations agents was found in the research for this chapter, which covered the sources cited here and a search of the research literature in November 2026. It is expected, by the reasoning above, that supervision work grows where agents are given Level 2 and Level 3 authority, because the engineer must verify what the agent proposes and the observer must be watched. It is speculation that the net effect on hours and on health is positive or negative; it depends on team design, which is what the charter decides.

Blameless culture and psychological safety

The practice that the SRE tradition gave operations for learning from failure is the blameless review. Google's postmortem chapter says that a blameless postmortem must focus on identifying the contributing causes without indicting any individual or team, assumes that participants acted reasonably given what they knew, and links blame to reporting: people who fear punishment do not bring issues to light (259, Lunney & Lueder, 2017). Chapter 12 set out the practice and its limits. The limit that matters for this chapter is that blamelessness concerns the individual and not the system. A review that stops at "the engineer made a mistake" is not blameless, and a review that excuses a known unfixed weakness is not a review. The action tracking of Chapter 12 closes that gap.

The research that underlies the term psychological safety is older than operations. Edmondson studied 51 work teams in a manufacturing company and found that team psychological safety, a shared belief that the team is safe for interpersonal risk taking, was associated with learning behaviour in the team, and that learning behaviour mediated the link between psychological safety and team performance (152, Edmondson, 1999). The setting was manufacturing teams of the 1990s, and the finding is an association in one company, so it supports a hypothesis for operations teams and does not prove it. Barteneva's operations finding, that high-satisfaction teams share blameless retrospectives and a feedback loop, points the same way.

For operators who supervise agents, psychological safety has two specific tests. An engineer must be able to say that an agent's proposal looks wrong, or that the engineer cannot judge it, without being asked why the agent was bought. An engineer must be able to stop an agent without a review that treats the stop as the incident. AI Purple recorded the matching rule for exercises: a session is safe for the truth when the charter is written first, records name roles, no result enters an appraisal and anyone may pause (F137). The operations charter applies the same rules to the rota.

Working time

On-call time raises a question of employment law before it raises one of wellbeing: whether it counts as working time. The answer is set by Directive 2003/88/EC and the case law of the Court of Justice, and the rules of the member states that transpose it. The directive defines working time as any period during which the worker is working, at the employer's disposal and carrying out their activity or duties, and a rest period as any period that is not working time (Article 2). It gives every worker a minimum daily rest of 11 consecutive hours per 24-hour period (Article 3), a minimum uninterrupted weekly rest of 24 hours, added to the daily rest, in each seven-day period (Article 5) and a maximum average working week of 48 hours including overtime (Article 6), and it allows derogations from some of these rules, including for activities where the worker's place of work and residence are distant and in cases of accident or imminent risk of accident, on condition of equivalent compensatory rest or, exceptionally, appropriate protection (Article 17) (18, European Union, 2003).

The Court has applied the definition to on-call duty in three judgments that bracket the question. In Jaeger (C-151/02, 9 September 2003) it held, under the predecessor directive, that on-call duty that a hospital doctor spent physically present in the hospital was working time in its entirety even where the doctor could rest during quiet periods, and that compensatory rest must follow the work immediately (24, CJEU, 2003). In Matzak (C-518/15, 21 February 2018) it held that stand-by time spent at home, where the worker must answer calls within eight minutes and be able to reach the workplace in that time, is working time because the constraints very significantly restrict the opportunities for other activities; where a worker only has to be reachable, only the time spent actually working counts (19, CJEU, 2018). In RJ v Stadt Offenbach am Main (C-580/19, 9 March 2021) the Grand Chamber held that stand-by time counts as working time in its entirety only if an overall assessment shows that the constraints objectively and very significantly limit the worker's ability to manage the time freely and pursue their own interests, and named as factors the length of the response time, the facilities provided and the average frequency of call-outs; it left the application to the national court, and it recalled that pay is for national law (25, CJEU, 2021).

For operations design, three implications follow, stated as organisational implications and not as legal advice. A response-time target is a working-time parameter. An engineer on call who must acknowledge a Tier 1 page within five minutes and be at a keyboard may be in the position the Court described for a very short response time, and an engineer who has 30 minutes and no constraint on location is in a different one. Frequency of call-outs is part of the test, so the page budget is a legal design value as well as a health one. And the classification is made by the national court on the facts, so each organisation records its response time, its call-out frequency and its facilities in the charter and asks counsel to confirm the classification in the member state concerned.

Rest after a night call-out is the second implication. Swedish law, which the Nordvik Region example follows, requires every employee to have at least eleven consecutive hours of rest in each 24-hour period, the period between midnight and 5 a.m. is to be included in that rest, and a temporary deviation for unforeseeable circumstances requires equivalent compensatory leave (Arbetstidslag (1982:673), section 13) (28, Swedish Parliament (Sveriges riksdag), 1982). A night call-out at 02:00 therefore moves the start of the next working day or earns compensatory leave, and the charter says which. The German transposition and the rules of Poland, where Hansa Mutual's service centre sits, were not reproduced for this chapter; the group's Hansa clause KBV-IT-2024-OPS-01 on rest after a night call-out is the instrument that carries the rule there, and its wording is to be confirmed against the national provisions by counsel.

Co-determination

The arrangements above are not the employer's alone to decide in either organisation. Employee representatives have rights over working time, health protection and tools that can monitor staff, and the charter is the document in which those rights are exercised for the rota.

In German law the works council has a right of co-determination, where no statutory or collective rule exists, over a list of subjects that includes questions of order in the establishment and the conduct of employees (Betriebsverfassungsgesetz section 87(1) no. 1); the start and end of daily working time, including breaks, and the distribution of working time over the weekdays (no. 2); the introduction and use of technical devices designed to monitor the behaviour or performance of employees (no. 6); and rules on the prevention of accidents and occupational diseases and on health protection within the framework of statutory provisions (no. 7). Where agreement cannot be reached, the conciliation committee decides and its ruling replaces the agreement (section 87(2)) (26, Germany, n.d.). Hansa Mutual's profile records that the group treats the organisation of on-call and standby as within no. 2 and the monitoring of engineers' commands as within no. 6. The chapter verified the wording of the section against the official text and did not verify the case law on whether standby falls within no. 2, so the group relies on its works agreement KBV-IT-2024 and its operations annex for that classification. For no. 6 the Federal Labour Court holds that a device is designed to monitor when it is objectively suited to collect or record information about the behaviour or performance of employees, and that the employer's intention to monitor does not matter (decision of 16 July 2024, 1 ABR 16/23, paragraph 25) (311, Bundesarbeitsgericht, 2024). The introduction of an AI operations tool that logs engineers' commands is therefore a no. 6 matter whether or not the log was meant for monitoring (AI Boss, Chapters 13 and 23, F86).

In Swedish law the Co-determination in the Workplace Act (Lag (1976:580) om medbestämmande i arbetslivet) obliges an employer bound by a collective agreement to negotiate on its own initiative with the union before deciding on an important change of its activity or of the working or employment conditions of the union's members, and allows the employer to decide first only where exceptional reasons require it (section 11); at the union's request, the employer must negotiate before decisions that concern a member even in other cases, with the same exception for special reasons (section 12) (27, Swedish Parliament (Sveriges riksdag), 1976). Nordvik Region, a public authority bound by the sector's collective agreements, follows this pattern. A change in the standby rota, a new paging tool or an agent that alters the nature of the on-call work is a section 11 matter, and the agreement MBL-NR-IT-2027-01 records how the Region and the unions apply it to operations tooling.

The AI Act adds one provision that applies if an operations tool is itself a high-risk AI system. A deployer who is an employer must inform the workers' representatives and the affected workers before putting into service or using a high-risk AI system at the workplace (Article 26(7)), and Annex III point 4(b) lists among high-risk uses AI systems intended to be used to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate the performance and behaviour of persons in work-related relationships (1, European Union, 2024). Most operations agents do not fall within that wording, since they act on infrastructure and not on people, but an on-call tool that assigns pages by an engineer's past behaviour, or ranks engineers by response, would need to be classified before it is introduced, and Chapter 23 sets out the instrument-level mapping.

Incentives

What an organisation rewards decides what its operators do, and the incentives of operations are easily wrong in three ways. The first is to reward the fix over the prevention. An engineer who restores a service at 03:00 is visible and thanked, and an engineer who removed the cause six months earlier is invisible, so the rota selects for and burns out its heroes. In the Region the engineer who knows recovery best, Joakim Wester, is also the person who takes the most weekend on-call, because the rota gravitates to the one who can fix; that is a key-person load that a cap on weekends per person and a rule to share recovery knowledge address. The second is to measure the person. Chapter 20 fixed the rule that no measure in the catalogue has a person as its subject, and Forsgren and colleagues' SPACE framework supports the caution that productivity cannot be reduced to one dimension; the author adds that activity counts are the easiest to collect and to game (230, Forsgren et al., 2021). The third is to reward the green dashboard. A rota that is rewarded for few pages will learn to suppress alerts, and a rota that is rewarded for fast restoration will restore before it diagnoses. The paired measures of Chapter 20 and the observer of Chapter 17 are the counter.

Compensation is the part of incentives that law and agreement settle. The Court of Justice has left pay for stand-by to national law (Matzak, Offenbach), and the sector's collective agreement at Nordvik Region and the group works agreement at Hansa Mutual fix it. Google's book describes time off or cash within a cap (118, Spadaccini, 2016). The charter records that compensation exists, by reference to the agreement, and does not reproduce figures that belong to the agreement.

Two incentive rules protect against the distortions the earlier volumes found. No exercise or drill result enters an appraisal (F137), and the stop right is never counted against the person who exercises it. A third rule concerns agent operators: an engineer who supervises an agent is rewarded for the quality of supervision, which is measured by the observer's catch rate on seeded errors and by the share of approvals that were reviewed, at team level, and not for the number of agent actions approved.

Worked example: an on-call charter

The following charter is illustrative. It is the artefact that the Region and its unions agree for the technical rota and the duty manager rota, in the form the chapter recommends: scope, response, rest, load, agent clauses, metrics and review in one reviewable file. The identifier family ONC-* is introduced by this chapter. The figures are design values and have not been measured; the Region sets them, records them and revises them from the monthly review.

charter: ONC-NR-2029-01
version: 1.0.0
status: illustrative
organisation: Nordvik Region
decision_record: AIDR-0925          # 2029-02-13, negotiation closed under MBL s.11
agreed_with: union-joint-committee  # MBL-NR-IT-2027-01 applies
effective: 2029-03-01
review: {first: 2029-09-01, then: yearly, monthly_team_review: true}
scope:
  services: [SVC-NR-002, SVC-NR-004]      # Tier 1 e-services
  rotas:
    technical: {people: 11, shift: one week in eleven, handover: "Monday 09:00"}
    duty_manager: {people: 4, role: incident commander for Tier 1}
response:
  tier1_page_acknowledge_minutes: 15
  location_constraint: none            # no obligation to stay at home or on site
  change_needs: negotiation            # s.11: any shorter target or location rule
working_time:
  daily_rest_hours: 11                 # Arbetstidslag s.13, rest includes 00:00-05:00
  after_night_call_out: start of next working day moves, or compensatory leave
  worked_time_during_call_out: counted as working time
  standby_compensation: per sector collective agreement   # no figures here
load:
  out_of_hours_pages_per_shift_ceiling: 5       # design value, average per quarter
  actionable_share_floor: 0.5
  night_call_outs_in_a_row_then_relief: 2
  max_weekends_per_person_per_quarter: 2
agents:
  attribution: delegation profile and named owner, never the engineer on call
  delegation_profile: DLG-NR-OPS-001
  stop_right: any on-call engineer, no approval, never counted against them
  concurrent_supervision: max one agent action class at Level 2 per engineer
reviews:
  naming: roles, not people
  appraisal_use: none                  # drills, seeded faults, stops
metrics:
  subject: rota and service, never a named person
  minimum_group_size: 5
  tools_that_log_commands: negotiate before use
triggers_for_review:
  - ceiling exceeded two months running
  - rest rule breached
  - one person above 1.5 times fair share of weekends

The charter reads as a list of decisions, each of which can be checked. The response clause records the facts a court would weigh under Offenbach: the response time, the absence of a location constraint and (in the load clause) the expected frequency of call-outs. The agent clauses write the three design rules of this chapter into the rota: attribution to the delegation profile, a stop right without penalty and a limit on concurrent supervision.

Practical guide: drafting an on-call charter with the works council

Purpose. Produce an on-call charter that the employer and the employee representatives agree before the rota is changed or an AI operations tool is introduced, and that records response time, rest, load, agent attribution, metrics and review in one file.

Roles. The head of operations (at Hansa Mutual the head of Group Site Reliability and Incident Management, at Nordvik Region the Head of IT and Digitalisation) owns the draft. The incident commanders and a sample of on-call engineers contribute the facts. The employee representatives (the Konzernbetriebsrat and local works councils, or the unions' joint committee) negotiate. The privacy officer reviews anything that logs staff. The service owners confirm the Tier 1 scope. Counsel confirms the working-time classification.

Steps.

1. Collect a quarter of facts from the paging and ticket records, aggregated for the rota: pages per shift, share out of hours, share actionable, night call-outs and the time of the first page after midnight. Do not extract per-person tables; the representatives agree the extract first.
2. State the response time, the location constraint and the facilities provided (laptop, connection, no vehicle) and ask counsel to confirm how the national rules classify the standby. Record the answer in the charter.
3. Set the rest rule from the national provision (eleven consecutive hours is the directive's minimum) and say what happens after a night call-out: later start or compensatory leave.
4. Set the load numbers from the data: a page ceiling per shift as an average over a quarter, a floor on the actionable share, a limit on consecutive nights, a cap on weekends per person. Default: start from Chapter 6's ceiling of 20 pages per shift for a Tier 1 rota with a floor of one half actionable, and lower it to the rota's own median after the first quarter. Adapt to the agreement.
5. Write the agent clauses: the delegation profile that names the owner of each agent action class, the stop right without approval and without penalty, and a limit on how many supervised agent classes one engineer holds at once.
6. Write the metrics clause: rota and service as subject, minimum group of five, no tool that logs commands switched on before agreement, no use of drills or seeded faults in appraisals.
7. Agree the review: a monthly look by the team at the figures, a quarterly look with the representatives, and the triggers that reopen the charter.
8. Record the agreement in an AI Decision Record and publish the charter to everyone on the rota.

Definition of done. The charter is in version control, the agreement is recorded, every number has a source or is marked as a design value, the first monthly review is in the calendar and the page ceiling is wired into the noise budget of Chapter 6.

Across the usage modes

The usage mode describes how the AI is deployed and whose identity it uses, and it changes what the operator carries. The table gives the load and responsibility consequence for the rota and the clause of the charter that answers it. It is the author's reasoning from the studies above, not a measurement.

Usage mode	Typical operations use	Effect on load (direction not measured)	Responsibility risk	Charter clause
Mode 0 Ambient AI	Vendor features in observability or ticketing, switched on by the supplier	Unknown until measured; the rota may not know it is there	Engineer answers for output they did not choose	Inventory of ambient features; negotiation before any that logs engineers
Mode 1 Conversational assistants	Engineer asks a chat assistant during an incident	May cut search time; adds a check on every answer	Engineer answers for the answer	Rules on what may be pasted; the engineer decides
Mode 2 Embedded workplace assistants	Summaries and drafts inside the incident tool, with the engineer's identity	Less writing, more reading; automation bias applies	Engineer is the named actor	Review of drafts at team level; edit-rate sampling
Mode 3 Agentic work tools	Platform engineer drafts infrastructure code and runbooks with an agent	Review load rises with volume	Reviewer is accountable for what is merged	Review caps; provenance in change records
Mode 4 Built AI applications	Triager, change reviewer, scribe built by the organisation	Fewer pages if correlation works; new supervision tasks	Owner named in the mandate	Mandate and owner named; stop right
Mode 5 Autonomous production agents	Runbook runner acting with its own identity	Execution leaves the rota; takeover remains	Highest risk of the crumple zone	Delegation record names delegator; stop without penalty; supervision limit

The degrees of delegation add a second reading. At Level 0 Advisory and Level 1 Assisted the engineer decides each action and carries the cognitive load of the decision. At Level 2 Supervised the engineer approves, and the risk is the approval given in seconds. At Level 3 Bounded the agent acts inside a catalogued runbook and the engineer carries the stop right and the takeover, the tasks Bainbridge identified as the residue of automation. Level 4 Autonomous is never used for the actions the book prohibits, so the person remains the named decider where the prohibitions apply.

Nordvik Region and Hansa Mutual

Nordvik Region runs a technical on-call rota of eleven engineers, one week in eleven, and a duty manager rota of four, among them Oskar Berg, who acts as incident commander for Tier 1 incidents; the platform lead, Maja Lindqvist, is the escalation point. SamDrift's network operations centre pages the rota. Standby is compensated under the sector's collective agreement and the target for a Tier 1 page is 15 minutes. The Region has no Mode 5 agent and its operations assistant NR-OPS-001 is at Level 0 Advisory, so its load question is about pages, rest and the key-person load on its most experienced recovery engineer, Joakim Wester, more than about supervising agents. It negotiates the charter ONC-NR-2029-01 with the unions under section 11 of the co-determination act and the agreement MBL-NR-IT-2027-01, which already keeps response times and closure counts from being reported by name and requires negotiation before a tool that logs engineers' queries or commands is switched on. The decision is recorded as AIDR-0925 (2029-02-13, illustrative), effective 2029-03-01, with a first review on 2029-09-01. The Region's constraint is size: eleven engineers carry the rota, a figure above the minimum of six to eight in the SRE reference, and the page ceiling of five out of hours per shift is a design value that its own quarter of data will correct.

Hansa Mutual runs a 24-hour rota of 12 trained incident commanders across Hamburg and the Polish service centre, each on duty for a week at a time per site, with product-line teams holding their own primary and secondary on-call and a 24-hour service desk under Katarzyna Zielińska. The page target for Tier 1 is five minutes to acknowledge, so the working-time question of Offenbach is live and is for counsel to confirm in each member state. Its IT-operations agent HM-OPS-001 acts at Level 3 Bounded for restarts, certificate renewal and scaling, and the agent operators of each shift window, among them Ewa Kowalczyk for the night window, hold the stop right without approval. The operations annex KBV-IT-2024-OPS-01 (rest after a night call-out) and -02 (team-level metrics, minimum group of five) are in force since 1 January 2028, and -03 requires agreement before AI tools that log engineers' commands are used. The group caps pages per shift, taking the ceiling of 20 and the floor of one half actionable from the noise budget of Chapter 6, and reviews them monthly with the head of Group Site Reliability and Incident Management, Tobias Richter, and in aggregate with the Konzernbetriebsrat under its chair, Thomas Brandt, the page and rest figures for the Polish service centre going also to its own employee representatives. The group records its on-call charter as ONC-HM-2029-01 under AIDR-0975 (2029-03-27, illustrative, after the review of the first quarter of 2029), and the agent clauses (attribution to DLG-HM-OPS-001 and the owner, stop without penalty, a limit on concurrent supervised classes) apply to the night window first. Hansa's difficulty is the seam between the national rules, three employee-representation regimes and a rota that crosses them.

The two differ in the question they ask and agree on the answer. Nordvik asks what an eleven-person rota can bear and negotiates under a duty to negotiate; Hansa asks how supervision of a Level 3 agent changes the work of a rota that already exists and agrees it with a works council that holds co-determination rights. Both write the decision into a charter, keep the metrics at the level of the team and attribute the agent's actions to its delegator.

Summary

This chapter concerned all five operations functions: O1 Observe, because the page and its noise are the first load on a person; O2 Diagnose, because the incident commander carries the judgement; O3 Change, because night changes and the review of agent-authored change fall on the rota; O4 Restore, because the call-out and the stop right are where the person meets the loop; and O5 Sustain, because toil, learning and the condition of the people are what keeps the operation fit over time.

The evidence is more limited than the practice built on it. Required availability is associated with changes in mood and in the physiological response the morning after, the burden depends on interruptions, control and culture, alert fatigue is documented mostly in security operations centres, and no independent study of operators' wellbeing under autonomous operations agents was found. The older research on automation is firmer: operators left with the residue of automation lose practice, complacency and automation bias are not cured by training, and responsibility tends to land on the person nearest the system. The design response is structural: a page budget and rest rule, supervision limits, an independent observer, a delegation record that names the delegator and owner, a stop right without penalty and metrics about the rota and never the person.

The law sets a floor. Directive 2003/88/EC defines working time and rest, the Court of Justice treats stand-by as working time when the constraints on it are heavy, and the response time and the frequency of call-outs are among the factors. German co-determination reaches working time, health protection and tools that can monitor employees, and Swedish law obliges negotiation before important changes. The on-call charter is the instrument that records the response, rest, load and agent clauses and that is agreed first. Whether AI relieves or intensifies the load is open, and the charter decides it team by team. Chapter 26 turns from the load on operators to their craft: the competences needed to supervise agents, the skills that decay and the drills that keep them.

Sources

1. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
2. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (298, Nordqvist, 2026)
3. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (299, Nordqvist, 2026)
4. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. (301, Nordqvist, 2026)
5. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. (213, Alahmadi et al., 2022)
6. Sundaramurthy, S. C. et al. (2015). A Human Capital Model for Mitigating Security Analyst Burnout. (214, Sundaramurthy et al., 2015)
7. Tariq, S., Baruwal Chhetri, M., Nepal, S. & Paris, C. (2025). Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities. (215, Tariq et al., 2025)
8. ISC2 (2025). 2025 Cybersecurity Workforce Study. (216, ISC2, 2025)
9. Bainbridge, L. (1983). Ironies of Automation. (217, Bainbridge, 1983)
10. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. (218, Parasuraman & Manzey, 2010)
11. Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. (302, Nordqvist, 2026)
12. Nordqvist, G. (2026). AI Purple: How Red and Blue Learn Together When AI Joins the Loop in European Enterprises and Public Authorities. (304, Nordqvist, 2026)
13. Spadaccini, A. (2016). Being On-Call. In Site Reliability Engineering: How Google Runs Production Systems. (118, Spadaccini, 2016)
14. Lunney, J. & Lueder, S. (2017). Postmortem Culture: Learning from Failure. (259, Lunney & Lueder, 2017)
15. Rau, V. (2017). Eliminating Toil. (253, Rau, 2017)
16. Forsgren, N. et al. (2021). The SPACE of Developer Productivity. (230, Forsgren et al., 2021)
17. European Parliament and Council of the European Union (2003). Directive 2003/88/EC concerning certain aspects of the organisation of working time. (18, European Union, 2003)
18. Court of Justice of the European Union (2003). Judgment in Case C-151/02, Landeshauptstadt Kiel v Jaeger. (24, CJEU, 2003)
19. Court of Justice of the European Union (2018). Judgment in Case C-518/15, Ville de Nivelles v Matzak. (19, CJEU, 2018)
20. Court of Justice of the European Union (2021). Judgment in Case C-580/19, RJ v Stadt Offenbach am Main. (25, CJEU, 2021)
21. Federal Republic of Germany. Betriebsverfassungsgesetz (BetrVG), section 87. (26, Germany, n.d.)
22. Swedish Parliament (1976). Lag (1976:580) om medbestämmande i arbetslivet. (27, Swedish Parliament (Sveriges riksdag), 1976)
23. Swedish Parliament (1982). Arbetstidslag (1982:673). (28, Swedish Parliament (Sveriges riksdag), 1982)
24. Elish, M. C. (2019). Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction. (149, Elish, 2019)
25. Dettmers, J., Vahle-Hinz, T., Bamberg, E., Friedrich, N. & Keller, M. (2016). Extended work availability and its relation with start-of-day mood and cortisol. (150, Dettmers et al., 2016)
26. Barteneva, D. (2021). Improving On-call Fatigue. (151, Barteneva, 2021)
27. Edmondson, A. (1999). Psychological Safety and Learning Behavior in Work Teams. (152, Edmondson, 1999)
28. Bundesarbeitsgericht. Beschluss vom 16. Juli 2024, 1 ABR 16/23 (Headset-System). (311, Bundesarbeitsgericht, 2024)