Service Level Agreement Enforcement

Incident evaluation begins with three request objects: service carries the measurements (status, downtimeDuration, responseTime, packetLoss), customer supplies the serviceTier that sets the contractual thresholds, and incident holds the report metadata.

Raw telemetry is normalized before any rule fires: isDowntime becomes the boolean service.status == 'down', while downtimeDuration, responseTime, and packetLoss are defaulted to 0 with the ?? operator so missing probes cannot break threshold comparisons. customerTier falls back to 'standard', which means an unknown customer is judged against the looser SLA rather than the premium one.

One violating parameter is selected per evaluation, in priority order under a first hit policy: isDowntime == true wins first and outputs 'downtime' with the duration as parameterValue, then responseTime > 0, then packetLoss > 0, with an 'unknown' fallback carrying 0. Only the first matching row fires, so a full outage is always assessed as downtime even if latency and loss are also degraded.

Ranking downtime above the other signals reflects how NOC triage works in practice: when a service is down, response time and packet loss readings are symptoms of the same event, and double-counting them would inflate both severity and compensation. The 'unknown' row keeps the graph deterministic when monitoring sends an event with no measurable breach.

Breach detection compares parameterValue against tier-specific limits, with the premium row for each parameterType listed before the standard one. Premium contracts tolerate downtime > 10 minutes, responseTime > 200, and packetLoss > 0.5 before slaBreached flips to true; standard contracts allow > 30, > 500, and > 2 respectively, and the final row returns 'No SLA breach detected'. Each hit also writes a breachDescription such as 'Excessive downtime for premium customer' for the incident record.

Running one threshold table per tier pair is how SLA schedules are actually written into enterprise contracts: the customer buys a numeric commitment, and the 2x-4x headroom between premium and standard limits is what differentiates the products. Half a percent packet loss is a defensible premium ceiling because real-time services like VoIP degrade noticeably beyond it, while 2 percent is livable for ordinary browsing traffic.

Severity is graded by crossing slaBreached with parameterType and customerTier under a first hit policy. A breached 'downtime' event is 'critical' (severityScore 3) for 'premium' customers and 'high' (2) for 'standard'; 'responseTime' and 'packetLoss' breaches score 'high' for premium and 'medium' (1) for standard, and anything without a breach resolves to 'none' with score 0.

Shifting every category up one notch for premium accounts encodes the commercial reality that enterprise contracts, like the fiber customer in the sample, often carry penalty clauses and reference risk, so the same outage costs the carrier more. The numeric severityScore alongside the label makes it easy for downstream systems to sort or aggregate incidents without parsing strings.

Payouts scale with the measured breach: when slaBreached is true, a 'premium' customer receives parameterValue * 5 as a 'service_credit', any other breached tier receives parameterValue * 2 as an 'account_credit', and non-breaches get compensationType 'none' with amount 0.

Crediting proportionally to the breach magnitude, minutes of downtime in the sample case, follows the standard SLA remedy model where compensation is a service credit rather than cash, which caps the carrier's exposure while still making the guarantee enforceable. The 5x versus 2x multiplier is a pricing decision that keeps premium credits meaningful relative to the higher fees those customers pay.

Routing follows severityLevel directly: 'critical' escalates to 'senior_management' with an 'immediate' timeframe, 'high' goes to a 'service_manager' within '4_hours', 'medium' to the 'support_team' within '24_hours', and anything else sets requiresEscalation to false. The three output fields together form a complete dispatch instruction for the ticketing system.

Tiered response clocks like immediate/4/24 hours mirror the restoration targets telecom operators publish in support plans, where the escalation level rises with severity so management attention is reserved for incidents that threaten contract penalties. Mapping the no-breach case to 'none' keeps informational events out of the on-call queue.