When the agent fails on Saturday, who gets the packet?

The Saturday that has not happened yet

It is Saturday 9:12 a.m. Overnight the agent kept "helping." By morning it has either looped on the same tool error, sent a half-right reply, or queued twenty near-duplicates for a human who is at a soccer game. Slack is quiet because the people who understand the agent are offline by design.

Autonomy without a Saturday owner is just an unsupervised weekday demo. This note is a pre-mortem: assume the failure already happened, then write what should have been true.

Write the pre-mortem with the people who will actually be bothered—not only the AI platform team. Weekend retail support, marketplace ops, and on-call engineering may disagree about what "stuck" means. Surface that disagreement on Thursday, not at 9:12 a.m. Saturday.

Failure mode one: nobody owns the pager

If the only "monitoring" is a dashboard nobody opens on weekends, the customer becomes your monitor. Name a human rota—even a thin one—for agents that send, spend, or change records on Saturday. Put the rota in the same place as infrastructure on-call, not in a model vendor's fancy activity view.

Write the shutoff: which config flag, which queue pause, which credential revoke. The person on call must be able to stop outbound actions in under five minutes without shipping code. Link that to your containment thinking in what the agent cannot reach.

If your agent vendor offers an activity view, it is not your pager. You still need a signal in the system your humans already wake up for—PagerDuty, phone, or a monitored inbox. Fancy UIs that require VPN and a laptop fail the grocery-line test.

Failure mode two: the handback is a screenshot

When the agent escalates—or a human interrupts—it must leave a packet, not a vibe. Minimum contents:

• What job it thought it was doing.
• What it already tried (tools, messages, ids).
• What it believes the customer state is now.
• What it recommends next—and what it must not retry.
• Links to logs the on-call can open without a vendor login scavenger hunt.

We have spelled a fuller shape in agent support handback. The Saturday twist is latency: the packet must be readable on a phone in a grocery line.

Redact secrets in the packet by default. Weekend responders under stress forward screenshots to the wrong channel. Build redaction into the handback generator so the fast path is the safe path—see also agent log redaction thinking elsewhere in the journal.

Failure mode three: weekday assumptions leak

Weekday staff catch bad drafts in a shared inbox. Saturday staff might be a single contractor with limited permissions. If your escalate path assumes a full merchandising or support pod, the pre-mortem fails. Either reduce weekend autonomy to read-only drafts, or staff permissions that match the blast radius.

Practice once: freeze a staging agent into a stuck state on a Saturday simulation and time how long until a designated human produces a clean customer outcome. If it takes an hour of Slack archaeology, you are not ready.

Build that drill into how you ship AI applications and agents, next to evals and cost caps.

Consider a weekend mode that drafts only: the agent prepares replies or actions into a queue, and a human sends. Lower autonomy can be the difference between a messy Monday and a public incident. Widen autonomy only after the drill passes.

What you write down before Friday

One page is enough:

1. Agents allowed to act on Saturday (list).
2. On-call name and backup.
3. Shutoff steps with screenshots.
4. Handback template link.
5. Customer holding message if reply will be slow.

Pin it next to the deploy channel. When the real Saturday arrives, you will edit the page—not invent it.

Store the one-pager where contractors can read it without a full-time SSO trail of tears. If your weekend coverage includes vendors, their access to shutoff and packet tools is part of the design—not an afterthought email.

Tie-out to evals and cost.

Weekend autonomy should appear in your agent eval fixtures: at least one stuck-tool case, one over-confident wrong draft, and one volume spike. If the harness only tests happy paths, Saturday will invent the sad ones. Cost routing notes elsewhere in the journal pair with this: a cheap weekend model that fails open is more expensive than a paused queue.

When the drill fails, reduce scope before you hire more weekend humans. Scope is the lever you control on Friday afternoon.

After a real weekend incident, hold a fifteen-minute Monday review with the packet in hand. Update the one-pager the same day. Pre-mortems that never become post-mortems are theater. The point is a living Saturday kit, not a document that dies in a drive folder.

Vendor status pages will not page you when your prompt broke. Your synthetic check should hit a canary job every Saturday morning and alert if the agent has not heartbeated or if error rates cross a line. Cheap canaries prevent expensive customer detection.

Document who may widen weekend autonomy after a clean month of drills. Make widening a deliberate change with the same review as a production deploy—not a Thursday evening toggle because a demo went well.

If no human can take the rota for a given weekend, narrow or pause outbound agent actions for that window in advance. An empty rota is a decision; pretend coverage is an incident waiting for a clock time.

Share the Saturday kit with customer-support leadership even if they are not on engineering pager. They need the holding message and the shutoff owner's phone tree. Surprises between those teams are how small agent errors become brand threads.

Print the shutoff steps once and leave them where the weekend laptop lives. Digital-only runbooks fail when SSO is down—the same hour you need them most.

Put this into practice

Before the next agent gains weekend send or write permission, run this pre-mortem in thirty minutes with the owner and the on-call. Fix the packet and shutoff gaps first. If you want help designing the rota and containment together—talk to us.

Related work: Spin:Market.