A system that requires a human to read an email and decide whether action is needed is fundamentally flawed. Software should do the interpreting; humans should be notified only when they need to take action. ## Three Valid Outputs | Type | Definition | Human Action | |------|-----------|--------------| | **Alerts** | Something is happening or about to happen that needs immediate action | Act now | | **Tickets** | System can't auto-handle, but no damage if human acts in a few days | Act soon | | **Logging** | Recorded for diagnostic/forensic purposes | None unless prompted | ## Key Principle Monitoring should **never** require a human to interpret any part of the alerting domain. The classic "email alert when value exceeded" pattern is explicitly called out as ineffective. ## Logging Expectation No one reads logs unless something else prompts them to do so. Logs exist for after-the-fact investigation, not proactive monitoring. ## Cross-Domain Connections - [[Error Budget Model]] — monitoring detects budget consumption - [[SRE Playbook MTTR Improvement]] — what happens after an alert fires - [[True Observability Prerequisites]] — modern evolution of this framework --- *Source: Site Reliability Engineering, Chapter 1 (Treynor Sloss, 2016)* *Extracted: 2026-03-25*