Alerts are a product, not a threshold

Start with the grain contract

Before comparing a metric with history, define its grain: date, geography, product, source and processing run. If the current number is city-level while the baseline mixes cities or partial runs, the threshold is evaluating a different question.

Freshness applies to every dependency, not only the final table. An internally consistent number built from one current and one stale input is still wrong for the decision.

This is a public-safe account of the work. Internal identifiers, proprietary thresholds, prompts, infrastructure details and operational commands are intentionally omitted.

Eligibility before anomaly

I prefer an eligibility layer before the score: source readiness, expected coverage, valid geography, sufficient history and a successful owning run. Ineligible rows should appear as data-quality failures, not business anomalies.

Weekday-adjusted history is usually more honest for weekly businesses than a flat trailing average. Volume gates prevent one event in a tiny cohort from wearing the same severity as a market-wide shift.

eligible = sources_ready & grain_valid & history_sufficient
signal = eligible & unusual(metric, comparable_history)

Four questions, in order

A useful alert workflow moves from diagnostic to descriptive to prescriptive to predictive. First verify the data and localise the funnel. Then describe the size and persistence of the movement. Only then suggest an action or forecast what may happen next.

Jumping directly from ‘GBV fell’ to ‘pricing caused it’ ignores traffic, supply, discounts, utilisation, refunds and changing mix. The alert should accelerate investigation without pretending to have completed it.

Design the silence

Every published signal should answer what changed, why it is unusual, how much it matters and what was excluded. State transitions should use only successful history. All-clear, no-data and failed-run are different states and must not collapse into an empty inbox.

The quality of an alert system is not the number of red rows it can produce. It is the fraction of messages that a receiver understands, trusts and can act on—and the confidence that silence has a documented meaning.