Zahlen Operator Manual

3.4 — Action Queue Documentation

Task states, operational actions, escalation semantics, routing behaviors, and intervention guidance

Page Overview

The Action Queue is the operator-facing work surface for issuer-health signals that require review, investigation, replay validation, or operational follow-up. In the src-0527A architecture, the page is served by the issuer processor action queue route and is rendered as the Issuer Processor Action Queue. The source code describes this page as a prioritized operator queue derived from issuer health alert signals.

The Action Queue is not a passive report. It is the operational handoff layer between automated issuer-health detection and human decision-making. It converts issuer-health events into structured rows that operators can search, open, investigate, replay, and eventually resolve.

In the implementation, IssuerProcessorActionQueueService builds the queue from issuer-health events and enriches each row with severity, priority, issuer identity, metric context, recommended action, routing reason, task state, resolution state, and drill-down links. This design keeps the queue deterministic, low-dependency, and useful even before deeper incident or task repositories are fully wired into every workflow.

Operator principle

Use the Action Queue when Zahlen has already identified issuer-related work and the operator needs to decide what to review first, what to investigate, what evidence to validate, and whether the item should remain open, escalate, or move toward resolution.

Where the Action Queue Fits in the Operator Workflow

The Action Queue appears after issuer-health alert generation and before final operational resolution. It is the practical workspace where detection becomes work. The page uses a visible workflow strip that guides operators through the normal action path.

Review

Investigate

Timeline

Replay

Resolve

Review means the operator reads the queue row and determines why the system elevated the signal. Investigate means the operator opens the issuer-health investigation page for the affected issuer cohort. Timeline means the operator reviews when the behavior appeared and whether it persisted. Replay means the operator validates whether the evidence remains reproducible and deterministic. Resolve means the operator closes, continues monitoring, escalates, or assigns further work based on the evidence.

Task States

Task state describes the operational lifecycle of a queue item. In the current service contract, the action queue can display states such as open, claimed, in_progress, resolved, cancelled, and monitoring. These states are used not only for presentation but also for deterministic ordering. The service sorts work using severity rank, action priority score, task-status priority, creation time, and event identity so that the queue behaves consistently across refreshes and replay-like review conditions.

Term	Definition in Zahlen	Operator interpretation
Open	Open means the work item has not yet reached a completed state and still requires operator attention. Critical and warning signals default to open because they represent unresolved operational risk.	Treat open items as active work. If the item is also high priority or unassigned, it should be reviewed before lower-risk monitoring items.
Claimed	Claimed means an operator or workflow has taken responsibility for the item, but the work is not necessarily finished. This state creates ownership visibility without implying resolution.	Use claimed to distinguish assigned work from unowned work. A claimed item should have a clear owner and a next investigative step.
In Progress	In progress means the item is actively being investigated or processed. This state indicates that an operator has moved beyond acknowledgment into active review.	Check whether the investigation, timeline, or replay evidence supports continuing the action, escalating it, or resolving it.
Resolved	Resolved means the operational issue represented by the queue item has been closed or judged no longer active. A resolved item should have enough supporting evidence to explain why closure was appropriate.	Use resolved only when the issuer behavior has recovered, the signal has been explained, or the operational risk has been addressed.
Cancelled	Cancelled means the work item was intentionally removed from the active workflow without being treated as a successful resolution. Cancellation is different from recovery because it usually reflects workflow correction rather than issuer improvement.	Use cancellation carefully. Operators should preserve the reason so future reviewers can distinguish cancelled noise from resolved operational risk.
Monitoring	Monitoring means the signal is not currently urgent enough to require active intervention, but it remains visible for continued observation. Informational signals commonly map to monitoring behavior.	Use monitoring when the signal is meaningful but not yet severe. Watch for repeated recurrence, rising severity, or movement into warning or critical status.

Operational Actions

Operational actions are the steps an operator can take from a queue row. In the rendered Action Queue, each item includes pill-style links such as Investigate Now, Investigation, Timeline, and Replay. These links are not decorative. They represent the core evidence path operators follow before making a decision.

Term	Definition in Zahlen	Operator interpretation
Investigate Now	Investigate Now is the primary action. It opens the issuer-health investigation view for the affected issuer BIN, country, card brand, and evidence window.	Use Investigate Now when the row is open, high priority, critical, warning, repeated, or operationally unclear.
Investigation	Investigation opens the detailed diagnostic view for the issuer cohort. This surface helps explain the metric, affected issuer identity, recommendation, and supporting context.	Use Investigation to understand why the system generated the queue item and what evidence supports it.
Timeline	Timeline opens the chronological history of the issuer-health behavior for the selected cohort and time window.	Use Timeline to determine whether the problem is new, persistent, worsening, or recovering.
Replay	Replay opens the replay-validation path for the same issuer cohort and window. Replay is used to check whether evidence and conclusions remain deterministic.	Use Replay when the item may require auditability, governance confidence, or escalation support.
Search	Search filters the visible queue rows by issuer, metric, status, owner, severity, or other row text. It helps operators narrow a large queue into relevant work.	Use Search to find a specific issuer BIN, response code, metric name, unassigned owner, or unresolved task state.

Escalation Semantics

Escalation semantics define when a queue item should move from ordinary monitoring or triage into stronger operational attention. The action queue itself assigns queue name, priority, task status, and resolution status, while the broader escalation service evaluates aging work, repeated signals, critical severity, external attribution, fraud-related metrics, and unowned items.

In src-0527A, critical severity routes toward issuer-escalations and receives critical priority. Warning severity routes toward issuer-triage and receives high priority. Informational items remain in issuer-monitoring and usually remain in monitoring or observing states. Fraud-pressure metrics can route toward issuer-risk because fraud posture changes may require a specialized operational response.

Term	Definition in Zahlen	Operator interpretation
Severity	Severity expresses the seriousness of the issuer-health signal. The current priority model recognizes critical, warning, and info levels.	Critical items should be escalated immediately. Warning items should be triaged promptly. Informational items should be monitored for recurrence or worsening.
Priority	Priority expresses the urgency of operational handling. The queue maps critical severity to critical priority, warning severity to high priority, and informational severity to normal priority.	Use priority to decide what to work first when many queue items are visible.
Action Priority Score	Action priority score is a numeric ordering signal derived from severity and, when available, metric delta. In the service, severity supplies the base weight while delta magnitude can increase the score.	Use the score as a consistent sorting aid. Higher scores usually deserve earlier review, especially when they are unresolved or unassigned.
Escalation Level	Escalation level describes how strongly the system believes work should be raised for supervisory or specialized review. Levels include none, low, medium, and high in the escalation service.	Medium escalation usually means aging, repeated, or unowned work. High escalation usually means critical, stale, fraud-related, external, or unresolved open work.
Aging Item	An aging item is work that has remained active beyond the review threshold. In the escalation service, the default review threshold is sixty minutes.	Review aging items to prevent important issuer behavior from sitting unassigned or unresolved.
Stale Item	A stale item is work that has remained active beyond the stale threshold. In the escalation service, the default stale threshold is one hundred eighty minutes.	Treat stale items as supervisory concerns, especially when they are open, critical, repeated, or unowned.
Unowned Item	An unowned item is work with no assigned owner. The routing service intentionally defaults to blank ownership so work enters the correct queue without accidental hard assignment.	Assign an owner before deep operational work continues. Ownership is a control against silent backlog growth.

Routing Behaviors

Routing behavior determines where issuer-related work should go. In the source architecture, IssuerOperationalRoutingService is intentionally pure decision logic. This means it resolves queue, priority, owner, and routing reason without mutating incidents or tasks. This design helps preserve deterministic behavior and allows routing decisions to be reused by alert-to-incident bridges, queue enrichment, escalation workflows, and supervisor dashboards.

The routing model uses severity, metric name, attribution type, issuer identity, issuer country, and card brand to determine the operational destination. Critical severity and outage-like attribution route toward issuer-escalations. Fraud-pressure metrics route toward issuer-risk. Core issuer health metrics such as auth success rate, retry recovery rate, decline entropy, and issuer response stability route toward issuer-triage. Warning severity also routes to issuer-triage by default.

Term	Definition in Zahlen	Operator interpretation
Issuer Escalations	Issuer escalations is the queue for high-urgency issuer work, including critical severity, issuer outage, network outage, and external issuer incident attribution.	Use this queue when the issuer signal may require immediate supervisory attention or external operational coordination.
Issuer Risk	Issuer risk is the queue for work associated with fraud-pressure metrics or defensive authorization posture. Fraud-related routing recognizes that issuer risk behavior may suppress legitimate recovery.	Use this queue when fraud pressure, fraud score, or fraud-pressure index appears to influence recovery or authorization stability.
Issuer Triage	Issuer triage is the primary queue for warning-level issuer health signals and core health metrics such as authorization success rate, retry recovery rate, decline entropy, and issuer response stability.	Use this queue for structured review, investigation, timeline analysis, and replay validation.
Issuer Monitoring	Issuer monitoring is the safe default queue for lower-urgency or informational issuer signals. It preserves visibility without forcing unnecessary escalation.	Use this queue for signals that are meaningful but not yet urgent, severe, repeated, or operationally confirmed.
Routing Reason	Routing reason is the explanation string that records why the item entered a particular queue. It may include severity, metric, attribution type, issuer BIN, country, and brand.	Read the routing reason before acting. It explains whether the item is in the queue because of severity, metric type, issuer identity, or attribution context.

Intervention Guidance

Intervention guidance describes what the operator should do after reviewing the queue row and supporting evidence. In the current queue service, recommended actions are deterministic and severity-aware. Critical items instruct immediate escalation and investigation. Warning items instruct review and triage. Informational items instruct monitoring.

An intervention should not be treated as an automatic system action. In the current Zahlen philosophy, the queue supports operator decisioning rather than uncontrolled autonomous remediation. The operator should first verify the signal, review the timeline, validate replay evidence when needed, and then decide whether to escalate, monitor, assign, resolve, or gather more evidence.

Workflow stage	Meaning	Evidence to inspect	Recommended operator action
Review	The operator reads severity, metric name, summary, issuer identity, priority score, task status, and routing reason.	Severity, queue, priority, issuer BIN, country, card brand, metric, summary, task status.	Confirm why the item exists and decide whether it requires immediate investigation or continued monitoring.
Investigate	The operator opens the investigation view for the issuer cohort and time window.	Investigation summary, metric shift, baseline/current values, recommended action, related evidence.	Determine whether the behavior is isolated, repeated, severe, or operationally meaningful.
Timeline	The operator reviews the sequence of issuer behavior over time.	Event timing, persistence, recurrence, recovery, degradation trajectory.	Decide whether the issue is new, persistent, worsening, or recovering.
Replay	The operator validates whether the evidence and conclusions remain reproducible under deterministic replay.	Replay output, replay consistency, divergence signals, evidence lineage.	Use replay before escalation, audit review, or governance-sensitive closure.
Resolve	The operator updates the operational state based on evidence.	Resolution status, task state, owner, last action, last action type.	Resolve only when the evidence supports recovery, closure, or continued non-urgent monitoring.

How Operators Should Read a Queue Row

A queue row should be read from left to right as an operational story. Created At explains when the signal entered the queue. Severity explains urgency. Queue explains destination. Priority and priority score explain ordering. Owner and assigned operator explain accountability. Issuer BIN, country, and brand identify the affected cohort. Metric explains what behavior changed. Summary explains the observed condition. Routing reason explains why the item belongs in its queue. Task status and resolution status explain whether work is still active. Actions provide the evidence path.

Term	Definition in Zahlen	Operator interpretation
Issuer BIN	Issuer BIN identifies the issuing bank cohort associated with the signal. Zahlen uses this as a core issuer identity anchor.	Search or group by BIN when repeated signals appear across metrics or windows.
Country	Country identifies the geographic issuer context. Country-level visibility helps distinguish localized degradation from broader issuer or network behavior.	Compare issuer behavior across countries when degradation appears regional rather than global.
Brand	Brand identifies the card network context, such as Visa or Mastercard. Brand context helps separate issuer behavior from network-specific behavior.	Use brand context when similar issuers behave differently across networks.
Metric	Metric names the behavioral signal that triggered the queue item, such as response-code recovery rate, retry recovery rate, decline entropy, or issuer response stability.	Use the metric to understand what operational behavior changed and which evidence view to inspect next.
Summary	Summary provides the human-readable description of what Zahlen observed, including recovery counts, confidence language, telemetry context, and truth-linkage context when available.	Read the summary carefully before opening evidence links. It often explains why the system elevated the item.
Resolution Status	Resolution status describes whether the work is unresolved, observing, or resolved. Warning and critical items default to unresolved because they represent active operational concerns.	Do not ignore unresolved items. They require review, ownership, or evidence-based closure.

Recommended Operator Practice

Operators should begin each Action Queue session by reviewing the status banner and summary cards. Queue Items shows workload volume. Issuers shows how many issuer cohorts are affected. Critical, Warning, and Info separate severity distribution. Latest identifies the most recent queue activity. Severity Filter and Issuer BIN Filter show whether the current page is narrowed to a specific operational view.

After reviewing the summary cards, operators should use search to narrow the queue by issuer BIN, metric, status, owner, or severity. They should prioritize open, unresolved, high-priority, unowned, critical, warning, repeated, or aging items. They should use Investigate Now to understand the row, Timeline to determine persistence, Replay to validate deterministic evidence, and Resolution Status to track operational closure.

Recommended first response to a high-priority warning

Open Investigate Now, review the issuer cohort and metric context, check Timeline for persistence, use Replay if the decision may require audit or escalation support, assign ownership if the row is unowned, and keep the item unresolved until evidence supports closure or monitoring.

Summary

The Action Queue is the operational workbench for issuer-health signals. It transforms automated detection into human-operable work by combining deterministic ordering, task states, routing behavior, escalation semantics, and direct evidence links.

For operators, the Action Queue answers three questions. What requires attention? Why was it routed here? What evidence should be reviewed before taking action?

For supervisors, the Action Queue provides operational accountability. It exposes unowned work, aging items, unresolved signals, queue pressure, and escalation candidates. For the broader Zahlen architecture, it preserves the principle that issuer intelligence should be explainable, replay-safe, and operator-visible before it becomes automated.