When should an alert use an adaptive threshold?

Start from the page that would change an action

Name the condition for which a person should interrupt other work. A rising latency curve may be interesting without being actionable; an error-budget burn or a failed checkout path can justify a page. Specify the owner, expected response, and maximum useful detection delay before selecting a threshold method. The alert is a decision interface, not a classifier accuracy contest.

Seasonality can hide both noise and damage

A learned baseline may account for predictable daily traffic, but it can also absorb a slowly growing fault. A fixed threshold can be transparent yet page repeatedly at every legitimate peak. Compare the rules on identical windows and separate data missingness from healthy low traffic. If a model needs a week of history, say what happens during a new service launch or after a major release.

A Friday promotion distorts the baseline

In a constructed shop scenario, ordinary checkout traffic peaks at 2,000 requests per minute. A promotion doubles volume while the failure ratio rises from 0.2% to 3%. A volume-sensitive latency baseline may treat the increase as expected and stay silent. The operator retains a simple failure-ratio safety rule, then tests whether the adaptive latency rule adds useful warning without repeating the same page.

Record the competing alert policies

Use one decision card for both candidates. It keeps threshold settings beside the operational outcome they are meant to protect.

Field	Fixed candidate	Adaptive candidate
Trigger	Explicit impact ratio and window	Baseline deviation with versioned training window
Cold start	Works immediately	Falls back to named safety rule
Review	Misses and noisy periods	Misses, noisy periods, and drift

Replay the same hard windows

Include confirmed incidents, maintenance, deployment rollouts, quiet hours, and missing telemetry. Count significant events detected, pages without useful action, time to page, and time to clear. A low page count is ambiguous: it may indicate improved precision or suppressed important failures. Record incident labels and disputed cases so a reviewer can inspect the denominator rather than only a dashboard score.

Retire a rule only with an escape path

Keep the fixed safety signal until the adaptive rule has survived representative operating conditions and the team can disable it quickly. A changed traffic mix, instrumentation revision, or missing feature should put the adaptive result into an unknown state. Make the fallback visible to on-call staff and compare behavior after release; a model that stopped paging is not evidence that impact disappeared.

Evidence boundary for adaptive alert thresholds

• Google SRE alerting on SLOs: Google SRE evaluates alert strategies using precision, recall, detection time, and reset time. It does not prescribe an adaptive model for this fictional shop.
• Prometheus alerting practices: Prometheus documents alerting practices and the need for meaningful notification behavior. The page does not validate the invented thresholds or traffic pattern.

The example rates are invented. Local incident labels and pager consequences are required before any threshold can be accepted.