Send an approved reply
The facts match a written rule, and the reply creates no new promise, exception, account change, or money decision.
Customer support decision rights
Decide which support replies can go out and which decisions stay with an owner.
Use this worked matrix to separate approved replies from reviewed drafts, urgent escalations, and owner-only actions. Replace every fictional target, owner, and review date before live use.
This is a planning example, not legal, safety, security, financial, or compliance advice. Your policies, contracts, incident plan, emergency procedures, and qualified advisers take priority.
Worked cases7
Shipping, returns, billing, access, threats, safety, and legal notices.
Action lanes4
Send, draft, escalate now, or hold for an owner.
Evidence ruleKeep context
Give the owner enough facts to decide without rebuilding the case.
Four action lanes
Know whether to send, draft, escalate, or hold.
Decision rights mean who may take an action without another approval. When a case fits two lanes, use the more restrictive lane until an owner records a different rule.
Draft for review
The assistant can gather facts and prepare the wording, but a named reviewer approves or sends it.
Escalate now
The case may involve active harm, compromise, threats, safety, or a time-sensitive legal issue. Move it out of the routine queue.
Owner-only action
The assistant records and routes the request. A qualified owner decides refunds, credits, account changes, legal responses, safety remedies, or policy exceptions.
Worked example
Name the held action and the person who must decide.
The targets below are fictional internal acknowledgement examples, not promised resolution times or universal service levels. Replace them with your coverage, contracts, policies, and incident plan. The table scrolls sideways on small screens.
| Scenario and trigger | Allowed action | Held action | Example target | Evidence | Decision owner | Review |
|---|---|---|---|---|---|---|
| Shipping delay Carrier data confirms a delay, or the order and carrier records disagree. | Check both records. Send an approved factual update only when they agree; otherwise draft and route the reply. | Delivery promises, lost-parcel decisions, compensation, reships, and refunds. | Example: acknowledge a confirmed delay within 4 business hours; route conflicting records within 30 minutes during coverage. | Ticket and order ID, carrier history, timestamps checked, customer statement, reply or draft, and the held action. | Fulfillment or ecommerce support lead; named operations backup. | 30 days after launch, then monthly while this lane is active. |
| Return request A customer asks to return, exchange, or replace an item. | Collect the order, item, date, reason, required photos, and matching policy section. Send standard instructions only when the written rule clearly applies. | Eligibility exceptions, fee waivers, refunds, replacements, inventory promises, and policy exceptions. | Example: acknowledge within 4 business hours; route exceptions or damaged high-value items within 1 business hour. | Order and item details, dates, reason code, photos or statement, policy section, and the held decision. | Ecommerce operations or returns owner; finance owner for money decisions. | 30 days after launch and after any return-policy change. |
| Billing question A customer questions an invoice, subscription charge, duplicate charge, fee, or payment status. | Verify the visible billing record, collect the invoice or transaction reference, and draft an explanation from approved wording. | Refunds, credits, price or payment-term changes, tax treatment, payment-method changes, and reversal promises. | Example: acknowledge an ordinary question within 2 business hours; route suspected fraud or duplicate charges within 30 minutes during coverage. | Ticket ID, invoice or transaction reference, amount and date, billing status, approved source, customer statement, and draft. | Billing or finance operations owner; security route when fraud is suspected. | Monthly and after any pricing, billing, or refund-rule change. |
| Account access A customer reports a lockout, reset problem, unexpected login, MFA issue, or permission request. | Send approved public reset guidance and collect only the identity-check fields required by the written process. | Changes to identity fields, email, MFA, roles, permissions, recovery data, or account ownership. | Example: acknowledge routine reset guidance within 1 business hour; report suspected compromise immediately. | Ticket and account ID, timestamps, approved checks, error message, relevant device details, and actions already taken. Never collect passwords or recovery codes. | System owner for routine access; security or incident lead for suspected compromise. | Before launch, after authentication changes, and monthly during the first quarter. |
| Threat or coercion A message includes a threat of violence, self-harm, extortion, targeted harm, or another threat named in the incident plan. | Preserve the message and ticket context, apply the urgent tag, and notify the incident route. Use approved acknowledgement wording only if the plan permits it. | Credibility judgments, independent investigation, concessions, outcome promises, deletion, and routine-queue handling. | Report immediately. Example internal acknowledgement target: 15 minutes during coverage through the company’s urgent route. | The exact message in the approved system, sender or account, ticket ID, timestamp, channel, related messages, actions taken, and notification record. | Named incident or security lead; executive or on-call backup under the incident plan. | Quarterly and after a real incident or drill. |
| Safety issue A customer reports injury, illness, unsafe product behavior, a hazardous condition, or possible ongoing harm. | Preserve the report, gather only the facts required by the safety intake process, and escalate. Send approved receipt wording only if permitted. | Diagnosis, safety or medical advice, admissions, compensation, recalls, edits to the customer’s account, and public responses. | Report immediately. Example owner acknowledgement target: 15 minutes during coverage; follow the written after-hours route when closed. | The customer’s account, product or service details, date and location, supplied photos, ticket history, actions taken, and notification record. | Product safety, clinical, risk, or qualified operations owner named by the business. | Before launch, quarterly, and after a safety case or process change. |
| Legal notice A message claims to be a demand letter, subpoena, regulator contact, preservation request, court document, or formal notice. | Preserve the message and delivery metadata, apply the legal tag, and use the named legal-notice route. Acknowledge only with approved wording. | Interpretation, answers to claims, admissions, service decisions, deadline promises, record changes, and deletion. | Route immediately. Example legal-owner acknowledgement target: within 1 business hour or sooner when the notice states a deadline. | The original message or document in the approved system, sender, recipient, channel, timestamp, attachments, stated deadline, ticket ID, and notification record. | Legal counsel or qualified business owner; named executive backup. | Quarterly and whenever counsel changes the intake or preservation process. |
Escalation note
Give the owner enough evidence to decide.
Keep secrets and unnecessary personal data out of open chat. Passwords, recovery codes, full payment data, and medical details do not make an escalation more complete.
- What the customer said, separated from verified facts.
- The ticket, account, order, invoice, or transaction ID.
- Which records and approved rules were checked.
- What reply, if any, was sent.
- The action being held and the exact decision needed.
- Who was notified, through which channel, and when.
- Where the final decision will be recorded.
Blank matrix
Replace every example with a real owner, route, and date.
Copy the block into the support handoff. Separate the customer acknowledgement target from the internal escalation target so a fast reply does not hide a slow decision.
CUSTOMER SUPPORT DECISION-RIGHTS MATRIX Matrix owner: [Name and role] Covered queue or channel: [Queue, inbox, chat, or team] Coverage hours and timezone: [Hours and timezone] Urgent contact route: [Channel or phone route] Decision record: [Ticket field, log, or document] Last tested: [YYYY-MM-DD] Next full review: [YYYY-MM-DD] SCENARIO: [Plain name] Visible trigger: [What the support worker can see] Action lane: [Send / Draft for review / Escalate now / Owner-only] Allowed action: [What may happen without further approval] Held action: [What must not happen] Customer acknowledgement target: [Time and coverage rule] Internal escalation target: [Time and coverage rule] Evidence to keep: [Required records and fields] Escalation owner and channel: [Name or role and route] Backup and after-hours route: [Name or route] Decision recorded in: [System and field] Row review date: [YYYY-MM-DD] Review trigger: [Policy, tool, incident, or scope change] Repeat the scenario block for each ticket type.
The template stays visible and selectable if clipboard access is blocked.
20-minute rollout
Test the route before the next live exception.
A rule is useful only when the queue labels, owner route, and decision record match it. Run one ordinary case and one drill before expanding support authority.
- Replace the fictional rows with the queue’s real ticket categories.
- Mark each row Send, Draft for review, Escalate now, or Owner-only.
- Name a primary owner, backup, channel, coverage window, and decision record.
- Add the same triggers to ticket tags, SOPs, and approved replies.
- Run one routine shipping case and one fictional urgent case.
- Review the first week of tickets, then set a real next-review date.
Source notes
Use a written incident path and named owners.
These sources support role clarity, incident reporting, evidence preservation, and account care. They do not set the fictional response targets above or certify this matrix.
- CISA, Incident Response Plan Basics covers named roles, communication paths, and contact lists.
- NIST SP 800-61 Rev. 3 covers preparation, incident records, communication, and response work.
- FTC, Data Breach Response: A Guide for Business covers securing operations, preserving evidence, and assigning response owners.
Before the queue goes live
Put the decision-rights matrix beside the support SOP.
If the support worker cannot tell whether to send, draft, escalate, or hold, fix the rule and owner route before adding live chat, refunds, account changes, or urgent cases.
Build your handoff system
Ready to plan your first offshore role?
Use OutsourcedU to write the role, SOPs, onboarding steps, and weekly review before you hire more people.