Alerts should fire at or near the threshold where an SLO breach would occur, not well before. Premature alerts create noise, erode trust in the alerting system, and burn out on-call engineers with false urgency. When alerts fire for conditions that don’t correspond to real severity criteria, the on-call workflow degrades: engineers distrust pages, investigate phantom issues, and escalate reflexively rather than with judgment.
The rule: if an alert wakes someone at 4 AM, there should be a clear SEV, an SLO breach, or measurable user impact. If none exist, the threshold needs recalibration.