Why are incidents being escalated, even though they no longer meet the criteria for escalation?
When setting up escalation rules, you must determine whether to enable the Revalidate checkbox. In general, when configuring escalation rules, you will enable the Revalidate box so that records are revalidated to still match the condition at the time of escalation.
When escalating a record, there are two rules in effect: the "chain" rule that specifies the criteria for escalation and determines the time frame for setting the escalation level and another rule that includes the escalation actions that acts on the record that is set to the escalation level.
Within the chain rule, in the THEN section, one of the actions to include is Escalate. When you add the Escalate action, several fields become available to be set, including the Revalidate check box.
When the Revalidate check box is enabled: the escalation conditions are checked again at the time of escalation to determine if the record still meets the criteria to be escalated. If the record has been edited so that the escalation criteria are no longer met, the record will not be escalated, even though it initially met the original criteria.
For example, if the escalation criteria indicates that an incident must be in an unresolved status and assigned to a specific group in order for it to be escalated, if you check the Revalidate box, the incident will have to be in an unresolved status and still assigned to the specific group at the time it is escalated in order for the escalation rule to take effect.
If the incident is assigned to another group or is assigned to a solved or waiting status, it will no longer meet the escalation criteria and will not be escalated. If the revalidate check box were not enabled, then the incident would end up escalated, regardless of status and which group it was later assigned to.