All articles

Support Case Documentation Best Practices

Documentation fails not because people write too little, but because nobody agreed where anything belongs.

Key points

  • Support documentation is three separate systems — ticket-level, account-level, and general knowledge — and most teams collapse them into one, which is why nothing is findable.
  • The test for where something belongs: will this matter again on this ticket, on this account, or on any ticket?
  • Searchability is a writing problem, not a tooling problem. Documents titled by symptom get found; documents titled by cause do not.
  • Knowledge has to be captured while the ticket is open. Nobody writes it up afterwards, and asking them to is not a plan.

The three layers of support documentation

Most support documentation problems are filing problems, not writing problems. People do write things down. They write them in the wrong place, where nobody looks for them later.

There are three distinct layers, and each answers a different question.

LayerAnswersLives inRead by
Ticket What is happening on this case right now? Internal notes on the ticket Whoever touches this ticket next
Account What is always true about this customer? CRM or account record Anyone working any ticket for them
General What is true regardless of customer? Knowledge base Anyone meeting this situation

When these collapse into one another, characteristic failures appear. Account facts buried in ticket notes mean every new agent rediscovers that this customer runs a custom SSO setup. General fixes recorded in ticket notes mean the same solution is derived from scratch four times. And customer-specific incidents written up as knowledge base articles gradually make the knowledge base untrustworthy.

Deciding where a piece of information belongs

One question resolves nearly every case: when will this matter again?

  • Only on this ticket — ticket note. "Tried the workaround at 14:20, no change."
  • On any ticket for this customer — account record. "Runs a custom SAML setup; standard SSO troubleshooting does not apply."
  • On any ticket at all — knowledge base. "Error 5.7.1 on external send after a conditional access change: check the group claim in the assertion."

The account layer is the one most teams lack entirely, and it is the one that produces the most visible customer frustration — because when it is missing, the customer explains their own environment again to every new agent.

Writing things people can actually find later

A document nobody finds is equivalent to a document nobody wrote. Findability is mostly determined at the moment of titling.

Title by symptom, not by cause. The person searching has the symptom. They do not yet know the cause — that is what they are searching for. "Exports time out on ranges over 90 days" gets found. "Statement timeout in report generator" does not, because nobody types that.

Include the exact error text. Error strings are the highest-signal search terms that exist. Paste them verbatim, including codes, even if it looks untidy.

Write the words your team actually uses. If everyone says "the sync" and the documentation says "the bidirectional replication service," the documentation will not be found.

Will not be found

Title: "Resolution for auth subsystem claim mapping discrepancy"

Written from the perspective of someone who already knows the answer. Nobody in a hurry searches these words.

Will be found

Title: "SSO login returns 403 for some users after IdP group sync (error: missing group claim)"

Contains the symptom, the scope qualifier "some users", and the literal error text. It matches what someone types when the problem is in front of them.

The staleness problem

Every knowledge base decays. Products change, workarounds become obsolete, and the article that was correct in March quietly becomes wrong in September.

Decay matters more than gaps. A missing article costs someone twenty minutes of figuring it out. A confidently wrong article costs them twenty minutes plus a failed action plus, eventually, their trust in the whole system. Once staff believe the documentation is unreliable, they stop consulting it and revert to asking whoever has been there longest — which is the exact failure mode documentation was meant to solve.

What works is unglamorous:

  • Every document gets a named owner. Not a team. A person.
  • Every document gets a review date. Overdue means it is flagged as unverified rather than silently trusted.
  • Delete rather than archive. A smaller trusted set beats a large uncertain one.
  • Make correction trivial. If fixing a wrong line requires a review process, it stays wrong.

Capturing knowledge at the moment it exists

The hardest layer to sustain is the ticket layer, because it must be written while the work is happening — and that is precisely when nobody has time.

The common plan is to write it up afterwards. This does not happen. The ticket closes, the queue moves, and the context evaporates within a day. Any documentation strategy that depends on retrospective write-ups is a strategy that produces no documentation.

So the practical question is not how to persuade people to document more. It is how to make capture cost close to nothing at the moment the information exists. That means short mandatory structures rather than long optional ones, templates rather than blank fields, and — increasingly — generating the structured record from the thread automatically so the write-up is not a separate act of will. That last approach is what Brief does, and it is the reason the ticket layer stops being the layer that quietly fails.

Rolling this out without a documentation project

Large documentation initiatives usually fail, because they front-load months of writing before anyone sees a benefit and they compete with a live queue.

A smaller sequence works better:

  1. Fix the account layer first. It is small, high-value, and mostly a matter of moving facts that already exist into a consistent field.
  2. Standardise the ticket layer at transfer points only. Not every note — only handoffs and escalations, where the cost of absence is highest.
  3. Let the knowledge base grow from real tickets. When the same issue appears a third time, promote it. Do not attempt to write the knowledge base in advance; predicted articles are usually the wrong ones.
  4. Prune quarterly. Thirty minutes of deletion buys more trust than thirty minutes of writing.

Frequently asked questions

What should be documented on a support ticket?

The symptom as reported, each diagnostic step with the result it produced, what has been ruled out, the current status, and the next action with an owner. Anything a colleague would need in order to continue the work without speaking to you.

What is the difference between ticket notes and a knowledge base?

Ticket notes record what happened on one specific case and are written for whoever touches that case next. A knowledge base records what is true in general and is written for anyone who meets the same situation later. Confusing the two produces knowledge base articles about one customer's incident and ticket notes that try to be tutorials.

How do you keep support documentation from going stale?

Give every document an owner and a review date, and delete aggressively. A knowledge base that everyone knows is 40% wrong is worse than a smaller one that is trusted, because staff stop checking it at all and revert to asking colleagues.

How much detail is too much in a ticket note?

If the note is longer than the portion of the thread it summarises, it has stopped being documentation. Aim for what the next person needs to act, and leave the rest in the thread where it already lives.

Who should write support documentation?

The person holding the context, at the moment they hold it. Documentation written later by someone reconstructing events is slower to produce and less accurate. This is why capture has to happen during the ticket rather than as a separate later task.

Get the ticket-level layer for free

The hardest layer to sustain is the per-ticket one, because it has to be written while the work is happening. CaseMargin generates the structured brief from the thread, so the documentation exists whether or not anyone had time to write it.

Try the brief builder