Collection
Detect safety drift before the exception becomes normal
Prevent repeated success, temporary exceptions, noisy alerts and operational change from quietly weakening the controls that keep consequential work reliable.
8 elements · Explore in any order.
3 principles · 5 protocols
8 elements
Past success does not make a deviation safe
Nothing bad happened is evidence about the past, not automatic permission for the next run.
Read the idea ProtocolPut an expiry on every temporary exception
Temporary without an end condition is just permanent with optimistic wording.
Read the idea ProtocolReview exception debt as a portfolio
Ten small exceptions can create one large operating mode nobody intentionally designed.
Read the idea ProtocolDo not add an alert without an expected response
An alert with no expected action is usually just a new demand for attention.
Read the idea PrinciplePrune noisy alerts before adding another one
More warnings can make the important warning harder to hear.
Read the idea ProtocolRoute alerts by urgency, not one undifferentiated channel
If everything looks urgent, urgency stops carrying information.
Read the idea ProtocolRun a risk review before a material operational change
A control can be perfectly designed for yesterday's system.
Read the idea PrincipleTreat surprise as evidence that the model is incomplete
Surprise is not automatically danger, but it is evidence that your map of the situation missed something.
Read the idea