Protocol
Use a forcing function for the irreversible step
A warning asks you to be careful. A forcing function changes what is possible.
When it fits
- One accidental action can create high-impact irreversible or difficult-to-recover effects.
When to avoid it
- A bad forcing function can block urgent legitimate work and drive unsafe workarounds; use it narrowly.
Why it matters
Identify the narrow action whose accidental execution would be unacceptable, then require a prerequisite state or block invalid execution by design. Keep the constraint close to the harmful action. Provide an authorized override only when real exceptional cases justify it and make the override visible.
Steps
- The prevented action has genuinely high error cost.
- The prerequisite is objectively checkable.
- The control blocks the wrong state before execution.
- Legitimate exceptions have an explicit governed path.
- Workarounds are monitored rather than silently normalized.
An example
A destructive production job refuses to start until a verified environment identifier and approved change ID are present.
Check your result
A routine slip cannot directly perform the high-impact action in the invalid state.
Keep this limit in mind
- A bad forcing function can block urgent legitimate work and drive unsafe workarounds; use it narrowly.
Evidence and sources
Supports
A forcing function prevents an unintended action or requires another specific action before it can occur.
Forcing functions should be reserved for conditions where blocking the action is actually safer than allowing expert override.
Forcing Function · Definition