Zero-Tolerance for Failure
When to Use
- Establish failure-prevention culture and operating norms for mission-critical systems
- Apply HRO principles (preoccupation with failure, reluctance to simplify, sensitivity to operations, commitment to resilience, deference to expertise)
- Design defense-in-depth, fail-safe, and fail-closed controls for software, infra, and OT
- Define verification gates, independent checks, and release hold criteria
- Architect redundancy, isolation, and graceful degradation with explicit failure modes
- Facilitate pre-mortems, FMEA, and risk registers before high-stakes change
- Author stop-the-line policy and escalation when quality or safety signals are ambiguous
- Select and track prevention metrics (defect escape, near-miss, repeat incidents, gate bypass)
- Coach leadership behaviors that counter normalization of deviance and blame theater
- Brief engineering and ops on zero-defect aspiration vs error budgets for the right domain
When NOT to Use
- Own SLI/SLO definitions, error-budget policy, and burn-rate alerting →
site-reliability-engineer
- Run live incident war room, SEV classification, and status communications →
incident-management-engineer
- Design backup/immutability, RTO/RPO recovery, and ransomware restore architecture →
cyber-resilience-engineer
- Enforce CI compile/lint/test gates without broader prevention program →
build-validator
- Facilitate sprint ceremonies, backlog grooming, or team agile transformation → agile coaching skills
- Issue HR warnings, performance plans, or legal disciplinary guidance → escalate to HR/legal
- Own classified ATO/accreditation packages without operational excellence deliverables →
classified-cyber-security-senior-manager (pair for cleared context)
- Produce ADRs and integration patterns without failure-prevention lens →
senior-system-architecture (pair for architecture)
Related skills
| Need |
Skill |
| SLOs, error budgets, reliability toil, capacity |
site-reliability-engineer |
| Incident program, SEV, on-call, postmortems |
incident-management-engineer |
| Recovery tiers, backup/immutability, resilience tests |
cyber-resilience-engineer |
| Build/CI quality gates and merge validation |
build-validator |
| Cleared program governance, inspection, escalation |
classified-cyber-security-senior-manager |
| NFRs, architecture review, ADRs |
senior-system-architecture |
| Enterprise BCM/DR program and tabletops |
bcm-disaster-recovery-specialist |
| Active CSIRT containment and forensics |
incident-responder |
Core Workflows
1. Scope, limits, and charter
Clarify what “zero tolerance” means in context—aspiration, gates, and metrics—without perfectionism traps.
See references/zero_tolerance_scope_and_limits.md.
2. HRO principles and operating mindset
Embed high-reliability organization behaviors in teams that face rare, catastrophic failure.
See references/high_reliability_organization_principles.md.
3. Prevention, verification, and gates
Layer independent checks, hold points, and evidence before irreversible change.
See references/prevention_verification_and_gates.md.
4. Redundancy, degradation, and fail-safe design
Specify failure modes, safe defaults, and degraded operation—not only happy path.
See references/redundancy_degradation_and_fail_safe.md.
5. Pre-mortem, FMEA, and risk registers
Surface latent failures before launch; maintain living risk and mitigation traceability.
See references/pre_mortem_fmea_and_risk_registers.md.
6. Leadership, culture, and metrics
Measure prevention; reinforce stop-the-line; reduce normalization of deviance.
See references/leadership_culture_and_metrics.md.
Outputs
- Failure-prevention charter — scope, principles, RACI, interfaces with SRE/IR/QA
- Gate catalog — hold points, owners, evidence required, bypass rules and audit trail
- Design review pack — fail-safe/fail-closed decisions, degradation modes, verification plan
- FMEA / pre-mortem record — failure modes, causes, controls, residual risk, owners
- Stop-the-line policy — triggers, authority, duration, comms, and restart criteria
- Metrics dashboard brief — defect escape, near-miss, repeat incidents, gate effectiveness
- Leadership playbook — behaviors, rituals, and anti-patterns (learning vs blame)
Principles
- Prevent over punish — optimize systems and norms; avoid blame theater and hidden workarounds
- Fail closed by default — ambiguous safety or auth states deny; document explicit fail-open exceptions
- Independent verification — separation between build, check, and approve for high-criticality change
- Deference to expertise — elevate domain experts at the boundary; leaders ask, not override silently
- Measure escapes and near-misses — lagging severity alone rewards luck; track what almost failed
- Stop-the-line is a gift — halting bad change is success; normalize escalation without career penalty
- Pair with peers — reliability math (SRE), incidents (IR program), recovery (resilience), builds (CI)
1---2name: zero-tolerance-for-failure3description: Guides failure-prevention culture and operational excellence for mission-critical engineering— zero-defect aspiration vs error budgets; HRO principles; defense-in-depth; fail-safe/fail-closed; verification gates and independent checks; redundancy and graceful degradation; pre-mortems and FMEA; stop-the-line; defect escape, near-miss, and repeat-incident metrics; leadership against normalization of deviance—not blame culture. Use for failure-prevention programs, HRO practices, verification gates, fail-safe design, pre-mortem/FMEA, stop-the-line, near-miss reporting, or defect-escape metrics—not SRE error budgets only (site-reliability-engineer), incident command only (incident-management-engineer), backup/restore only (cyber-resilience-engineer), CI lint only (build-validator), agile coaching, HR discipline, or classified ATO without ops-excellence lens (classified-cyber-security-senior-manager).4---56# Zero-Tolerance for Failure78## When to Use910- Establish **failure-prevention culture** and operating norms for mission-critical systems11- Apply **HRO principles** (preoccupation with failure, reluctance to simplify, sensitivity to operations, commitment to resilience, deference to expertise)12- Design **defense-in-depth**, **fail-safe**, and **fail-closed** controls for software, infra, and OT13- Define **verification gates**, independent checks, and release hold criteria14- Architect **redundancy**, isolation, and **graceful degradation** with explicit failure modes15- Facilitate **pre-mortems**, **FMEA**, and risk registers before high-stakes change16- Author **stop-the-line** policy and escalation when quality or safety signals are ambiguous17- Select and track **prevention metrics** (defect escape, near-miss, repeat incidents, gate bypass)18- Coach **leadership behaviors** that counter normalization of deviance and blame theater19- Brief engineering and ops on **zero-defect aspiration vs error budgets** for the right domain2021## When NOT to Use2223- Own SLI/SLO definitions, error-budget policy, and burn-rate alerting → `site-reliability-engineer`24- Run live incident war room, SEV classification, and status communications → `incident-management-engineer`25- Design backup/immutability, RTO/RPO recovery, and ransomware restore architecture → `cyber-resilience-engineer`26- Enforce CI compile/lint/test gates without broader prevention program → `build-validator`27- Facilitate sprint ceremonies, backlog grooming, or team agile transformation → agile coaching skills28- Issue HR warnings, performance plans, or legal disciplinary guidance → escalate to HR/legal29- Own classified ATO/accreditation packages without operational excellence deliverables → `classified-cyber-security-senior-manager` (pair for cleared context)30- Produce ADRs and integration patterns without failure-prevention lens → `senior-system-architecture` (pair for architecture)3132## Related skills3334| Need | Skill |35|---|---|36| SLOs, error budgets, reliability toil, capacity | `site-reliability-engineer` |37| Incident program, SEV, on-call, postmortems | `incident-management-engineer` |38| Recovery tiers, backup/immutability, resilience tests | `cyber-resilience-engineer` |39| Build/CI quality gates and merge validation | `build-validator` |40| Cleared program governance, inspection, escalation | `classified-cyber-security-senior-manager` |41| NFRs, architecture review, ADRs | `senior-system-architecture` |42| Enterprise BCM/DR program and tabletops | `bcm-disaster-recovery-specialist` |43| Active CSIRT containment and forensics | `incident-responder` |4445## Core Workflows4647### 1. Scope, limits, and charter4849Clarify what “zero tolerance” means in context—aspiration, gates, and metrics—without perfectionism traps.5051**See `references/zero_tolerance_scope_and_limits.md`.**5253### 2. HRO principles and operating mindset5455Embed high-reliability organization behaviors in teams that face rare, catastrophic failure.5657**See `references/high_reliability_organization_principles.md`.**5859### 3. Prevention, verification, and gates6061Layer independent checks, hold points, and evidence before irreversible change.6263**See `references/prevention_verification_and_gates.md`.**6465### 4. Redundancy, degradation, and fail-safe design6667Specify failure modes, safe defaults, and degraded operation—not only happy path.6869**See `references/redundancy_degradation_and_fail_safe.md`.**7071### 5. Pre-mortem, FMEA, and risk registers7273Surface latent failures before launch; maintain living risk and mitigation traceability.7475**See `references/pre_mortem_fmea_and_risk_registers.md`.**7677### 6. Leadership, culture, and metrics7879Measure prevention; reinforce stop-the-line; reduce normalization of deviance.8081**See `references/leadership_culture_and_metrics.md`.**8283## Outputs8485- **Failure-prevention charter** — scope, principles, RACI, interfaces with SRE/IR/QA86- **Gate catalog** — hold points, owners, evidence required, bypass rules and audit trail87- **Design review pack** — fail-safe/fail-closed decisions, degradation modes, verification plan88- **FMEA / pre-mortem record** — failure modes, causes, controls, residual risk, owners89- **Stop-the-line policy** — triggers, authority, duration, comms, and restart criteria90- **Metrics dashboard brief** — defect escape, near-miss, repeat incidents, gate effectiveness91- **Leadership playbook** — behaviors, rituals, and anti-patterns (learning vs blame)9293## Principles9495- **Prevent over punish** — optimize systems and norms; avoid blame theater and hidden workarounds96- **Fail closed by default** — ambiguous safety or auth states deny; document explicit fail-open exceptions97- **Independent verification** — separation between build, check, and approve for high-criticality change98- **Deference to expertise** — elevate domain experts at the boundary; leaders ask, not override silently99- **Measure escapes and near-misses** — lagging severity alone rewards luck; track what almost failed100- **Stop-the-line is a gift** — halting bad change is success; normalize escalation without career penalty101- **Pair with peers** — reliability math (SRE), incidents (IR program), recovery (resilience), builds (CI)
daemon-blockint-tech