| name | zero-tolerance-for-failure |
| description | Guides failure-prevention culture and operational excellence for mission-critical engineering—
zero-defect aspiration vs error budgets; HRO principles; defense-in-depth; fail-safe/fail-closed;
verification gates and independent checks; redundancy and graceful degradation; pre-mortems and
FMEA; stop-the-line; defect escape, near-miss, and repeat-incident metrics; leadership against
normalization of deviance—not blame culture. Use for failure-prevention programs, HRO practices,
verification gates, fail-safe design, pre-mortem/FMEA, stop-the-line, near-miss reporting, or
defect-escape metrics—not SRE error budgets only (site-reliability-engineer), incident command only
(incident-management-engineer), backup/restore only (cyber-resilience-engineer), CI lint only
(build-validator), agile coaching, HR discipline, or classified ATO without ops-excellence lens
(classified-cyber-security-senior-manager).
|
Zero-Tolerance for Failure
When to Use
- Establish failure-prevention culture and operating norms for mission-critical systems
- Apply HRO principles (preoccupation with failure, reluctance to simplify, sensitivity to operations, commitment to resilience, deference to expertise)
- Design defense-in-depth, fail-safe, and fail-closed controls for software, infra, and OT
- Define verification gates, independent checks, and release hold criteria
- Architect redundancy, isolation, and graceful degradation with explicit failure modes
- Facilitate pre-mortems, FMEA, and risk registers before high-stakes change
- Author stop-the-line policy and escalation when quality or safety signals are ambiguous
- Select and track prevention metrics (defect escape, near-miss, repeat incidents, gate bypass)
- Coach leadership behaviors that counter normalization of deviance and blame theater
- Brief engineering and ops on zero-defect aspiration vs error budgets for the right domain
When NOT to Use
- Own SLI/SLO definitions, error-budget policy, and burn-rate alerting →
site-reliability-engineer
- Run live incident war room, SEV classification, and status communications →
incident-management-engineer
- Design backup/immutability, RTO/RPO recovery, and ransomware restore architecture →
cyber-resilience-engineer
- Enforce CI compile/lint/test gates without broader prevention program →
build-validator
- Facilitate sprint ceremonies, backlog grooming, or team agile transformation → agile coaching skills
- Issue HR warnings, performance plans, or legal disciplinary guidance → escalate to HR/legal
- Own classified ATO/accreditation packages without operational excellence deliverables →
classified-cyber-security-senior-manager (pair for cleared context)
- Produce ADRs and integration patterns without failure-prevention lens →
senior-system-architecture (pair for architecture)
Related skills
| Need | Skill |
|---|
| SLOs, error budgets, reliability toil, capacity | site-reliability-engineer |
| Incident program, SEV, on-call, postmortems | incident-management-engineer |
| Recovery tiers, backup/immutability, resilience tests | cyber-resilience-engineer |
| Build/CI quality gates and merge validation | build-validator |
| Cleared program governance, inspection, escalation | classified-cyber-security-senior-manager |
| NFRs, architecture review, ADRs | senior-system-architecture |
| Enterprise BCM/DR program and tabletops | bcm-disaster-recovery-specialist |
| Active CSIRT containment and forensics | incident-responder |
Core Workflows
1. Scope, limits, and charter
Clarify what “zero tolerance” means in context—aspiration, gates, and metrics—without perfectionism traps.
See references/zero_tolerance_scope_and_limits.md.
2. HRO principles and operating mindset
Embed high-reliability organization behaviors in teams that face rare, catastrophic failure.
See references/high_reliability_organization_principles.md.
3. Prevention, verification, and gates
Layer independent checks, hold points, and evidence before irreversible change.
See references/prevention_verification_and_gates.md.
4. Redundancy, degradation, and fail-safe design
Specify failure modes, safe defaults, and degraded operation—not only happy path.
See references/redundancy_degradation_and_fail_safe.md.
5. Pre-mortem, FMEA, and risk registers
Surface latent failures before launch; maintain living risk and mitigation traceability.
See references/pre_mortem_fmea_and_risk_registers.md.
6. Leadership, culture, and metrics
Measure prevention; reinforce stop-the-line; reduce normalization of deviance.
See references/leadership_culture_and_metrics.md.
Outputs
- Failure-prevention charter — scope, principles, RACI, interfaces with SRE/IR/QA
- Gate catalog — hold points, owners, evidence required, bypass rules and audit trail
- Design review pack — fail-safe/fail-closed decisions, degradation modes, verification plan
- FMEA / pre-mortem record — failure modes, causes, controls, residual risk, owners
- Stop-the-line policy — triggers, authority, duration, comms, and restart criteria
- Metrics dashboard brief — defect escape, near-miss, repeat incidents, gate effectiveness
- Leadership playbook — behaviors, rituals, and anti-patterns (learning vs blame)
Principles
- Prevent over punish — optimize systems and norms; avoid blame theater and hidden workarounds
- Fail closed by default — ambiguous safety or auth states deny; document explicit fail-open exceptions
- Independent verification — separation between build, check, and approve for high-criticality change
- Deference to expertise — elevate domain experts at the boundary; leaders ask, not override silently
- Measure escapes and near-misses — lagging severity alone rewards luck; track what almost failed
- Stop-the-line is a gift — halting bad change is success; normalize escalation without career penalty
- Pair with peers — reliability math (SRE), incidents (IR program), recovery (resilience), builds (CI)
