4 ms·

> was to drive home the sense of responsibility and trust we placed in those employees. This seems like the opposite of a blameless culture, putting the onus

• sokoloff 4y ago
  Disagree, but it might be because I phrased/explained it badly. There is a set of employees E, who might be the cause of the production problem. There is a set of employees P, who might be in a position to use this emergency authorization. E contains about 1000 employees. P contains about 5 employees (including me, as it happens). Members of E can do anything the normal rules allow during an emergency. Members of P can authorize anything they think is appropriate during an emergency. Only in that limited sense is the onus on them, but that's clearly time-bound to the emergency. P's responsibility is to restore service to our customers, not to worry during the incident about how service was originally lost. Later, in figuring out what happened, we do get to the point of who did what, when, and if we're able, why they thought that was the best course of action. In 19 years here and 17 since I designed this process, I've never seen a production incident nor a mistake in handling one held against a member of E nor P, even though we often learn something from our mistakes leading up and during prod incidents.