principle-postmortem
Postmortem
Incidents are inevitable. A postmortem converts failure into systemic learning — the goal is not to assign blame but to close the gap between what the system can do and what the environment demands. The prevent → detect → learn triad is incomplete without this phase.
Cross-references: principle-resiliency (prevent), principle-observability#SLI / SLO / Error Budget (detect / MTTD-MTTR framing), principle-release-engineering#Rollback (remediation action items).
Blameless Culture
Blame suppresses signal. When individuals fear punishment, they conceal information, underreport near-misses, and avoid risky-but-necessary work. Blameless postmortems operate from the assumption that everyone acted rationally given the information and tools available to them at the time.
Guiding principles:
- "The system allowed it" — if a person could cause an outage, the system lacked the guardrails to prevent it. The fix belongs in the system, not the person.
- Psychological safety — participants must feel safe sharing the full sequence of events, including their own mistakes. Facilitation owns this; interrupt any language that assigns personal fault.
- Hindsight bias — it is easy to see the right move after the fact. Explicitly reconstruct the information available at each decision point; do not evaluate decisions using information that only became visible later.
- Counterfactual fairness — "if only they had done X" is only valid if X was a realistic, well-understood option at the time. If X required information no one had, the real gap is in the information architecture.
- Separate the review from personnel processes — postmortems feed the improvement backlog, not performance reviews.