| K1 |
a rule that adds parts (P44, P45, P46, P40, P41, P47) conflicts with P23 (fewer parts) |
add those parts only as far as the master rule and the rigor matrix require |
both adding and removing parts change failure risk |
multi-AZ for production, single-AZ for development |
sourced (see P23, P44, P45) |
| K2 |
a fix is needed faster than P64 (change review) and P65 (small steps) allow, because of P73 (time until harm) |
use a predefined emergency change path with a shorter review, and do the full review afterwards |
skipping review without a plan removes every check at the moment of highest stress |
a hotfix path with one approver and a mandatory postmortem within 48 h |
author's synthesis; no single source |
| K3 |
P27 (tolerate variation) seems to conflict with P33 (reject bad input) |
tolerate variation within the specification (P27); reject and report input outside the specification (P33) |
both rules aim at stable behavior; they differ only in where the boundary lies |
accept any valid timestamp format the schema allows; reject a timestamp field that is missing |
author's synthesis from Taguchi and RFC 9413 |
| K4 |
preserving evidence (P83) would delay recovery beyond the time until harm (P73) |
capture evidence automatically and fast; if harm is imminent, restore service first and keep whatever the automation captured |
both the evidence and the service matter, and automation makes the trade-off small |
crash dumps and log shipping run before every automatic restart |
author's synthesis; no single source |
| K5 |
P18 (decide reversible decisions fast) conflicts with P64 (change review) and P56 (independent checker) |
scale the review depth with reversibility and consequence: reversible and low consequence → peer review or self-check; irreversible or high consequence → full review, P42 and an external checker |
both slowness and unreviewed irreversible harm are failures |
a new dashboard: the team decides; deleting historical audit logs: two approvers and a legal review |
author's synthesis from the Amazon 2015 letter and the master rule |
| K6 |
P7 (leave the method to the people doing the work) conflicts with P71 (checklists), P72 (critical control points) and P61 (qualified procedure) |
prescribe the method only at critical control points, in qualified or regulated procedures, and where the rigor matrix requires it; everywhere else give intent and constraints |
prescribed methods everywhere stop initiative; free methods at critical points remove proven protections |
"use the restore checklist" (prescribed); "improve developer onboarding" (intent only) |
author's synthesis from ADP 6-0 and P61 |
| K7 |
P5 (psychological safety) and P80 (blameless analysis) seem to conflict with accountability (P2, P6, P43, legal duties) |
treat honest errors and system weaknesses without blame; treat deliberate violations, reckless behavior and fraud through a defined, fair disciplinary procedure |
blame for honest errors hides information; no consequence for deliberate violations destroys trust and controls |
a wrong command during an incident → blameless postmortem; bypassing the two-person rule on purpose → disciplinary procedure |
author's synthesis; no single source |
| K8 |
P21 (specific, challenging goals) conflicts with P19 (indicators are gamed) and with Deming's rejection of numerical goals |
use goals for direction and learning; do not tie pay or ranking mechanically to one indicator; pair every target with a counter-indicator |
goals raise performance, but a single rewarded number distorts the work |
the team goal "halve build time" has a guard "test coverage does not drop"; bonuses are not calculated from the build time |
author's synthesis from Locke & Latham, Campbell and Deming |