nextbuild.works

Concept · learning from failure

Blameless postmortems

A record of what went wrong and what will stop it recurring, aimed at the system and not the person, and what writing our failures down bought here.

A postmortem is the write-up after something goes wrong. The chapter on it in Google’s Site Reliability Engineering gives the parts:

A postmortem is a written record of an incident, its impact, the actions taken to mitigate or resolve it, the root cause(s), and the follow-up actions to prevent the incident from recurring.

Blameless means the write-up looks for why the failure was possible, not for someone to punish. “A blamelessly written postmortem assumes that everyone involved in an incident had good intentions and did the right thing with the information they had.” It does not mean nameless. The same chapter says “the postmortem format clearly identifies the actions that led to the incident.” What changes is the question: not who did it, but what let them.

Why it matters more with an agent

For a team of people, blamelessness is a choice. Blame is possible; it just makes people hide their mistakes. With an agent, blame has nowhere to land. The session that made the mistake is gone by the next one, and the next one knows only what was written down. An apology from the agent reaches no one who will be there tomorrow. There is no person to fix, so the only follow-up that counts is a change to what the next session will read or run.

The chapter’s own wording fits better than it was meant to. It asks for “investigating the systematic reasons why an individual or team had incomplete or incorrect information”. Incomplete information is an agent’s permanent condition. The systematic reason to look for is what the code, the checks and the documents said, or failed to say.

None of this is new

“Blameless culture originated in the healthcare and avionics industries where mistakes can be fatal.” The chapter gives the reason in plain terms: where people are shamed for mistakes, “people will not bring issues to light for fear of punishment.” And the software version of the lesson is one sentence: you cannot fix people, “but you can fix systems and processes to better support people making the right choices”.

What writing failures down bought here

Where we fall short

Nothing says when a write-up is owed. The chapter is clear: “It is important to define postmortem criteria before an incident occurs so that everyone knows when a postmortem is necessary.” We have no such criteria. A failure gets written up because the session that hit it wrote it up, and the record lands wherever that session was working: the session history, a machine’s notes, the catalogue or the backlog. There is no single list of what went wrong.

The catalogue does not say which traps are now guarded. Some checks have since been built into the code, so the next rebuild keeps them. Others are still a command a person has to know to run. The entries do not record which is which.

The hard part of blamelessness is barely tested here. Blameless culture exists because people fear punishment. This estate has two participants, and one of them has nothing to lose by being named. What it shows is that failures get written down and turned into checks. It cannot show that the practice survives a team where someone has something to lose.