Interactive graph
Safety by Design
Table of Contents
Build workflows so the dangerous move is hard - not just a warning label and good intentions.
Key Concept
- Rollback is undo-by-design when release goes loud.
- Level 1: Build the release so you can quickly undo it when something breaks - like a door that opens both ways.
- Level 2: Build the release so you can quickly undo it when something goes wrong - like designing a door that opens both ways.
- Level 3: Rollback baked into release design - undo is a feature, not an afterthought.
- Level 4: Because loud failures happen, systems that assume rollback recover faster than heroics.
- Level 5: Rollback is undo-by-design when release goes loud - Reversibility at architecture time, not incident time.
- Staged Rollout means fewer people hit before the hazard is proven safe.
- Make the dangerous move hard by default - not just forbidden on paper.
Examples
- We moved the hot oil station off the walk lane before buying more warning signs.
- The playground gate opens toward the fence, not the street - design beat another lecture.
Note Relationships
| Relationship | Wikilink | Reason |
|---|---|---|
| contradicts | Develop, Don't Endanger | when the opposite frame fits better |
| extends | Eliminate Before Managing | Design out the hazard before you label it |
| extends | Hierarchy of Controls | Hard-to-cause harm is elimination at the top of the ladder |
| extends | Rollback Principle | Rollback is undo-by-design when release goes loud |
| extends | Staged Rollout | Fewer people hit before the hazard is proven safe |
