Engineering: SOPs
Six procedures for a pipeline where generation is cheap: the architecture decision, the change protocol, gate discipline, the irreversible-change rule, incident handling and the monthly gate audit.
Markdown. No sign-up, no email.
When writing code stops being the constraint, the procedures that matter are the ones governing what gets decided and what gets stopped. These six assume generation is nearly free and that the scarce things are judgement, verification and attention.
SOP 1: Architecture decision#
Run: before any change that alters a contract, a data shape, or how two systems talk.
- State the decision as a question with at least two real answers. One answer is not a decision.
- Have agents generate the options and the argument against each. Arguments against are the part people skip and the part that ages well.
- A human chooses, and records: the choice, the rejected options, and the reason.
- The record is the deliverable. A decision that lives only in the head of whoever made it cannot be revisited, and it will be re-argued in six months by people with less context.
The rejected options matter more than the chosen one. They are what stops the same debate recurring, and they are the only way a future reader can tell a considered decision from a default.
SOP 2: The change protocol#
Run: every change, no exceptions for size. Small changes cause most incidents precisely because they skip steps.
| Step | Rule |
|---|---|
| Scope | One change, one purpose. A branch doing two things cannot be reverted cleanly |
| Generate | Agents write the change and its tests in the same pass |
| Review | AI review first, then a human on anything touching a contract, auth, money or data |
| Test | The suite runs. A skipped test is a failing test with better manners |
| Scan | Dependencies, secrets and patterns, before CI/CD rather than after |
| Merge | Only with every gate green and a named accepter |
SOP 3: Gate discipline#
Run: continuously. Audited monthly.
A gate exists to stop things. Three rules keep it real:
- No gate is bypassed without a written reason naming who authorised it and what the risk was.
- A gate that has never fired is investigated, not celebrated. Either it is misconfigured, or the work is routing around it, and both look identical on a dashboard.
- A gate that fires constantly on the same false positive gets fixed or removed. A gate people learn to ignore is worse than no gate, because it produces the appearance of control.
SOP 4: Irreversible changes#
Run: whenever a change cannot be undone in minutes.
Schema migrations, data deletions, public API contracts, anything that touches money.
- Written rollback path, tested before go-live rather than described.
- A named human accepts, separately from the code review.
- Executed in a window with someone watching, never as a side effect of a routine deploy.
- For destructive data operations: a verified backup, and a restore that has actually been run.
No agent executes an irreversible change, whatever its confidence. The test is not capability, it is whether the mistake can be undone.
SOP 5: Incident handling#
Run: on any production defect.
- Roll back first, diagnose second. Restoring service and finding the cause are different jobs, and doing them in the wrong order extends the outage while somebody reads logs.
- Reproduce before fixing. A fix without a reproduction is a guess that happens to correlate.
- Every incident produces a test that would have caught it. An incident that does not become a test case will happen again, and the second time is more expensive because the first was survivable.
- The postmortem asks which gate should have caught it, and why it did not.
SOP 6: Monthly gate audit#
Run: monthly, thirty minutes.
| Question | What a bad answer looks like |
|---|---|
| Which gates fired, and how often? | A gate at zero for a month |
| Which were bypassed, by whom, and why? | Bypasses with no recorded reason |
| Which produced false positives? | The same false positive every week, still unfixed |
| What reached production that should have been stopped? | Anything, and the gate that missed it |
This is the procedure most likely to be skipped, because nothing is obviously broken while it is being skipped. It is also the only one that notices the pipeline quietly becoming decorative.