Rule 28 of 33 · Chapter VI — When Things Break
Blame the system, never the person
Why this rule exists
When something breaks, the most natural and most destructive reflex is to find who did it, but human error is almost always the last link in a chain of system failures, and stopping at the person guarantees you never fix the real cause. If a bad deploy took down production, the interesting questions aren't 'who deployed it' but 'why did our process let a bad deploy through, why didn't tests catch it, why was rollback slow,' and those are the fixable things. Blameless postmortems exist because the moment people fear being punished for mistakes, they stop reporting them, they hide near-misses, and they get defensive instead of curious, at which point the organization goes blind to its own risks. We treat mistakes as information about weak systems, not evidence of bad people, because that's the only culture in which people tell the truth about what happened. The engineer who caused today's outage is usually the one who understands it best, and we want them explaining it, not defending themselves.
In practice
After any real incident, write a blameless postmortem: what happened, the timeline, the root causes, and what we'll change so it can't happen the same way again. Focus relentlessly on the system, the process, the missing guardrail, the confusing interface, not on the individual who tripped the last wire. Use neutral language, 'the deploy went out without a passing test suite,' not 'Alex skipped the tests.' Include concrete action items with owners, so the postmortem changes something rather than just documenting sadness. Treat whoever was involved as a partner in understanding, not a defendant, and thank them for their honesty. Share the postmortem openly, because the lesson is only worth something if everyone learns it, not just the person who lived it.
When it doesn't apply
Blamelessness is about honest mistakes and systemic gaps, which is nearly everything; it does not cover genuine negligence or repeated recklessness after clear warnings, which is a different, direct conversation. And blameless doesn't mean consequence-free for the system, the whole point is that something must change.