Zero is a Bad Target:Diverse Teams Experience Friction

[Originally a talk, “Continuous Improvement for Resilience, Security, and Inclusion”]

Continuous improvement is the idea that our software, infrastructure, security posture, processes — and people! — can be improved through incremental change over time. Every information security management system revolves around a continuous improvement cycle. One such cycle is PDCA: Plan, Do, Check, Adjust.

No matter what your experience level, no matter how extensively you Plan the thing, no matter how carefully you Do the thing, you need to Check the thing (assess it), and you need to Adjust your plans — and fix them for the next cycle.

I made a mistake

When I first made a mistake that impacted another engineering team, I was afraid of consequences. My manager asked, “Did you learn something? Yes? Good.”

That was it.

“But what happens if I make a big mistake?”

It’s okay to make a mistake.
It’s okay to make a big mistake.
It’s okay to make many different mistakes.
It’s not okay to make the same mistake repeatedly.

And it’s not okay to harm people knowingly.

Zero is a bad target

When I made a big mistake, I wondered — Am I the right person to do this? For developing engineering resilience, zero incidents means you aren’t taking risks. Typically, the pattern is to align on a reasonable risk budget for your current situation (and various socio-technical and business factors can change that risk budget).

An important note is that you don’t “spend” your risk budget. You don’t knowingly take down prod just for funsies. You don’t take arbitrary risks assuming that your budget can afford it. The risk budget is there so that you take thoughtful actions that are intended to improve the resilience of your system when you can afford it.

Similarly:
Experiencing zero friction in a diverse community means you aren’t interacting with people who are all that different from you after all.

It’s not a perfect metaphor. But the essence is that you can’t realistically walk on eggshells taking extreme care while also producing the widgets so that capitalism will graciously provide us health care. And you can’t realistically barge through thick and thin heedlessly to your impact on those around you while productively building relationships.

What matters most in any incident is what we do when we learn that we made a mistake

Over time, you invest in your inclusion journey, so that you generally know where the landmines and piles of eggshells are. You will inevitably step on a few.

Whether technical or personal — what matters most in any incident is what we do when we learn that we made a mistake.

You may feel shame. You may feel hurt by the way someone pointed out your mistake. Take inventory of your own feelings — but also take inventory of the feelings of people around you. If you hurt someone, learn about why they feel hurt, and how what you did affected them.

Walk through the Anatomy of an Apology [when you hold comparable or relative power within the primary power dynamics that are relevant]:

1. Get consent to share an apology, and respect their boundaries if they choose not to take on the emotional labor of receiving an apology.
2. Acknowledge what happened, without evading nor down-playing.
3. Create space for emotional response.
4. Center the impact, center their experiences and needs, and center learning what you can do differently (without looking to them to support you through that).
5. Take accountability through naming and owning your actions.
6. Prevent future mistakes by changing your behaviors.
7. Explicitly apologize — with a focus on their healing, never on your guilt, and without seeking forgiveness.

“Intent is not magic”. Just because I didn’t intend to hurt someone doesn’t change that I did. Intent holds meaning — but that only affects future impact when I follow through with action after learning that I hurt someone. That doesn’t erase past impact.

What does “good” look like?

I can count on my hand the number of people in tech I’ve met who have “not bad” skills in working through continuous improvement along their inclusion journey.

Some “good” signals:

• Folks teach each other about inclusive practices and the experiences of people who are marginalized or stigmatized in ways that they aren’t. (E.g., when we white people call each other out about the racism we do.)
• Folks own their mistakes — openly — and explain why it was wrong and what they’ll do differently, thereby reinforcing the culture we want to have.
• Senior leaders own their mistakes.
• Folks take thoughtful actions that are intended to improve the resilience of your people — i.e., investing in systemic change for inclusion, at an organization-wide level.
• Tangible, measurable change: representation, retention, visibility, and equitable outcomes from top to bottom.

I can’t tell you what “good” looks like, because “good” is not a state nor a destination — “good” is a journey of continuous inclusion.