The change question — six questions a change must answer before it is applied

A change begins as six questions, not as a commit. Before the commit, the pull request, the deploy, an engineer or a change-advisory board answers what, why, when, who, where, and how. The five questions from Part LXIV answer the auditor: “show me the audit trail of this change”. The sixth question (how) answers the operator: “show me the runbook”. A change record that omits “how” is a change record whose operator wing is flying blind.

The six questions

Every change submitted to a production repository answers six questions. The questions are answered in different places and by different people, but a change is not auditable until each has a machine-readable or human-readable record.

flowchart LR
    C["Change request"]
    C --> Q1["What: artefact identity"]
    C --> Q2["Why: rationale"]
    C --> Q3["When: window"]
    C --> Q4["Who: author and approver"]
    C --> Q5["Where: environment"]
    C --> Q6["How: procedure and rollback"]
    Q1 -.->|"image digest"| REG["Registry"]
    Q2 -.->|"PR description"| PR["Git"]
    Q3 -.->|"deploy window"| CAL["Calendar"]
    Q4 -.->|"CODEOWNERS"| OWN["Owners"]
    Q5 -.->|"cluster, namespace"| K8S["Cluster"]
    Q6 -.->|"runbook, revert"| RB["Repo"]

• What. The artefact identity. Image digest, Terraform plan checksum, manifest set.
• Why. The rationale. Lives in the PR description.
• When. The deploy window. A maintenance window, a change-advisory-board slot, a freeze exception.
• Who. The author and the approver. Two distinct identities; conflated, the audit is broken.
• Where. The environment. Cluster, namespace, account, region.
• How. The procedure and the rollback. The runbook the operator will execute and the revert the operator will execute if it goes wrong.

The five-question audit answers the auditor. The sixth question (how) answers the operator who, at 02:00, must execute the change with a runbook that fits on one screen.

Why “how” is the new question

LXIV-03 establishes the five-question audit. The auditor asks who, what, why, when, where, and the answer lives in the deployment record. The operator asks an additional question: how do I do this, and how do I undo it?

The “how” question is operational context the audit record does not capture: the order of steps, the dependencies between steps, the verification at each step, the rollback path. A change record that answers the five audit questions but not the how question has answered the auditor’s questions and left the operator’s questions to a wiki page that has drifted.

From question to pull request

The six questions translate into a pull request template. The template enforces the questions at submission time, so the author answers them before the approver is asked to sign off.

TITLE="Increase checkout replica count to handle peak"
BODY=$(cat <<'EOF'
## What
Image digest sha256:abc123...

## Why
Peak traffic on 2026-08-21; current replica count
saturates at 1.4k RPS; target is 2.5k RPS.

## When
Window: 2026-08-22 02:00-04:00 UTC; freeze exception
logged in CHANGE-2026-118.

## Who
Author: alice; Approver: bob (platform-team on-call).

## Where
Cluster: payments-prod; namespace: checkout; region:
us-east-1.

## How
Apply HPA + Deployment bump; verify pod count via
kubectl; rollback via revert PR if 5xx rate > 0.5%.

Refs: #1234
EOF
)
gh pr create \
  --title "$TITLE" \
  --body "$BODY" \
  --base main \
  --head feat/checkout-hpa \
  --reviewer bob,carol \
  --label "change,production,freeze-exception"

A template that enforces the six sections turns the six questions from a discipline into a checklist.

Production discipline

1. The PR template is the gate. A pull request without all six sections is a pull request that does not merge. Branch protection enforces the template.
2. The “how” question is non-negotiable. A change with a runbook but no rollback plan is a change that will be reverted in panic. The rollback is part of the how, not a separate question.
3. The window is recorded in the pull request, not in chat. A change window in a Slack channel is invisible to the audit; a window in the PR body is part of the record.

Cross-course references

• This course, Part LXIV (Auditability) - the five-question audit this lesson extends.
• Linux for Production Sysadmins - Parts XXXIII (ChangeMgmt) cover the change-management process from the operating-system side, the analogue of the decision-identity field.

Quiz