The least bureaucratic controls — the discipline

The discipline of the least bureaucratic controls is five properties, all five, on every control: named loss, sized mechanism, measured friction, named owner, expiry date. A control missing any one of the five is a bureaucracy in waiting. This lesson teaches the test, the failure modes, and the quarterly governance review that keeps the programme on the right side of the line.

The five-property test

Every control in the programme is scored against five properties. A control with all five is a control; a control missing any one is a bureaucracy in waiting, or already a bureaucracy.

flowchart TB
    C["Control"] --> P1["1. Named loss:\nwhat does this prevent?"]
    C --> P2["2. Sized mechanism:\nsmallest check that prevents"]
    C --> P3["3. Measured friction:\ncost in seconds / hours / cycle time"]
    C --> P4["4. Named owner:\nwho reviews and can drop the control"]
    C --> P5["5. Expiry date:\nwhen does this control retire"]
    P1 --> R["Control:\nall five present"]
    P2 --> R
    P3 --> R
    P4 --> R
    P5 --> R

The properties, one at a time.

1. Named loss. The control exists because a specific loss was named in writing. “We prevent unreviewed changes reaching production.” “We prevent images with critical CVEs being deployed.” “We prevent unencrypted S3 buckets from being created.” Without a named loss, the control is a ritual.

2. Sized mechanism. The mechanism is the smallest thing that prevents the loss. A review is sized to the risk (one reviewer for routine; two for risky). A policy is sized to the threat (one rule per loss, not ten). A bigger mechanism prevents the loss and more; a bigger mechanism imposes more friction.

3. Measured friction. The cost of the control is measured. Reviewer-hours per quarter. CI seconds per build. Cycle-time added per PR. The measurement is recorded; the owner reads the measurement.

4. Named owner. The control has an owner whose job is to track the named loss and the measured friction. The owner is named in CODEOWNERS or in the policy header. The owner can drop or shrink the control without escalating to a committee.

5. Expiry date. The control has a date at which it is reviewed for retirement. “This rule was added to block CVE-2024-3094; it expires on 2026-12-31 unless the threat persists.” The expiry date is in the policy header; the quarterly review honours the expiry.

The failure modes of missing properties

Each missing property produces a characteristic failure mode. The diagnosis is local; the fix is mechanical.

flowchart LR
    P["Missing property"] --> FM["Failure mode"]
    P1["No named loss"] --> FM1["Ritual:\nno one knows what it prevents"]
    P2["No sized mechanism"] --> FM2["Overreach:\nengineers bypass"]
    P3["No measured friction"] --> FM3["Hidden cost:\ncost dwarfs benefit"]
    P4["No named owner"] --> FM4["Drift:\nno one tracks"]
    P5["No expiry date"] --> FM5["Persistence:\nthreat has passed"]
    FM --> FIX["Mechanical fix"]
    FM1 --> FIX1["Write the named loss"]
    FM2 --> FIX2["Shrink the mechanism"]
    FM3 --> FIX3["Instrument the cost"]
    FM4 --> FIX4["Name the owner"]
    FM5 --> FIX5["Add and honour expiry"]

The quarterly governance review

The five-property test is run quarterly. The review is the discipline that keeps the programme on the right side of the line: every control is scored; a control missing a property is either fixed (the property is added) or retired (the control is dropped). The review has a single deliverable: a table of controls, the property each one has, and a decision for every property that is missing.

flowchart LR
    Q["Quarterly review"] --> LIST["List every control"]
    LIST --> SCORE["Score against five properties"]
    SCORE -->|"missing property"| FIX["Fix:\nadd the property"]
    SCORE -->|"cannot fix"| DROP["Drop the control"]
    SCORE -->|"all five"| KEEP["Keep"]
    FIX --> DOC["Document in review log"]
    DROP --> DOC
    KEEP --> DOC

The review is run by the named owners. The platform team reviews the pipeline-level controls; the security team reviews the policy-as-code controls; the infrastructure team reviews the IAM and network controls. The review log is committed to the repository; the log is auditable.

The anti-patterns to avoid

The five-property test is the positive discipline. The negative discipline is the set of anti-patterns the team must recognise and reject.

• The deck. A 30-slide governance deck that names the controls but has no artefacts in the repo. The deck is communication, not a programme.
• The committee. A change advisory board that approves every change but has no policy-as-code gate. The committee is procedural over mechanical loss.
• The blanket rule. A single policy file that applies to every change regardless of risk. The blanket rule is unsized.
• The permanent rule. A control added in 2020 that has not been reviewed since. The permanent rule has no expiry.
• The orphan. A control whose owner has left the team and CODEOWNERS has not been updated. The orphan has no owner.

Each anti-pattern is the same failure mode with a different label: a control missing one or more of the five properties. The fix is the same in every case: add the missing property or drop the control.

Production discipline

1. Score every control against the five properties quarterly. The score is in the review log.
2. Fix or retire every control missing a property within the quarter. The review is actionable or it is a ceremony.
3. Write the named loss in the policy header. The header is the first thing the auditor reads.
4. Name the owner in CODEOWNERS or the policy header. The owner is the structural accountable.
5. Honour the expiry date. A control that has expired and has not been renewed is dropped.

Cross-course references

• This course, Part CXVI-01 frames the trade-off; this lesson operationalises the trade-off into five properties.
• This course, Part CXV (OperatingModel) names the roles who run the quarterly review (security team, platform team, infrastructure team).
• Terraform for Production Sysadmins - Part IX (DeliveryPipeline) covers the same five-property test applied to Terraform plan checks.

Quiz