CAB, peer review, and four-eyes — the social contract of governance

Four-eyes is the cheapest gate that catches the most expensive failures. CAB is the higher-cost gate that catches the systemic risks. The pair is the social contract of governance: a change that has not been seen by another human is a change that has decided the team is not involved.

The four-eyes principle

The four-eyes principle says: a change must be reviewed by at least one human who is not the author. The reviewer’s job is to find the thing the author missed. The review is a documented sign-off; the signature is the audit trail.

The principle is scale-free. A one-line config tweak gets a peer review. A control-plane upgrade gets a senior review plus a CAB. The principle is the same; the depth is different.

flowchart TD
    A[Author writes plan] --> B[Reviewer reads]
    B --> C{Issues found?}
    C -->|Yes| D[Author revises]
    D --> B
    C -->|No| E[Reviewer signs]
    E --> F[Change approved]
    F --> G[Window scheduled]

The cycle is deliberate. A reviewer who cannot find an issue has probably not read the plan. The author who revises the plan in response to the review is the loop that pays down the risk.

Peer review

Peer review is the routine gate. A peer reviewer is an engineer of comparable seniority who has not been involved in the change but is familiar with the cluster. The peer reviewer’s job is to ask: does this plan make sense?

The peer reviewer typically catches:

• A wrong command flag.
• A missing pre-condition (e.g., the snapshot was not taken).
• A misclassified risk (e.g., Class 2 that is actually Class 3).
• A missing communication (e.g., the customer success team was not told).

The peer review is not a deep audit. The peer review is the fresh pair of eyes that finds the obvious mistake the author cannot see because they are too close to the change.

Senior review

A senior review is the gate for Class 2 changes. A senior reviewer is a more experienced engineer who has handled the same kind of change before. The senior reviewer’s job is to ask: what could go wrong?

The senior reviewer typically catches:

• A scenario that the author considered improbable but the senior has seen.
• A rollback path that looks fine but has a hidden assumption.
• A validation that is correct but insufficient.
• A timing that conflicts with another change.

The senior review is the gate that catches the plausible failure modes. The senior has seen enough failures to know which ones are not improbable.

CAB review

A CAB (Change Advisory Board) is the gate for Class 3 changes. A CAB is a scheduled meeting with multiple reviewers from different teams: the cluster operator, the security team, the network team, the application team, and a customer representative. The CAB reviews the plan, asks questions, and either approves, rejects, or requests revisions.

sequenceDiagram
    participant Author
    participant CAB
    participant Security
    participant Network
    participant Apps
    Author->>CAB: Submit plan
    CAB->>Security: Review for security risk
    CAB->>Network: Review for network risk
    CAB->>Apps: Review for impact risk
    Security-->>CAB: Findings
    Network-->>CAB: Findings
    Apps-->>CAB: Findings
    CAB->>Author: Approve / Revise / Reject

The CAB is the social contract. The CAB is the moment where the change is not the author’s own decision; it is the team’s decision. The CAB’s findings are the audit trail.

Failure modes of self-approval

The worst production failure is self-approval. An operator writes a plan, signs it themselves, and proceeds. The change is ungoverned. The cluster’s risk is unpriced.

Self-approval happens when:

• The operator is the only engineer on-call.
• The operator is rushed and the change is “small.”
• The operator has authority to self-approve (a Common anti-pattern).

The remediation is structural:

• Schedule CAB meetings so the operator is not the only gate.
• Require a second sign-off for Class 3 changes.
• Audit recent changes for self-approval at the quarterly PIR review.

Production discipline

The four-eyes principle is the cluster’s cheapest gate. The CAB is the highest-cost gate. The pair makes the governance work: the routine catches the obvious; the systematic catches the systemic. The discipline is the same scale-free: every change gets a review by a different human.

• Peer review is the routine gate. It catches the obvious.
• Senior review is the Class 2 gate. It catches the plausible.
• CAB is the Class 3 gate. It catches the systemic.
• Self-approval is a failure mode. Audit recent changes for self-approval at the quarterly PIR review.

Quiz