Unit 11.03: Stating the failure modes you accept
Every system has failure modes. The useful distinction is between the ones you have named and mitigated and the ones that will be discovered by a user.
Failure, mitigation, residual risk
Three columns. The failure, what you do about it, and what risk remains after the mitigation. The third column is what makes the row honest - a mitigation without a residual is a claim to have solved the problem.
Below is four accepted failures for the capstone system.
accepted failure mitigation residual
paraphrases far from document wording may retrieve nothing logged and reviewed weekly medium
staleness is surfaced but not auto-detected updated date shown in every answer medium
no multilingual support non-English queries refuse rather than guess low
conflict detection is numeric only escalates to a human on any disagreement low
Naming a failure you accept is stronger than claiming you have none. Each row
carries a mitigation and a residual risk, so a reviewer can disagree with the
judgement rather than discover the gap in production."Staleness is surfaced but not auto-detected" with the mitigation "updated date shown in every answer" and a residual of medium. That is a complete row: the reader knows what breaks, what catches most of it, and roughly how much exposure is left.
Compare with the same failure written as "we show dates on answers." Same fact, no acknowledgement that a user can ignore a date, and nothing a reviewer can push back on.
The mistake this prevents
The mistake is presenting a system as having no known failure modes. It reads as thoroughness and is read by experienced reviewers as inexperience - they know the failures exist, so a list of none means the analysis was not done, and now they have to do it themselves without your knowledge of the system.
Takeaway
Name the failures you accept, with a mitigation and a residual risk each. It converts an unknown unknown into a documented trade-off a reviewer can disagree with before it reaches production.