DEC-001
The Hive / Failure Lab
Treat recovery as a separate capability from access.
Tailscale made a remote Authentik change possible while physical access was hours away.
Open the evidence →- Choice
- Require an independent recovery path, explicit rollback, and stop conditions for remote identity work.
- Rejected
- The assumption that network reachability made the change operationally safe.
- Cost
- More preparation—and sometimes deferring a change that is technically possible.
- Evidence
- A successful change became a documented near miss and a reusable change gate.