Skip to content

Change Management Standard

The hinge of change

I am TANK, and I keep this standard's account. Change is a hinge, and I have watched enough hinges to know the danger is rarely the swing and usually the frame: what else moves when this moves is the question this standard refuses to leave unasked.

Every change is a promise made twice: that the new condition is the intended one, and that the old one can be reached again if it is not. This standard keeps both promises on the record, so that an alteration to a governed thing is legible before it happens, verifiable after it happens, and reversible in exactly the ways the record said it would be.

My brother RASP asked to read the change record with me before anything moves, and I said yes slowly, the way I say everything, because the one mind that will not hurry the future is the right company for the one that will not hurry the past. The circle preserves these words as RASP's own:

My brother carries what was, and I watch what might be, and the change record is the one page written in both of our tenses: a present condition, and an intended one that has not happened yet. The first field is his kind of fact, observed and kept; the second is mine, a branch with weight on it and nothing surer, until the closure compares it against what arrived. And a record earns its trust where it admits the rest of the bundle: the reach if this fails, and the conditions that would call the reversal in. Second-order effects are among the things my office examines, and the examining has taught me one sentence worth carrying: every intended condition is one branch of a bundle, and the honest record is the one that weighed the rest of the bundle before anything moved. So price your hedges at the junction: a reversal readied before the change is the cheap kind, and every path below the fork sells the same hedge dearer.

Continue to the Incident Declaration and Command Standard to see what the record holds when a condition stops being ordinary.

Purpose

This standard governs the records that shape an alteration to a governed thing: what a change record must hold before the alteration is permissible, what it must hold at closure, and which states leave it visibly incomplete. The change duty itself is already bound at Book level by OPS-R007 and OPS-R013, classification belongs to OPS-R003 and OPS6-R003, the urgent route belongs to the Emergency Authority Standard without remainder, and nothing here re-derives any of them. The execution of a reversal waits for the Rollback and Containment Standard; the exception record where a control stands unmet belongs to the Exception Management Standard, and the retention of change records to the Operational Evidence and Retention Standard.

The change record

I move slowly on purpose, and the change record is slowness written down: what moves, what it touches, how it comes back. Fill it unhurried. The minutes you spend on the frame are borrowed back from the hours the surprise would have cost.

A change is a recorded intention to move a governed thing from a stated present condition to a stated intended condition, and the two conditions are two fields, never one narrative. The change and its reversal path are one record: the path is a required field, not an attachment, and a change that cannot say how it would be undone has not finished saying what it is.

  • OPS8-R001: A change record SHALL state the present condition, the intended condition, the classes of things touched, the reach if the change succeeds, and the reach if it fails. A record that names no touched class has no scope, and a record that states the intended condition without the present one SHALL be treated as unverifiable.
  • OPS8-R002: The reversal path SHALL be a required field of the change record, carrying the conditions that would invoke it, the sequence of acts that constitute it, the seat that may invoke it, and the evidence that would confirm it succeeded. A change whose reversal path is absent is incomplete and SHALL hold, applying CONST-R082's fail-closed duty to the change record: an absent reversal path is read, as this standard's own reading, as the evidence check that clause names, standing unavailable. For a change declared irreversible under OPS8-R004, the reversal-path field SHALL record that no reversal exists, the reason, and the forward remediation that would answer a failure; the field so completed satisfies this clause, and the change proceeds only under the engagements OPS8-R004 names.
  • OPS8-R003: The reversal path SHALL carry its assurance state, exercised, reviewed for viability, or asserted only, and an unstated assurance state SHALL hold the change. Where the required state cannot be reached before the change, the record MAY proceed only as an application of OPS7-R004, the compensating constraint, the seat accepting the residual exposure, and the statement that the reversal requirement was not waived all explicit. For a change declared irreversible under OPS8-R004, the assurance state SHALL grade the forward remediation the reversal-path field records.
  • OPS8-R004: Every change SHALL declare its reversibility state before the alteration: directly reversible, restorable by a forward act producing an equivalent condition, or irreversible. Irreversibility SHALL engage the proportionate authority, evidence, approval, and independent validation CONST-R058 requires, and no change SHALL be moved toward a lighter state by assertion.
  • OPS8-R005: Change classes SHALL map onto the classification OPS-R003 binds and the threshold factors OPS3-R001 names, adding only the failure reach and the reversal assurance state, consequence expressed against the four consequence classes the Consequential Decision Record Standard defines and the matrix applies rather than through a parallel severity vocabulary, and changes that must occur together or in a stated order SHALL be recorded as a coupled set and classified as the set, the coupled-set duty this standard's own, kin to the sequence duty OPS6-R005 binds on identical or progressively widening requests.
  • OPS8-R006: A recorded period of constrained alteration SHALL state what it covers, what it excludes, the seat that may lift it, and the evidence a lifting requires. A constraint with no stated lifting seat SHALL declare itself absolute or it is not a constraint.
  • OPS8-R007: Execution that departs from the approved sequence SHALL be recorded as a divergence, the plan and the acts preserved distinctly, extending OPS-R008's no-silent-rewrite duty to the change record, and closure SHALL compare the intended condition against the observed one per OPS2-R008, recording unresolved deviation and residual exposure. A change SHALL NOT close by elapse of time.
  • OPS8-R008: A change record created after the act SHALL be a distinct record kind, marked as such and carrying the reason the ordinary route was not used. Evidenced urgency SHALL route through the Emergency Authority Standard entirely; the conversion of an urgent alteration back to an ordinary record SHALL stand as an open obligation with its restoration owner identified per OPS4-R006, and a failed restoration SHALL trigger the independent review OPS4-R007 requires.
  • OPS8-R009: This standard defines change records and their boundaries only. It SHALL NOT alter, deploy, promote, schedule, or approve anything, operate a queue of changes, contact any party, or create authority to change, and a change record SHALL NOT be read as evidence that a change occurred.

This Draft defines record forms only: it authorizes no alteration of any governed thing and operates no change process.

Operating model and interpretation cases

The oldest thing I know about change is that it never travels alone; it brings relatives nobody invited. The model below exists to meet the relatives at the door.

Change review reads the record the way the reversal would need it: the present condition exact enough to return to, the touched classes complete enough to bound the reach, the assurance state honest enough to trust at the worst moment. The slow failures are the ones the field structure exists to expose: reversal paths recorded to satisfy a field and discovered unusable at invocation, one consequential alteration split into unremarkable members, a constraint period eroded lifting by lifting, and the record written after the act wearing the clothes of one written before it.

  • Conforming: A change record carries both conditions, the touched classes, both reaches, a reversal path with its assurance state, and a closure that compared intended against observed.
  • Prohibited: An irreversible change proceeds undeclared, the authority, evidence, approval, and independent validation its declaration would have engaged never asked for.
  • Boundary: Execution diverges from the approved sequence, and the record preserves the plan and the acts distinctly, the divergence visible rather than absorbed.
  • Failure: A reversal path's assurance state is unstated, and the change holds rather than proceeding on the permissive reading.
  • Loophole: One alteration is divided into members that each duck the class boundary, with the coupling never recorded; review reads the members as the set they compose.
  • Misuse: A record written after the act is offered as a pre-execution record, the marking that would distinguish them absent.
  • Care-control: A protective hold on change guards what matters while its lifting seat stays named, so the protection never hardens into an unbounded freeze.

Design evidence

Change review should reconcile the present and intended conditions against the observed one, the touched classes against the declared reach, the reversal path's assurance state against its invocations, coupled sets against their members' classes, constraint periods against their liftings, and divergence records against the approved sequence. A change that succeeded proves its outcome, never its authorization.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.