Most change freezes are a mood, not a calendar. Someone says "no deploys until things calm down," and then the freeze erodes one urgent afternoon at a time — until somebody ships a pricing change at 4pm on December 23 and spends the quietest week of the year on a billing outage. The fix is not a stricter mood. It is one table on the wall: the windows you declare in advance, what is frozen inside each one, what still ships, and who can say yes when something truly cannot wait.
Full template with worked example: Change-Freeze Calendar Template — HIVE80lab Ops Notes. The regular lanes that keep freezes rare are in the Maintenance Window Policy.
1. The freeze calendar, one page
A row per window, declared weeks ahead. Three columns do the real work:
| Column | What goes in it | Why it exists |
|---|---|---|
| What's frozen | A scope, not the word "everything" — e.g. "all production deploys, pricing, schema, infrastructure" | A vague freeze is an unenforceable one |
| Still ships | Rank-1 security fixes, rollback-only patches, docs, monitoring | What keeps security clocks running inside the freeze |
| Break-glass approver | One named human per window — never a committee, never the requester | A freeze without a name becomes a freeze broken by whoever argues hardest |
2. The four windows small teams actually declare
Teams of 5–50 rarely need more than four a year. More than that means your regular process is broken — fix the lanes instead:
- Peak-season blackout (Black Friday, December, your customers' crunch): all production, the season your customers cannot afford an incident.
- Quarter-close: finance systems only — nothing touches billing while the books close.
- Migration / major-release week: one moving part at a time; everything else waits until the migration has been stable for a week.
- Event week (launch, conference, audit): whatever you would not explain to a customer while it is on fire.
3. The freeze rule, stated as one line
During a declared window, a production change needs one named approver's yes — the calendar is the policy, the approver is the exception. No freeze means "nobody can ever ship"; it means shipping now costs one conversation with the person whose name is on the row.
4. The exception loop: ninety seconds per request
- Ask with three facts: what changes, why it cannot wait, and the rollback. No rollback → "no" by default.
- Check the calendar row: is the change inside the frozen scope for this window?
- The named approver decides in ninety seconds: yes with a time-box ("ship it today, done by 5"), or no with a slot ("first thing after Jan 3"). No third answer.
- Log it in the row: date, change, approver, outcome. The log is how you notice one team asks every single time.
5. What still ships during a freeze
- Rank-1 security fixes — severity clocks do not pause for a holiday.
- Rollback-only fixes — if the fix is a revert, it ships; a rewrite waits.
- Docs, runbooks, monitoring — writing never took production down.
- Pre-scheduled patch lanes, if the window's scope allows — say so on the row instead of relitigating it.
6. Three metrics
- Exceptions requested vs granted. Healthy is about one in five. Nine in ten means decoration; zero means a wall people route around.
- Incidents traced to a change made just before the window opened. Most peak-season incidents are pre-freeze changes detonating late — this is the metric that justifies the freeze to skeptics.
- Windows held. A freeze that silently stops being true is worse than no freeze. Update the row when the window ends: held or broken, and why.
Worked example: from a December 23 outage to eleven quiet days
A twelve-person B2B SaaS company. The year before: a founder shipped a pricing-schema change at 4pm on December 23 because "the freeze was just for the engineers." It corrupted invoicing for one customer segment; nobody noticed until January 2; three days of manual repair in the new year. The next year they declared the window on November 20 — December 18 to January 3, full production scope, the on-call lead as break-glass approver. Nine exceptions requested, two granted (both rank-1 security patches, shipped same-day with the clock documented), zero production incidents, and the pricing change shipped January 6 with a rehearsed rollback. Total process cost: one table, one line in the weekly review, and ninety seconds per exception request.
If you want the whole change-control loop — windows, lanes, rollback drills, the freeze audit — run by an outside pair, that's the Small-Team Ops Audit; the Ops Starter Kit covers the incident half, and Vol. 2 covers the on-call rotation that staffs the freeze.
Top comments (0)