The outage started with a service none of us could name. Something in the order pipeline stopped moving, we traced it back through three hops, and arrived at a small virtual machine running a component that had been quietly doing its job for six years. Nobody on the call recognised it. It was not in the on-call documentation, it had no dashboard, and when we finally dug up who had built it, that person had left the company two reorganisations ago. We had a production dependency that, organisationally speaking, did not exist.
Ownership does not disappear in a dramatic moment. It evaporates. Somebody builds a useful thing, they move to another team, their old team gets absorbed into a different department, the wiki page that mentioned it stops being maintained, and one day the last person who could have told you what it does takes a job somewhere else. The machine keeps running perfectly the whole time, which is exactly why nobody notices the ownership has gone. Working systems generate no reminders that they need a human attached to them.
The cost is invisible right up until it is enormous. An unowned system is not patched, because nobody receives the advisory. It is not monitored meaningfully, because nobody knows what healthy looks like. It has no runbook, no capacity plan, and no place in any migration project, so it silently becomes the oldest and most fragile thing in your estate while everything around it is modernised. When it eventually breaks, you are not doing incident response. You are doing archaeology under time pressure.
What I ask for now is boring and it works. Every system in the inventory carries the name of a team, not an individual, and that mapping gets reviewed whenever the organisation chart changes, because reorganisations are the single biggest producer of orphans. If a service cannot be assigned to a team that will admit to owning it, that is not a paperwork gap. That is a finding, and it goes on the risk register with everything else we know is dangerous.
A system with no owner is not stable. It is just unattended, and the difference only becomes obvious at the worst possible hour.
– Serguey Shinder
Top comments (0)