After-Action Pathway Update¶

Retrospective review — instantiates Exposure Pathway Interruption

After an incident or near-miss, rebuilds the source-pathway-receptor model to add the route that was actually used and the links that turned out to be cuttable.

When a hazard reaches a receptor despite the controls, it has just revealed a route the model missed or mis-weighted. After-Action Pathway Update is the retrospective step that reopens the source-pathway-receptor graph after an event or near-miss and corrects it: it adds the pathway actually used, re-inventories which links proved severable, and tests whether a different cut would have prevented the outcome. Its defining move is to treat the incident as data about the graph rather than only an operational failure to be cleaned up. It builds no control of its own; its product is a better map for the mechanisms that do.

Example¶

A deli-meat processor gets a routine finished-product positive for Listeria monocytogenes. The plant's pathway model assumed contamination entered with raw material, and its controls were placed accordingly. The after-action update reconstructs what actually happened: environmental swabbing traces the organism to a floor drain beside the packaging line, aerosolized by high-pressure hose-down and settling onto exposed product — a route the model never contained.

The graph is updated to add the drain → aerosol → product link. The severable-link inventory gains a new cuttable step — replacing high-pressure wet cleaning near exposed product with low-pressure or dry methods, and treating the drain. A counterfactual check then asks the decisive question: which single change, made earlier, would have broken this route — and the answer (hygienic zoning between wet-cleaning and packaging) becomes the control the plant actually adopts.

How it works¶

Reconstruct the route that was used, not the one assumed. Build the actual source-to-receptor path from physical evidence, not from the pre-incident model.
Revise the graph. Add the missing links and re-weight the ones the event showed were stronger or weaker than believed.
Update the severable-link inventory. Record which newly-visible links can be cut, and how.
Run the counterfactual. Ask which single cut, applied beforehand, would have prevented the outcome — and route that answer back to the mechanisms that build and verify controls.

Tuning parameters¶

Trigger threshold — review only major incidents, or every near-miss. A lower threshold harvests more free lessons but costs review effort.
Evidence depth — interviews and paperwork versus physical reconstruction and environmental sampling. Deeper evidence finds the true route but is slower.
Stance — blameless and system-focused versus accountability-seeking. A blame-oriented review dries up the very reports it depends on.
Re-test scope — re-examine only the one link, or re-open the whole graph for the class of failure it represents.
Feedback latency — how fast the revised graph and cut reach the controls that must change.

When it helps, and when it misleads¶

Its strength is that it is the only mechanism here that closes the loop, converting surprises into a better map; a near-miss becomes a free lesson instead of a lucky escape. Its failure modes are organizational: findings that never feed back change nothing (a report filed, not applied), and a blame-oriented review that suppresses the reporting it needs. Its classic misuse is running the review backwards — assembling it to justify the control already in place ("the process worked as designed") rather than to find the route that got past it.^[1] The discipline that keeps it honest is a blameless, system-focused review whose output is a changed graph and a changed control, tracked to closure rather than to a document.

How it implements the components¶

After-Action Pathway Update fills the retrospective, model-revision subset:

pathway_graph — revises the source-pathway-receptor map to include the route the incident actually took.
severable_link_inventory — updates which links proved cuttable in light of what the event exposed.
counterfactual_pathway_test — asks which single cut, applied earlier, would have prevented the outcome, and hands that to the controlling mechanisms.

It operates no control: physical severing is Barrier Interposition and Route Closure or Segmentation, the ongoing watch for the hazard re-routing is Risk Migration Review, and re-measuring what reaches receptors is Exposure Sampling Transect.

Instantiates: Exposure Pathway Interruption — it maintains the route model the whole archetype depends on, correcting it after each surprise.
Sibling mechanisms: Barrier Interposition · Multi-Barrier Verification Drill · Source Reduction Program · Buffer Zone Design · Contact Time Reduction · Exposure Sampling Transect · Filtration or Scrubbing · Pathway Reachability Analysis · Personal or Local Protective Control · Risk Migration Review · Route Closure or Segmentation · Sentinel Receptor Monitoring · Source Elimination or Substitution · Vector or Carrier Control · Ventilation or Flow Redirection

Notes¶

It is a learning step, not a control, so its entire value is realized only when the updated graph and severable-link inventory are pushed back into the mechanisms that build and verify barriers. An after-action update that stops at a report interrupts nothing; the loop closes only when a link is actually cut or a drill actually re-scoped.

References¶

[1] The after-action review — a structured retrospective comparing what was expected to what happened and why — originated in U.S. Army training practice and is now widely used for organizational learning; its value depends on being conducted to learn rather than to assign blame. ↩