Skip to content

Common-Mode Escape Review

Structural review — instantiates Adaptive Barrier-Circumvention Response

Tests whether nominally independent barriers would actually fail together — against the same feature, data gap, assumption, or context — so apparent defense-in-depth is not a single point of failure wearing several hats.

Layered defense only helps if the layers fail independently — otherwise one adaptation defeats several at once and the "depth" was an illusion. Common-Mode Escape Review is the structural analysis that tests for exactly that. It maps which control layers rest on the same target feature, observation channel, assumption, supplier, implementation path, or failure mode, groups them by shared dependency, and stresses broad variant classes against each group to see whether one class would take a whole group down together. Its defining principle is that independence is purpose-relative and tested, never inferred from different product names or organizational owners — the review's whole job is to distinguish real diversity from correlated failure wearing a disguise.

Example

An aviation-security program reviews its layered passenger screening. On paper the layers look independent: document check, watchlist match, behavioral referral, physical screening, and canine detection. The review maps each layer's dependencies and finds that the document check, the watchlist match, and behavioral referral all rest partly on the same underlying feature — identity resolving correctly against the same watchlist data. Physical screening and canine, by contrast, engage a different feature entirely — the object rather than the identity.

The structural conclusion, stated at the level of features rather than any operational method: for an escape class that turns on identity, three "independent" layers are really one dependency, and would degrade together — a classic common-mode failure. For that class, genuine independence comes only from the object-engaging layers. The review's output is a verdict, not a score: either add a layer that engages a genuinely different feature, or name an owner who explicitly accepts the residual risk. A headcount of five layers never revealed that three of them were one.

How it works

  • Map dependencies and target features per layer. What signal, data source, assumption, supplier, or operator does each control actually rest on?
  • Group by shared dependency. Cluster layers that ride the same feature or channel, regardless of how differently they are branded.
  • Stress variant classes against the groups. Ask, per plausible escape class, whether one adaptation defeats an entire group at once.
  • Require diversification or owned residual risk. Every material common mode is either diversified away or assigned to a named owner who accepts it.

Tuning parameters

  • Dependency taxonomy — what counts as a shared dependency: feature, data, supplier, implementation, operator, context. A broader taxonomy catches subtler common modes but flags more to adjudicate.
  • Independence-test rigor — independence inferred from names versus tested against variant classes. Rigor is the entire point, and it costs effort.
  • Variant-class breadth — how many escape classes the groups are stressed against. Broader finds more shared failures but risks chasing implausible ones.
  • Materiality threshold — how large a common mode must be before it demands diversification rather than accepted residual risk.
  • Residual-risk ownership — whether every unaddressed common mode gets a named owner. Enforcing this adds accountability and process weight.

When it helps, and when it misleads

Its strength is dissolving defense-in-depth theater: the discovery that five layers are one dependency in a trench coat, which no count of controls could surface. It converts "we have many layers" into the far more useful "we have N genuinely independent layers against class X."

Its failure mode follows from its core truth — independence is purpose-relative, so layers independent against one variant class can be common-mode against another, and a single portfolio-wide "independence score" misleads.[1] The review can be gamed by stressing only the classes the layers already handle, and run backwards it is used to certify a portfolio ("passed common-mode review") rather than to find dependencies. The discipline is to test independence per plausible variant class, and to treat different names and owners as no evidence of independence whatsoever.

How it implements the components

  • control_portfolio_independence_map — its central output: which layers share a target feature, observation channel, assumption, supplier, or failure mode, tested against variant classes rather than assumed.
  • side_effect_and_escape_surface — it maps the shared blind spots — the escape surface common across layers — that a single adaptation could exploit to bring a whole group down.

It does not generate the novel adaptation hypotheses it stresses (that's Adverse Adaptation Red Team), record the coverage claim per cell (that's Barrier Coverage Matrix), or design the more-independent replacement portfolio (that's the Layered Independent-Control Design Workshop). This review proves whether layers fail together; siblings imagine, record, and redesign.

Notes

Independence is not a property of a portfolio; it is a property of a portfolio against a specific variant class. Two layers can be independent against one escape class and common-mode against another, so a common-mode review is never finished — it is re-run whenever a new class appears. A "passed" verdict is always scoped to the classes actually tested, and reading it as unconditional is the exact error the review exists to prevent.

References

[1] Common-cause (or common-mode) failure — reliability engineering's term for redundant components that fail together because they share a hidden dependency — is the precise hazard here: an adaptive population needs only to defeat the shared feature, not each layer separately, so nominal redundancy provides far less protection than a layer count suggests. ↩