Common-Mode Escape Review¶
Structural review — instantiates Adaptive Barrier-Circumvention Response
Tests whether nominally independent barriers would actually fail together — against the same feature, data gap, assumption, or context — so apparent defense-in-depth is not a single point of failure wearing several hats.
Layered defense only helps if the layers fail independently — otherwise one adaptation defeats several at once and the "depth" was an illusion. Common-Mode Escape Review is the structural analysis that tests for exactly that. It maps which control layers rest on the same target feature, observation channel, assumption, supplier, implementation path, or failure mode, groups them by shared dependency, and stresses broad variant classes against each group to see whether one class would take a whole group down together. Its defining principle is that independence is purpose-relative and tested, never inferred from different product names or organizational owners — the review's whole job is to distinguish real diversity from correlated failure wearing a disguise.
Example¶
An aviation-security program reviews its layered passenger screening. On paper the layers look independent: document check, watchlist match, behavioral referral, physical screening, and canine detection. The review maps each layer's dependencies and finds that the document check, the watchlist match, and behavioral referral all rest partly on the same underlying feature — identity resolving correctly against the same watchlist data. Physical screening and canine, by contrast, engage a different feature entirely — the object rather than the identity.
The structural conclusion, stated at the level of features rather than any operational method: for an escape class that turns on identity, three "independent" layers are really one dependency, and would degrade together — a classic common-mode failure. For that class, genuine independence comes only from the object-engaging layers. The review's output is a verdict, not a score: either add a layer that engages a genuinely different feature, or name an owner who explicitly accepts the residual risk. A headcount of five layers never revealed that three of them were one.
How it works¶
- Map dependencies and target features per layer. What signal, data source, assumption, supplier, or operator does each control actually rest on?
- Group by shared dependency. Cluster layers that ride the same feature or channel, regardless of how differently they are branded.
- Stress variant classes against the groups. Ask, per plausible escape class, whether one adaptation defeats an entire group at once.
- Require diversification or owned residual risk. Every material common mode is either diversified away or assigned to a named owner who accepts it.
Tuning parameters¶
- Dependency taxonomy — what counts as a shared dependency: feature, data, supplier, implementation, operator, context. A broader taxonomy catches subtler common modes but flags more to adjudicate.
- Independence-test rigor — independence inferred from names versus tested against variant classes. Rigor is the entire point, and it costs effort.
- Variant-class breadth — how many escape classes the groups are stressed against. Broader finds more shared failures but risks chasing implausible ones.
- Materiality threshold — how large a common mode must be before it demands diversification rather than accepted residual risk.
- Residual-risk ownership — whether every unaddressed common mode gets a named owner. Enforcing this adds accountability and process weight.
When it helps, and when it misleads¶
Its strength is dissolving defense-in-depth theater: the discovery that five layers are one dependency in a trench coat, which no count of controls could surface. It converts "we have many layers" into the far more useful "we have N genuinely independent layers against class X."
Its failure mode follows from its core truth — independence is purpose-relative, so layers independent against one variant class can be common-mode against another, and a single portfolio-wide "independence score" misleads.[n1] The review can be gamed by stressing only the classes the layers already handle, and run backwards it is used to certify a portfolio ("passed common-mode review") rather than to find dependencies. The discipline is to test independence per plausible variant class, and to treat different names and owners as no evidence of independence whatsoever.
How it implements the components¶
control_portfolio_independence_map— its central output: which layers share a target feature, observation channel, assumption, supplier, or failure mode, tested against variant classes rather than assumed.side_effect_and_escape_surface— it maps the shared blind spots — the escape surface common across layers — that a single adaptation could exploit to bring a whole group down.
It does not generate the novel adaptation hypotheses it stresses (that's Adverse Adaptation Red Team), record the coverage claim per cell (that's Barrier Coverage Matrix), or design the more-independent replacement portfolio (that's the Layered Independent-Control Design Workshop). This review proves whether layers fail together; siblings imagine, record, and redesign.
Related¶
- Instantiates: Adaptive Barrier-Circumvention Response — it certifies whether a control portfolio's independence is real or nominal, the precondition for escape resilience.
- Consumes: Barrier Coverage Matrix supplies the correlated-coverage flags this review investigates and either confirms or clears.
- Sibling mechanisms: Adverse Adaptation Red Team · Barrier Coverage Matrix · Layered Independent-Control Design Workshop · Champion–Challenger Barrier Revalidation · Conditional Control-Rotation Protocol
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Tests whether nominally independent barriers would actually fail together — against the same feature, data gap, assumption, or context — so apparent defense-in-depth is not a single point of failure wearing several hats, making its operative form a bounded evaluation of existing evidence or work that produces a finding or disposition.
Independent corroboration: The frozen evidence defines Common-Mode Escape Review as 'Tests whether nominally independent barriers would actually fail together — against the same feature, data gap, assumption, or context — so apparent defense-in-depth is not a single point of failure wearing several hats', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Reliability engineering supplied the common-mode test of whether multiple barriers share one feature or assumption and therefore fail together.
Related originating lineages:
- Biology & Ecology — Resistance management supplies the evolutionary-selection account of one adaptation escaping controls with a common target.
- Security Studies & Intelligence Analysis — Defense-in-depth review contributes adversarial testing of nominally independent safeguards.
Review resolution: Both reviewers agree on engineering_design as primary. Reading the source mechanism confirms that its defining operation belongs to that lineage; the final record retains biology_ecology, security_intelligence only where it materially formed the mechanism and keeps present-day application breadth separate from provenance.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
Independence is not a property of a portfolio; it is a property of a portfolio against a specific variant class. Two layers can be independent against one escape class and common-mode against another, so a common-mode review is never finished — it is re-run whenever a new class appears. A "passed" verdict is always scoped to the classes actually tested, and reading it as unconditional is the exact error the review exists to prevent.
[n1] Common-cause (or common-mode) failure — reliability engineering's term for redundant components that fail together because they share a hidden dependency — is the precise hazard here: an adaptive population needs only to defeat the shared feature, not each layer separately, so nominal redundancy provides far less protection than a layer count suggests. ↩