Window calendar
Each window with its owner, coverage hours, and the result that counts as done.
Maintenance windowing
Make changes to a decision system in published windows, each with a named owner, a rollback plan, and notice to the people the change affects.
- 1 Evidence
- 2 Authority
- 3 Decision
- 4 Consequence
- 5 Challenge
- 6 Reconsideration
- 7 Correction acts here
Where it acts
At Correction, one of the seven stages every consequential decision passes through. Every change ships with an owner and a rollback plan, so a bad change can be undone.
Steps
Put the mechanism in motion
3 steps, in order. Check each one off as it is done; the records below show the work was done.
0 of 3 steps complete
Records this mechanism keeps
What a team running this mechanism keeps, and what each record is for.
Notice templates
Prewritten notices for high-, medium-, and low-risk changes, with the lead time and sender for each.
Fallback table
Each dependency, what the system does when it fails, and who is paged.
Reuse-ready snippets
Copy policy, audit, and incident language
Use these snippets in requirements, audits, and postmortems with the mechanism permalink.
Policy requirement
Policy requirement (MEC-03 Maintenance windowing) - Publish maintenance windows, each with a named owner, the result that counts as done, and the person who can order a rollback. - Set a minimum notice period for each risk tier, and notify the people affected before any change ships. Reference: https://ethotechnics.org/mechanisms/patterns/maintenance-windowing
Product requirement
Product requirement (MEC-03) - Each change ticket names its window and its owner. - During a window, people affected can see status updates and which fallback the system is using.
Audit evidence checklist
Audit evidence checklist (MEC-03) [ ] The window calendar lists each window's owner, coverage hours, and the result that counts as done. [ ] Each change was announced with the lead time its risk tier requires. [ ] Each dependency has a fallback, with the date it was last tested.
Postmortem trigger
Postmortem trigger (MEC-03) Trigger review when a change ships outside a window, without notice, or without a tested rollback.
Example usage
A two-week window for a screening model update
One scenario with each part of the mechanism in place.
How it plays out
A housing authority updates its tenant-screening model in a two-week window owned by the data team lead, who can roll back on her own authority if the denial rate moves more than two points. Applicants with pending cases get notice ten days ahead. If the credit-data feed fails, new applications go to a caseworker instead of being scored.
Anti-patterns
Common failure cases and counterfactuals
Each case passes on paper and fails in operation. The counterfactual shows what would have worked.
Maintenance without owners
A window is published with no owner and no one named to order a rollback, so a bad change stays in place while people argue about who decides.
Counterfactual: Each window names an owner, the result that counts as done, and who can order a rollback.
Exception: Two owners can share a window when the record says which one decides on rollback.
Silent maintenance
Changes ship without notice, so people meet new behavior with no warning and cannot tell an error from a change.
Counterfactual: The people affected get notice with lead time set by risk tier, and the fallback is named.
Exception: An emergency fix can ship before notice goes out, as long as the notice and an after-action record follow.
Diagnostics for this mechanism
Tools that size the risk this mechanism addresses.
Diagnostic
Delegation audit
Walks a team through one workflow against six questions and returns an exposure score, the permissions nobody can justify, and whether its decisions can be undone. Start here when the system keeps no decision records yet; use the record conformance checker once it does.
Cite this page · v1.2.1 · updated Oct 6, 2026 · CC BY-SA 4.0
APA
Ethotechnics Institute. (2026). Maintenance windowing (MEC-03). Ethotechnics Institute. https://ethotechnics.org/mechanisms/patterns/maintenance-windowing
MLA
Ethotechnics Institute. "Maintenance windowing (MEC-03)." Ethotechnics Institute, 2026, https://ethotechnics.org/mechanisms/patterns/maintenance-windowing.
Chicago
Ethotechnics Institute. "Maintenance windowing (MEC-03)." Ethotechnics Institute. Oct 6, 2026. https://ethotechnics.org/mechanisms/patterns/maintenance-windowing.
BibTeX
@misc{mechanism_maintenance-windowing,
title={Maintenance windowing (MEC-03)},
author={Ethotechnics Institute},
year={2026},
howpublished={Ethotechnics Institute},
url={https://ethotechnics.org/mechanisms/patterns/maintenance-windowing},
version={v1.2.1}
}
RIS
TY - WEB TI - Maintenance windowing (MEC-03) AU - Ethotechnics Institute PY - 2026 UR - https://ethotechnics.org/mechanisms/patterns/maintenance-windowing ER -