We audited our own process and kept about half of it.

Where it breaks

Logs are the cheapest witness you have. Before anyone proposes a theory, we turn on debug logging on a copy of the site, repeat the problem once and read what it left behind. Half the time the answer is sitting there in plain words, and the other half we at least know which theories to stop discussing.

Permissions tend to drift. A role that made sense at launch picks up one extra capability each year until nobody can say who is allowed to do what. We list the roles, list the people and compare them with what the job actually needs. It is a dull hour, and it has found more real problems than most scanners.

  • Write down what you expect before you measure
  • Change one thing at a time
  • Keep the numbers next to the commit