Blameless postmortems are a 50-year-old fix for a cognitive bug. Not kindness, accuracy.
In 1967, two psychologists named Edward Jones and Victor Harris ran an experiment that should be taped to the wall of every incident-review room. They handed college students an essay either praising or criticizing Fidel Castro and asked a simple question: what does the person who wrote this actually believe? When the students thought the writer had chosen the position, their answer was unsurprising, a pro-Castro essay meant a pro-Castro author. But Jones and Harris also ran the condition that matters. They told a second group, plainly and in advance, that the writer had been assigned the position. No choice. The experimenter picked which side, and the student wrote to order, the way a debate-class student argues a side drawn from a hat.
It changed almost nothing. The students who knew the position was assigned still judged the writer who praised Castro as genuinely more sympathetic to Castro than the one who attacked him. The situation fully and explicitly explained the behavior, the subjects had been told so, and they reached past it for the person's character anyway. That result, that we infer disposition from behavior even when we know the situation caused it, is the reason your postmortems lunge for “the engineer was careless” before anyone has finished describing what happened. And it is the reason that asking everyone to “just be more understanding” has never once fixed it.
Psychologists call this the Fundamental Attribution Error, a name Lee Ross gave it in 1977, and it is about as close to a law as social psychology owns. When we explain other people's behavior, we systematically overweight disposition (character, competence, carelessness) and underweight situation (the environment, the constraints, the pressures, the system that made the behavior likely). The whole discipline's hard-won lesson, accumulated over decades of experiments, is that context shapes conduct far more than our intuitions credit, and that those intuitions get the balance exactly backwards.
The Jones and Harris result adds the property that makes this practical rather than academic: the error is near-automatic, and it does not yield to merely knowing better. It's a fast, reflexive, System-1 judgment, disposition is the default inference, fired before the deliberate mind gets a vote, which is why you can be handed the situational explanation on a plate and still convict the person. Hold onto that, because it quietly destroys the most common advice about postmortems. If the bias survived subjects being told the writer had no choice, it is certainly going to survive your engineers resolving to be nicer about the outage.
Now look at an ordinary postmortem through that lens. The instinctive version reaches immediately for disposition: ops dropped the ball, the on-call engineer was careless, he should have known. That is not the people in the room being unusually cruel. It is the Fundamental Attribution Error firing on schedule, the cognitive default doing precisely what it does to everyone. And the blameless-postmortem movement, whether or not its advocates frame it this way, is a direct structural correction of that bug.
I want to be honest that this connection is not a discovery, the safety-science world has been building it for half a century. In 1990, James Reason drew the line between the “person approach” to error, which blames the operator at the sharp end, and the “system approach,” which hunts for the latent conditions that set the operator up; the person approach is the attribution error institutionalized, the system approach is its correction. Sidney Dekker's “new view” of human error, translating the work of Jens Rasmussen, Erik Hollnagel, and David Woods, insists that “a human error problem is actually an organizational problem,” and that the investigator's real job is to put the operator's actions back into the flow of events and ask why those actions made sense to that person, at that moment, with the information they had. Aviation institutionalized no-blame incident reporting decades ago; medicine's landmark 1999 report To Err Is Human argued that hospital errors were overwhelmingly systemic rather than the work of bad apples.
And in 2012, John Allspaw wrote the canonical engineering version for Etsy, and he put his finger on the exact bug without ever naming it. Blame, he wrote, “is founded in the belief that individuals, not situations, cause errors.” Read that sentence again: it is the Fundamental Attribution Error, stated in a tech blog post in 2012, forty-five years after Jones and Harris measured it in a room full of students reading about Castro. The practice had been reaching for the bias the whole time. It just hadn't connected itself to the name, and the measurement, underneath.
Naming the bias buys you something specific, and it ends the most tedious argument in this whole space, the one about whether blamelessness is “soft.” Most defenses of the blameless postmortem are, at bottom, defenses of niceness: don't make people feel bad, protect psychological safety, be humane. All true, and all beside the point, because anyone who wants to argue back can simply say “accountability matters” and they're not wrong.
The real case for blamelessness is that it is more accurate, and accuracy is an argument you can actually win. The dispositional fix, the bad-apple removal, doesn't merely feel harsh; it leaves the cause untouched. If a system's tooling, alerting, staffing, and deadline pressure made a given error not just possible but likely (even the path of least resistance, even the sensible move in the moment) then firing or retraining the particular human who was standing there when it went off changes nothing about the trap. The next person inherits it, and the failure reproduces itself on schedule. You have pressed a reset button on the same bug and called it justice. And it does worse than nothing, because blame also poisons the one resource an incident review runs on, which is information. People who expect to be blamed stop reporting, stop volunteering the embarrassing detail that turns out to be load-bearing, and the organization goes blind exactly where it most needs to see. Aviation and medicine learned this at great cost and even gave the human price a name, the “second victim,” the clinician so damaged by being blamed for a systemic failure that they leave the profession, a phenomenon Albert Wu described in 2000. So blamelessness is not a favor you do the engineer. It is the only way to attribute a failure to the thing that actually produced it, which is the only way to stop it from happening again.
There's a famous corollary, and it's where most popular treatments quietly get the science wrong, so it pays to get it right, because the honest version is sharper than the folklore. The corollary is the actor-observer asymmetry, named by Edward Jones and Richard Nisbett in 1972: the claim that we explain our own behavior by the situation and others' by their character. It's the “same engineer, opposite verdicts” hypocrisy, the person who says “the runbook was wrong” about her own outage says “he should've known better” about yours.
It's a satisfying story, and the broad, universal version of it is mostly false. Bertram Malle's 2006 meta-analysis of 173 studies found the average asymmetry is essentially zero, it simply isn't the sweeping law of human nature it's folk-cited as. But the same analysis found it survives, consistently, in one specific place: negative events. For failures, mistakes, things that went wrong, the asymmetry is real and reliable, people genuinely do excuse their own and convict others'. And a negative event is exactly what an incident is. So the hypocrisy you've watched play out in postmortems isn't a myth; it's scientifically grounded in the one domain where it actually holds, which happens to be the worst possible domain for it to hold, because it's the domain you run postmortems in. The honest move is to claim it precisely where it's true and not an inch further: not “humans always excuse themselves,” but “for failures specifically, this bias is real, and your review needs a referee for it.”
Two more things the genre routinely botches, and getting them right is what separates a usable argument from a hype piece.
First, the Fundamental Attribution Error is well-replicated as a finding, but it is not a hardwired universal of the species. Cross-cultural work, Michael Morris and Kaiping Peng in 1994, later synthesized in Richard Nisbett's The Geography of Thought, found that East Asian observers spontaneously attend to situational and contextual factors far more, and show a markedly smaller correspondence bias, than Western ones. The “blame the individual first” reflex is, to a meaningful degree, a Western individualist attentional habit rather than pure cognition. That reframes the whole practice in a useful way: a blameless postmortem isn't fighting human nature so much as teaching your organization an attentional skill that other cultures cultivate by default, which is also why installing it can feel so strange and effortful, like learning to look where you've been trained your whole life not to.
Second, the strong version of this argument refuses to lean on the dramatic classics that the weaker versions love. You will see “the situation explains everything” essays reach for Philip Zimbardo's Stanford Prison Experiment; don't, because it has been methodologically discredited, coached guards, demand characteristics, and a long history of failed replication, laid out in detail by Thibault Le Texier in 2019. The case for situational thinking does not need it and is weakened by association with it. It rests perfectly well on the evidence that actually survived scrutiny: the clean, replicated correspondence bias of Jones and Harris, the cross-cultural attention data. An argument is strongest when it uses only the parts that held up.
So what do you actually do? The single most important consequence of “the bias survives knowing about it” is that you cannot fix your postmortems by asking people to be better people. Good intentions lose to a System-1 default every single time. The correction has to be structural, a procedure that forces the situational attribution the bias suppresses, whether or not anyone in the room is feeling generous that afternoon. Concretely, three things:
The structure carries the load precisely because the goodwill can't.
But there is a line, and the honest version of blamelessness is loud about it, because critics will otherwise pounce and they'll be right to. Blameless is not accountability-free. Dekker's own Just Culture draws the distinction sharply: a blameless default for honest error is not a blanket amnesty for genuine recklessness or willful violation, and “the system made this likely” is emphatically not “no one is ever responsible for anything.” You still close competence gaps; you still deal with someone who knowingly bypassed a safeguard. The claim is narrow, and it's defensible exactly because it's narrow: situational attribution as the default for honest error, plus actually repairing the system that produced it. Not “nobody's ever to blame.”
Here's the reframe, and it costs nothing but a change of register. Stop defending the blameless postmortem as kindness, because that's the argument you lose, someone will always raise accountability, and they'll have a point. Defend it as accuracy, because that's the argument you win: you are correcting a measured, replicated, fifty-year-old error in human perception that, left to run, makes you fix the person and re-ship the system that will reproduce the failure with the next person who touches it.
The blameless postmortem is not a manners rule and it is not a hug. It is a 1967 experiment about Castro essays, operationalized, a procedure built to override a known bug in how humans see each other, so that you can finally see the thing that actually broke. The next time someone in the room reaches for “they should have known better,” you don't have to debate whether that's a nice thing to say. You can point out that it's most likely wrong, and then ask the only question that has ever fixed anything: what made it make sense at the time?
A system-approach postmortem needs the flow of events, not the actor's account of it.
Dekker's question, why did it make sense to them at that moment, with the information they had?, can only be answered if you can reconstruct what the operator actually saw and did. And the essay's sharpest point is that blame poisons the information a review runs on: the actor under suspicion is exactly the wrong source for the record. That gets concrete with autonomous agents, where the post-incident story is written by the thing being investigated. Chain of Consciousness anchors an agent's actions to a tamper-evident record, so a blameless, system-approach review can replay the real flow of events instead of relying on a self-defensive summary.
See a verified action chain · Hosted Chain of Consciousness
pip install chain-of-consciousness · npm install chain-of-consciousness