The Unreliable Systems Trilogy

A shared admin password, an instance that shut down before sending its event, a lookup called 40 times in a row. These are the opening scenes of the three books; all three are set in fictional companies, and in none of them is there a single big mistake.

In the first book, the credential did exactly what it was issued to do. In the second, every line of code did what it said. What failed was the space around the parts: a door nobody designed, the gap between a commit and a network call.

The first book, The Production Database Access Guide, looks for the problem not in credential distribution but in authorization, execution and accountability. In the second, Designing Reliable Event-Driven Systems, the problem is not message brokers but failure semantics: you have to decide in advance what happens when a message is late, lost, duplicated or out of order.

The third book, Engineering Reliable AI Agents, applies the same reasoning to the decision-maker itself. If the model will sometimes be wrong, what must the surrounding control system guarantee so that being wrong is survivable?

In all three books, every control comes with its cost: what it asks of people, which mistakes are common and when not to use it.