You Cannot Have Both Simultaneously
The ETTO Principle, also developed by Erik Hollnagel, states that people and organizations constantly make trade-offs between two competing goals:
- Thoroughness: Checking every log line before deploying. Writing 100% test coverage. Getting three approvals. Running a full regression suite. Reading the entire runbook. (Safe, but slow and expensive.)
- Efficiency: Pushing the fix now. Skipping the tedious approval meeting. Deploying directly to production because staging is "basically the same." (Fast and cheap, but riskier.)
Neither extreme is viable. Pure thoroughness means nothing ships. Pure efficiency means everything breaks. Every engineer, every day, makes dozens of ETTO trade-offs — usually unconsciously.
The Double Bind
Organizations create a toxic dynamic by punishing engineers for this unavoidable trade-off — but only in hindsight:
- Before the accident: "Why is this taking so long? We need to move faster. Be more efficient!"
- After the accident: "Why didn't you follow the full procedure? You weren't thorough enough!"
The engineer made the same trade-off both times. The only difference is whether it worked out. This is outcome bias — judging the quality of a decision by its result rather than by the information available at the time it was made.
ETTO and Blame
Understanding ETTO reframes "human error." When an engineer skips a step and an incident results, the instinct is to say they were careless. But if you examine the context — the deadline pressure, the 47 previous times the same shortcut worked fine, the implicit message from management that speed matters — the trade-off looks entirely rational.
The corrective action is not "tell engineers to be more careful." It is to change the system so that the thorough path is also the efficient path. Invest in faster test suites. Automate approvals for low-risk changes. Make the safe thing the easy thing.
Interviewers sometimes ask: "Tell me about a time you made a trade-off between speed and safety." This is an ETTO question in disguise. The strong answer acknowledges the trade-off explicitly, describes the context that made efficiency the rational choice at the time, and — if the outcome was bad — focuses on what systemic change would make the safe path faster, rather than promising to "be more careful next time."