Engineering Standard

Every new capability is scoped for what it exposes before it's scoped for what it enables. In practice: before a feature is built, the question asked first is what data or access it touches, not what it lets a user do. Threat modeling happens at design time, not as a review gate before release.

No architectural decision ships without a corresponding record in the format defined by the Decision Framework. A pull request or design that changes architecture without an accompanying decision record is treated as incomplete, not as documentation debt to address later.

Provable, boring foundations are chosen over novel ones by default. Departing from that default requires the decision record to explicitly justify why the novel approach was necessary — novelty is never assumed to justify itself.

AI is adopted into a workflow only where it measurably improves something OSG already does, and only where its use doesn't obscure how a resulting decision was actually made. AI-assisted output used in a decision record is marked as such, consistent with the same evidence-labeling standard applied to founder statements versus synthesis elsewhere in OSG's documentation.

Reliability and incident response are specified as part of a system's initial requirements, not added once something breaks in production. A system without a defined failure and recovery behavior is not considered complete, regardless of whether its primary function works.

Every system has an explicit, named owner and a defined decision right — who can change it, and under what process. Ambiguity about ownership is treated as a defect to resolve immediately, not a detail to sort out once it becomes a problem.