Course 3 - Module 4 - Lesson 1
Permissions, logs, retries, escalation, and rollback as practical guardrails
Best Practices Without the Lecture Voice
Control access and record what happened
Permissions should match the job: reading a report does not require deleting reports. Give each workflow only the resources and actions it needs. Keep a useful log of the run, including its input reference, attempted steps, outcomes, and any human decision.
A log should help answer 'Did this action happen?' without exposing unnecessary private information. Store an internal record identifier where possible rather than copying the full record. Decide who can inspect the log and how long it needs to be kept.
Retry carefully when the outcome is uncertain
A retry is another attempt after a failure. If fetching a public page times out, a limited retry may be reasonable. If creating a record times out, first check whether the record was created. Repeating a successful write can produce a duplicate.
Use a unique job identifier so the destination can recognize repeated attempts where supported. This is often called idempotency: repeating the same request has the same intended effect rather than adding another copy. Set an attempt limit and delay; do not retry forever.
Escalate and recover with a named plan
Escalation means routing a case to someone able to resolve it. Missing permission, contradictory records, or an unclear write result should have a named owner. Include the evidence and what was attempted so the owner does not have to reconstruct the entire incident.
Rollback restores a previous state where possible. For a fictional label-update workflow, keep the old label and a change identifier before writing. Practice restoring a sample record, and keep a manual path available. A recovery plan only helps if someone can actually use it.
Tiny experiment
Describe how a label-update workflow handles a timeout after writing. Include a duplicate check, maximum attempts, escalation owner, and a way to restore the old label.
Confidence check
Which failures are safe to retry immediately, and which require checking whether the first attempt already changed something?