A hierarchy of incorrectness
A couple of months ago, I watched this video where Byron Cook is interviewed alongside Carina Hong. Around minute 4, Byron describes his work as one where “an incorrect answer is a crime”.
The phrase stuck. I started thinking about how the idea generalizes beyond crime and proofs to all the forms of incorrectness we deal with daily in cloud. And how a simple framing could help me explain to leadership and peers when principled engineering pays off, and when it doesn’t.
I landed on five tiers, each describing a different consequence of incorrectness and a different price to pay, from the least severe to the most severe: choice, chore, cost, churn, crime. C5 for us cloud geeks.
In C5, bugs move silently between tiers, usually upwards. A clean Choice last quarter starts costing time and becomes a Chore. A Chore that triggers an SLA penalty becomes a Cost. A Cost that drives a major customer to a competitor is now Churn. Churn that catches regulators’ attention is at the gates of Crime. The strategic skill we must gain isn’t labelling bugs today; it’s recognizing when a bug is headed upwards.
So far, no cloud provider executive has served prison time anywhere in the world for a software defect or system failure. Bugs have lived in negligence territory: accidents, civil at most. But AI, the good accelerator it has proven to be, is accelerating bug escalation too. It’s worth asking whether deploying AI agents without solid guardrails could now push routine bugs from negligence into recklessness, which is the threshold where regulators start treating failures as something more than accidents.1
Cloud and large-scale distributed system companies operate at all five tiers simultaneously: billing at Crime, customer-facing APIs at Churn, SLAs at Cost, internal tools at Chore, experimental features at Choice. C5 helps me know which defect sits where, predict which way it might move, and make a recommendation on how to invest in correctness accordingly. The cost of not investing is rising, because AI is amplifying everything it touches and shifting the legal analysis at the top.
So, what bugs really matter? The ones climbing up the pyramid.
Deep dive on the five tiers
CRIME Who pays: company and executives. Escalates from: Churn that catches regulators’ attention.
When incorrectness is a Crime, bugs sit in code paths where wrong answers carry legal exposure: billing arithmetic, access control, cryptographic correctness, audit logging. The defects that raise regulators’ eyebrows are not the ones that cause downtime. They are the ones that produce wrong but plausible outputs at scale. Oracle Cloud was investigated by the FBI in 2025 following a 2021 CVE that sat unpatched for years and exposed 6M records across 140k tenants. Alibaba Cloud executives were summoned by Chinese authorities in 2022 following an incident that left a 1B-record police database publicly accessible for fourteen months. In both, the bug was old, the exposure was silent, and the discovery happened long after the harm.
The verification techniques that matter here are the ones that produce artifacts of correctness a regulator could read. SMT solvers, theorem provers, and tools like Lean and Dafny produce machine-checkable proofs of correctness. When the question becomes “did you know this could fail?”, the difference between “we tested” and “we proved” is the difference between negligence and a defensible posture.
CHURN Who pays: customers. Escalates from: Cost that drives a major customer to a competitor.
When incorrectness is Churn, bugs sit on the surfaces customers actually touch: SDKs, public APIs, developer documentation, the contracts that integrations depend on. The defects that drive Churn are not the ones that crash the service. They are the ones that quietly violate expectations until the customer decides somebody else is more reliable. In February 2026, Huawei Cloud’s C++ SDK shipped a broken configuration; the incident drew 1.6M views on Zhihu and nearly 1,300 reactions on GitHub, leading Huawei to issue a public apology citing CI process violations. In October 2025, Azure Front Door went dark for nine hours when a configuration change slipped past its safety checks, taking Microsoft 365 and Xbox with it. Neither defect was catastrophic in isolation. Both eroded customer trust at scale.
The verification techniques that matter here are the ones that catch contract violations before customers do, like property-based testing and schema validation. The point at this tier is not proof. The point is coverage of what the customer expects. The real fix is end-to-end conformance: customer-facing documentation, configuration, and code, all kept consistent.
COST Who pays: business. Escalates from: Chore that triggers an SLA penalty.
When incorrectness is a Cost, we’ve entered classic SRE nightmare territory and triggered the financial machinery: SLA penalties, refund credits, emergency on-call. Engineers scramble, money bleeds, but the relationship survives because the response is bounded and competent. This is where most “bad” cloud incidents actually live. On October 20, 2025, AWS DynamoDB suffered a multi-hour control plane outage in us-east-1 with a long recovery tail when a latent race condition in DNS automation emptied a regional endpoint; 197 SaaS providers including Slack, Atlassian, Snapchat, and Coinbase cited AWS as the cause of their own outages. On June 12, 2025, Google Cloud went down globally for nearly three hours when a null pointer in untested code, unprotected by feature flags, was triggered by malformed metadata propagated globally through Spanner.
The verification techniques that matter here are the ones that catch race conditions and crash paths before they ship. Distributed protocol verification with TLA+ and P catches consensus and replication races. Deterministic simulation testing replays the same workload across millions of schedules to catch the rare timing interactions traditional testing misses. Bounded model checkers like CBMC catch null pointer dereferences in C and C++ binaries. The point at this tier is not zero defects. The point is catching the specific defect that takes you off the air.
CHORE Who pays: engineers. Escalates from: Choice that started costing time.
When incorrectness is a Chore, bugs should never reach customers. They consume engineering time. Tickets get filed, requiring patches and pushing for retrospectives. The work is invisible outside the company because the cost is paid in engineer-hours, not in revenue or customer trust. Most cloud development lives here: flaky tests on non-critical paths, weak internal tooling, configuration drift, dependency rot, technical debt. None of this is dramatic. But it compounds. A team that lives perpetually at Chore tier loses its best engineers to teams that don’t.
The verification techniques that matter here are the ones with low per-defect cost and broad applicability. Strong type systems eliminate entire categories of defects at zero runtime cost. Static analyzers catch regressions that flaky tests miss. Fuzzing finds the inputs nobody thought to write a test for. This is also where LLM-assisted code review and AI-generated test suites might earn the highest return on investment. The point at this tier is far from proof. The point is raising the floor.
CHOICE Who pays: no one, if managed well. Escalates from: this is the entry point.
When incorrectness is a Choice, the bugs exist by design. We knew they existed, we weighed the cost of fixing vs. the cost of shipping, and we shipped. The MVP with a known limitation to validate a market hypothesis. The configuration that works for 99% of customers and fails politely for the rest. The optimization deferred to next quarter because this quarter has bigger fish. When these decisions are made well, the bug never manifests in a way that hurts anyone, and no one pays the price.
The discipline at this tier is twofold. Making the trade-off well requires judgment. Preserving it well requires documentation and monitoring. Choice-tier defects need to be tracked in an explicit register of accepted technical debt and instrumented with metrics that watch the failure mode. The risk at Choice tier is not the bug itself, but forgetting the bug exists; because a Choice forgotten becomes a Chore, and a Chore forgotten becomes a Cost. The point is catching the moment when the conditions that justified the trade-off no longer hold.
- The regulatory landscape is evolving differently across geographies. China has the harshest statutes on paper, but enforcement against major platform executives has so far been administrative rather than criminal. Europe is hardening operationally through DORA and NIS2, and France is already testing criminal complicity theories against platform CEOs. The United States is moving the opposite way. ↩︎