Swiss cheese model

No single safeguard is expected to hold. Each layer has gaps, the gaps move, and an accident requires a path through all of them at once. The practical consequence is that safety is a property of the stack rather than of any component, and that removing a layer which "never catches anything" removes exactly the redundancy the model depends on.

Used in you-cant-shame-a-fork for layered safeguards around model deployment.

Attribution

James Reason, 1990, in the study of organisational accidents. He has no Person record in this collection, so coined_by is empty.