The script Atlassian ran on the morning of April 5, 2022, had been through the proper checks.
It had been peer reviewed. It had been tested in staging. It had already run once in production, against 30 customer sites, and removed an old app from them without trouble. The second run was meant to do the same for 883 more.
But between the team that asked for the job and the team that did it, the list had changed meaning. Instead of the ID of the old app on each site, it now held the ID of each site itself. The review, Atlassian wrote afterwards, “focused on which endpoint was being called and how. It did not cross-check the provided cloud site IDs.” The staging test couldn’t catch it either, because those IDs didn’t exist in staging.
The script started at 07:38 UTC and finished at 08:01. It deleted 883 sites belonging to 775 customers, some of whom were without their tools for up to two weeks. The case has the rest.
Atlassian had a second pair of eyes. They were looking at the wrong thing.
Two people, two jobs
The four-eyes principle says that a risky action needs two people: one to do it and one to check it. Its older cousin, segregation of duties, splits a process so that the person who does something isn’t also the person who records, approves or reconciles it.
Without either, one person’s slip goes straight through. Before Knight Capital’s trading disaster in 2012, one technician copied new code onto the firm’s order-routing servers and missed one of eight. According to the Securities and Exchange Commission, Knight “did not have a second technician review this deployment,” and had no written procedure requiring it.
Without segregation, one person’s deception can go through too. Barings, a London bank with more than 230 years in merchant banking, collapsed in 1995 after losses run up by Nick Leeson, its trader in Singapore. In a summary of the official inquiry, Australia’s central bank listed the first failing: “a lack of separation between the front and back offices.” As general manager, Leeson “effectively controlled both sides of the trading operation,” which let him trade without authority and then alter the records of what he had done. Secret accounts hid the losses. Among the inquiry’s lessons: “clear segregation of duties is fundamental to any effective control system.”
What the second pair of eyes needs
A second check is only as good as what it looks at. Atlassian’s review followed its standard process, and that process looked at how the code called the system, not at the data it was fed. The first fix it set out in its review was a change to the system itself: route every deletion of customer data through a “soft delete,” so the data can still be recovered for a while.
Two other things matter. The checker needs to be independent of the doer, not a colleague nodding along to finish the day. And the check has to happen where it can still stop something, before the action takes effect, not in a report read afterwards.
The shared account
Imagine a small charity where the treasurer both pays the bills and reconciles the bank statement each month. She is honest, and has been for years. One month a supplier’s bank details are changed by a convincing email, and three payments go to a stranger. The reconciliation looks fine to her, because she is reconciling against the same wrong details she typed in.
The charity’s fix costs almost nothing. A second trustee now approves any change of payee details, and someone other than the treasurer reads the bank statement each month. Neither step accuses anyone of anything.
Four eyes and an agent
AI coding agents make it easy to collapse the roles again. One person can now ask an agent to write a change, ask another agent to review it, and press merge, all without a second human looking.
Software platforms already have a guard for this, built for people. GitHub lets a repository require that “the most recent reviewable push must be approved by someone other than the person who pushed it.” When an agent pushes code on someone’s behalf, the useful second pair of eyes belongs to a person who didn’t direct that agent, looking at what can go wrong: which records the change touches, which IDs it uses, what it deletes.
A second model reviewing the first can help as an extra filter. It is a different check from a second person who answers for the result.