We assumed the audience for a postmortem didn't matter to how honestly it got written. An anonymous survey told us we were badly wrong.

Every postmortem at Helix has always been visible company-wide by default, including to the author's own manager and skip-level. We considered this a feature — full transparency, nothing hidden. An anonymous internal survey suggested it was quietly undermining the honesty we were trying to protect.

What the survey found

We asked engineers, anonymously, whether they had ever softened or omitted a detail in a postmortem specifically because their manager or skip-level would read it. 44% said yes, at least once. That number alone justified taking the question seriously — nearly half of our engineers had, at some point, chosen self-protection over completeness in a document explicitly designed to reward completeness.

"I wrote 'the deploy process didn't catch this' instead of 'I skipped the canary step because I was behind schedule,' and both sentences are technically true. Only one of them is useful to the next person."

What we changed

We didn't remove manager visibility — that would just move the problem, since managers legitimately need to know what happened in their org. Instead we added an optional, genuinely anonymous "unfiltered addendum" channel, reviewed only by a rotating peer facilitator who scrubs identifying detail before folding relevant system insights back into the public postmortem.

postmortem_addendum_process
visibility: facilitator only (rotates monthly, never the author's manager)
purpose: >
  Capture anything the author felt unsafe including in the public
  version. Facilitator extracts SYSTEM-relevant insights, strips
  identifying detail, and merges them into the public doc within
  48 hours. Original addendum is deleted after merge, not archived.

What came out of the addendum channel in its first quarter

Of the postmortems that used it, roughly two-thirds contained at least one detail that materially changed the public root cause once merged back in — not dramatic revelations, mostly small honest admissions like "I was rushing" or "I didn't fully understand this system before touching it," details people wouldn't write with their manager's name in the visibility list, but that made the eventual fix noticeably more targeted.

  • Even a strong blameless culture can be undermined by simple audience visibility — check who's actually reading before assuming honesty.
  • An anonymous, facilitator-mediated addendum channel can recover details a fully-visible document will never contain.
  • Don't remove legitimate manager visibility to fix this — add a genuinely separate, low-stakes channel instead.