The Context
Picture this. It's Tuesday at 2 AM. Your main production cluster just went down. The incident channel is exploding. Three clients are threatening to terminate contracts by morning. Your VP of Engineering is already on a call with the biggest account, buying time you don't have.
And then you discover what happened. Your senior infrastructure lead - the person who built half the platform, who holds the keys to every deployment pipeline, who is the only one who truly understands the legacy migration layer - made a catastrophic mistake. Not a typo. Not bad luck. A genuine lapse in judgment. They bypassed the staging environment, pushed directly to production, and brought everything down.
In any normal circumstance, the answer is clear. Serious violation of protocol. Documented. Addressed. Possibly grounds for termination. Your company has policies for exactly this situation. The playbook is written. Justice has a clear path.
But this isn't a normal circumstance. This is a crisis. And in crisis, the playbook catches fire along with everything else.
You need this person - right now, in the next four hours - to fix what they broke. They are the only one who knows the system deeply enough to restore it. Fire them on principle, and you don't just lose an employee. You lose the operation.
This is the moment where leadership stops being about vision statements and quarterly goals. This is where it becomes about one brutal question: do I optimize for what's right, or for what keeps the system alive?
Most leadership books won't touch this scenario. They'll talk about "accountability cultures" and "holding the line." And they're right - in peacetime. But you're not in peacetime. You're standing in front of a burning building, and the arsonist is also the only firefighter you've got.
This scenario isn't theoretical. It plays out in some form every week in organizations around the world. The scale differs - sometimes it's a production outage, sometimes it's a key sales executive who alienated a partner right before a critical deal closure, sometimes it's a project manager who botched a client deliverable but is the only person who understands the scope of five intertwined projects. The pattern is always the same: the person who caused the problem is also the person you need to solve it.
And every time, the leader faces the same question. Not "what's the right thing to do?" - that's easy to answer from a distance. But "what's the right thing to do right now, with these constraints, when the cost of the 'right' answer might be higher than the cost of the 'wrong' one?"
The Impossible Choice
In moments of chaos, the leader's primary goal isn't to be "fair." It's to prevent the system from collapse. This is a truth that sounds uncomfortable because we've been trained to believe that fairness and effectiveness always align. They don't. Not always. Not in extremis.
When structure is crumbling, people are scarce, and processes are burning, the priority shifts from ideal decision purity to maintaining manageability. The leader who understands this isn't abandoning their principles - they're exercising a higher-order principle: the survival of the system that makes all other principles possible.
Think of it like triage in a field hospital. The doctor doesn't treat patients in order of who arrived first or who "deserves" care the most. They treat based on who they can save with the resources they have. The drunk driver who caused the accident might get treated before the innocent pedestrian - not because the doctor approves of drunk driving, but because the pedestrian's injuries are beyond what the field hospital can handle, and the driver can be stabilized and sent for further help.
Is that "just"? No. Is it the right call? In that moment, with those constraints - absolutely.
Sometimes this means keeping someone who made a serious mistake - because without them, everything falls apart. This isn't weakness. It's cold-blooded calculation. And it's one of the loneliest decisions a leader will ever make.
The loneliness comes from knowing that you'll be judged for it. Not now - now everyone is too busy surviving. But later, when the dust settles, when people have the luxury of calm reflection, they'll look back and see a leader who "let someone off the hook." They won't see the math you did at 2 AM. They won't feel the weight of knowing that firing one person meant losing three clients, destabilizing two teams, and potentially triggering a cascade that would take months to recover from.
They'll see softness where there was strategy. And that's a cost you accept upfront, because the alternative - being "principled" while the system collapses - isn't principled at all. It's self-indulgent.
There's a reason military commanders study this dynamic extensively. In battlefield conditions, the commander who relieves a competent but flawed officer in the middle of an engagement - out of principle - risks losing the engagement entirely. The flawed officer's knowledge of terrain, troop positions, and enemy patterns can't be transferred in a briefing. It exists in their head, in their muscle memory, in the relationships they've built with their subordinates. Replace them at the wrong moment, and you don't get a better officer in command - you get confusion, delay, and a unit that's suddenly operating without its nervous system.
Organizations aren't armies, but the principle transfers cleanly: there are moments when the cost of the "correct" decision exceeds the cost of the "wrong" one, and recognizing those moments is what separates strategic leadership from performative leadership.
The Mechanics
The decision to prioritize controllability over justice isn't instinctive - it's mechanical. It follows a logic that can be broken down, understood, and applied deliberately. Here are the four forces at work.
In peacetime, you can afford the ideal decision. You have bench strength. You have time to recruit. You have processes that will absorb the shock of losing a key person. Crisis strips all of that away. Suddenly, every person is load-bearing. Every process is running on minimum viable capacity. Firing someone "on principle" in this environment isn't principled - it's reckless. It's like throwing away your last bottle of water in the desert because the label is wrong. The math doesn't care about fairness. The math cares about whether you have enough hands to keep the operation running until tomorrow.
Every organization has people who are more than their job description. They carry institutional memory. They know which client prefers email over Slack. They know the undocumented workaround for that legacy API. They have relationships with vendors that took years to build. In normal times, this context is a nice-to-have - it makes things smoother but isn't critical. In crisis, it becomes the difference between recovery and chaos. Even a problematic employee - someone who made a serious mistake - temporarily carries irreplaceable knowledge, connections, and familiar decision routes. Remove them too early, and the system doesn't just slow down. It loses orientation entirely. You're not just losing a person - you're losing the map.
Every decision in crisis is a choice between two bad options. There are no good options - there are only degrees of damage. The question isn't "what's right?" but "what causes less harm?" Between the probability of a repeated error (which you can mitigate with oversight, guardrails, and monitoring) and the guaranteed destabilization of removing a critical person (which you cannot mitigate in the short term) - you choose the lesser evil. This isn't softness. It's the same logic a surgeon uses when deciding which limb to save. It's cold, precise, and deeply uncomfortable. But the alternative - choosing the option that feels morally cleaner but causes more damage - is a luxury that crisis doesn't offer.
This is the part most leaders get wrong. They make the crisis decision - keep the person, absorb the mistake, maintain stability - and then they forget to close the loop. "Forgiveness" in crisis isn't actual forgiveness. It's a tactical deferral. It has an expiration date. The grace period lasts exactly until the system regains enough strength to absorb the shock of change, and an alternative path becomes available. After that, the account must be settled. Not out of vengeance, but out of systemic hygiene. A leader who keeps someone indefinitely after crisis because "we got through it together" has confused tactical necessity with strategic endorsement. The exception must never become the rule.
These four forces aren't sequential steps - they operate simultaneously. The leader in crisis is running all four calculations at once, in real time, with incomplete information, under pressure. That's what makes it one of the hardest calls in organizational leadership.
The Hidden Cost of "Principled" Decisions
Let's be honest about what happens when a leader chooses justice over controllability in the middle of a crisis. Because the advocates of "always hold the line" rarely talk about the aftermath.
Scenario: you fire the person who caused the outage. It feels righteous. The team sees accountability in action. The policy is upheld. The message is clear: we don't tolerate this.
And then reality hits.
- The recovery takes three times longer. Nobody else knows the system at that depth. Your remaining engineers are reverse-engineering what the fired person built, reading through months of undocumented decisions, and guessing at configurations that were never written down. The outage that could have been resolved in four hours stretches into two days.
- The team fractures. Some people agree with the firing - "they deserved it." Others are terrified - "if one mistake gets you fired during a crisis, why would I ever take a risk?" Your best people, the ones who actually innovate and push boundaries, start updating their resumes. Not because they sympathize with the fired person, but because they realize this organization punishes action over inaction.
- Client trust evaporates. The extended outage costs you two of the three at-risk accounts. One of them was a reference client for your biggest upcoming deal. The revenue impact cascades through the next two quarters. The board starts asking questions that have nothing to do with infrastructure and everything to do with leadership judgment.
- The replacement takes months. You start recruiting. The role is senior, specialized, and requires deep context that takes six months to build. During that ramp-up period, your infrastructure team operates at diminished capacity. Every deployment carries extra risk. The "principled" decision keeps costing you long after the crisis is over.
None of this means the mistake should go unaddressed. It absolutely should. But timing matters. A doctor doesn't lecture a patient about their diet while performing emergency surgery. There's a time for accountability, and there's a time for survival. Confusing the two isn't principled - it's destructive.
The most dangerous version of this mistake is the leader who fires on principle and then tells themselves a story about "doing the hard thing." They frame the collateral damage as the cost of integrity, rather than recognizing it as the cost of poor timing. True integrity includes knowing when to act - not just what to do.
There's a particular irony here that's worth naming. The leader who fires on principle during crisis often gets praised in the short term. "Wow, they really held the line." "That took guts." The applause feels validating. But applause doesn't fix the production system. Applause doesn't retain the clients. Applause doesn't prevent the next three engineers from leaving because they saw what happens when you make a mistake under pressure. The principled leader gets a moment of moral satisfaction - and then spends the next six months dealing with the cascading consequences that nobody claps for.
Meanwhile, the leader who chose controllability gets no applause. They get sideways looks and whispered doubts. But their system is running. Their clients are retained. Their team, while shaken, is intact and functional. Six months later, the "soft" leader has a recovered organization. The "principled" leader has a moral victory and a rebuilding project. History rewards the one who kept the lights on.
The Symptom: Retrospective Distortion
Here's the cruel irony. You make the hard call. You keep the problematic person. You stabilize the system. You guide the team through the crisis. You lose sleep, absorb criticism, and make a dozen more uncomfortable trade-offs nobody will ever see. And then - the crisis passes.
The system recovers. The clients calm down. The team finds its rhythm again. And that's when the judgment begins.
Colleagues - the same ones who were too panicked to make decisions at 2 AM - now have the clarity of calm. They sit in their comfortable chairs, with full context and hindsight, and they render their verdict: "excessive softness." "Why didn't we hold them accountable?" "It sends the wrong message." "If I had been in charge, I would have..."
This is retrospective distortion - the cognitive bias that makes calm-state observers believe they would have made "better" decisions under conditions they never experienced. They judge by outcome, not by the constraints that shaped the decision.
Retrospective distortion is especially vicious in organizational settings because it carries moral weight. The critics aren't just saying "I would have decided differently." They're saying "I would have been braver, more principled, more just." They're rewriting the crisis narrative from a position of safety, casting themselves as the moral hero and the actual decision-maker as the compromiser.
This effect is amplified by a second bias: outcome attribution. When the system recovers successfully, people attribute the recovery to the system's inherent resilience ("we would have been fine anyway") rather than to the difficult decisions that made recovery possible. The very success of the controllability-first approach becomes evidence against it. "See? We survived. So the person couldn't have been that important after all."
The logic is backward, but it's psychologically irresistible. Success erases the memory of how precarious things actually were. The leader who held the line during chaos watches their crisis decision reframed as a character flaw - and there's almost nothing they can do about it in the moment, because defending the decision sounds like making excuses.
This is compounded by what psychologists call the "curse of knowledge" in reverse. The leader who made the crisis decision can't un-know what they knew at 2 AM - the fear, the limited options, the weight of the dependencies. But the critics literally cannot access that state. They try to imagine it, but their imagination is filtered through current safety. It's like trying to remember what hunger feels like while sitting at a full table. You can recall the concept, but not the desperation.
The result is a persistent, low-grade erosion of trust in the leader's judgment. Not dramatic enough to cause a confrontation, but steady enough to shift how their future decisions are perceived. Every subsequent act of pragmatism gets filtered through the lens of "remember when they let that person off?" The crisis decision becomes a stain on the leader's reputation - not because it was wrong, but because the conditions that made it right have been forgotten.
Almost nothing can be done about this in the moment. But not nothing. Which brings us to the antidote.
The Antidote
The best defense against retrospective distortion isn't arguing louder - it's documenting in real time. If you know you're making a decision that will look questionable from the outside once calm returns, your job isn't to justify it later. Your job is to create the record now, while the conditions that shaped the decision still exist.
The Controllability Protocol
-
01
Document the decision context - while you're in it Write down what's happening: what broke, who's available, what resources you have, what the timeline looks like, what the blast radius of each option is. Not a polished report - a raw situational log. Timestamp it. This becomes your evidence that the decision was strategic, not emotional. Even a quick Slack message to yourself or a trusted peer - "Keeping X on for now because they're the only one who can restore Y, will address the violation after stabilization" - is enough. The point isn't elegance. It's creating a contemporaneous record.
-
02
Separate in-the-moment decisions from post-factum judgments Make it explicit - to yourself, to your leadership team, to HR if needed - that the crisis decision is temporary. "We are choosing to defer accountability actions until the system is stabilized. This is not forgiveness. This is sequencing." Use those exact words. They matter, because they prevent the narrative from being rewritten later. When someone says "but you let them off the hook," you can point to the record and say "no, I deferred. And here's why."
-
03
Set an explicit expiration on the exception The biggest risk of controllability-first decisions is that they become permanent. Define an exit condition: "This person stays until we've hired their backup," or "We revisit this at the next leadership sync after the migration is complete." Put it on the calendar. Make it concrete. An exception without an expiration date isn't an exception - it's a new policy. And a new policy built on crisis logic will erode your organization's standards silently but relentlessly.
-
04
After stabilization - close the cycle without apology Once the crisis passes and the system is strong enough, return to full discipline. This means following through on the deferred accountability - performance conversations, role changes, or termination if warranted. Don't justify the exception. Don't explain why you were "soft." Simply act. The cycle is: survive → stabilize → restore standards. The leader who completes all three phases demonstrates something far more sophisticated than simple toughness - they demonstrate operational intelligence.
-
05
Conduct a private retrospective on your own decision-making After the cycle is closed, sit with the decision honestly. Was keeping that person truly necessary, or was it conflict avoidance dressed up as strategy? Did you set an expiration, or did you let it drift? The same framework that protects against retrospective distortion from others must be applied to yourself. The line between strategic deferral and avoidance is thin, and only honest self-examination keeps you on the right side of it.
Notice the pattern: none of these steps involve convincing anyone that you were right. They're not about winning arguments. They're about creating a system of accountability that survives both the crisis and the calm that follows. The documentation protects you from distortion. The expiration protects the organization from drift. And the follow-through protects your integrity from the seductive pull of permanent exceptions.
When This Goes Wrong
Controllability over justice is a powerful framework. But like any powerful tool, it can be abused. And it's important to name the failure modes clearly, because the line between strategic deferral and chronic avoidance is dangerously easy to blur.
The crisis passes, but the exception remains. The leader who deferred accountability never gets around to restoring it. "There's always something" - another deadline, another risk, another reason to keep the problematic person in place. Weeks become months. The team watches. They learn that mistakes have no consequences if you're important enough. This isn't controllability - it's capitulation. The difference is entirely in whether the cycle gets closed.
Some leaders - consciously or not - begin to perceive every situation as a crisis. If it's always an emergency, then accountability can always be deferred. The controllability framework becomes a permanent shield against hard conversations. Watch for this in yourself: if you find that you're always in "crisis mode," the real crisis might be your own avoidance pattern, not the organization's stability.
The person who was "kept" during the crisis sometimes develops a sense of immunity. "They needed me. They couldn't fire me then, and they won't fire me now." If the leader doesn't close the cycle explicitly and firmly, the retained person may interpret tactical deferral as a blank check. This makes the eventual accountability conversation even harder - but also even more necessary.
The framework works when it's used as a scalpel - precise, time-bounded, and deliberate. It fails when it becomes a blanket - covering problems indefinitely in the name of "stability." Knowing the difference requires honesty with yourself, and that's perhaps the hardest part of the entire equation.
it's keeping the system alive long enough
for justice to matter again.