Poka Yoke

Poka-Yoke: Mistake-Proofing for Software

Shigeo Shingo's insight, from the Toyota Production System: people will always make mistakes; that is not the problem worth solving. The problem is letting a mistake become a defect. So you stop trying to make humans more careful and start redesigning the work so the mistake either cannot physically happen or announces itself immediately.

A poka-yoke ("poh-kah yoh-kay", ポカヨケ) is a device: a jig, a shape, a counter: not an instruction. In software: a type, a constraint, a hook, a schema, a state machine. The single most important consequence:

A comment, a docstring, a wiki page, a code review checklist, or a line in CLAUDE.md saying "don't do X" is not a poka-yoke. It is training. Training degrades. A device does not. If your proposed fix relies on someone remembering something, keep going.

When to Use This Skill

• Use when the user says "poka-yoke this", "mistake-proof it", or "make this harder to get wrong".
• Use when designing an interface, schema or state machine and the ask is "make invalid states unrepresentable" or "so callers cannot screw it up".
• Use when auditing existing code for footguns: "what could bite us here", "what is easy to misuse".
• Use after an incident, when the fix must close the class rather than the case: "make sure this never happens again", "this is the third time".
• Especially for money, auth, permissions, deletion, migrations and pipelines, where failure is silent.

The two axes

Every real poka-yoke answers two questions. Use both when you classify a hazard or propose a device. They are the difference between this method and generic code review.

Axis 1, Regulatory function: what happens when the mistake occurs?

This is a strict preference ladder. Always reach for the highest rung you can afford.

Shingo's rule: prefer control over warning, always, and only settle for warning when control is genuinely too expensive, then say why out loud. In software the honest reason is usually "the language can't express it" or "it would break every existing caller," and both are worth stating explicitly so the tradeoff is visible.

Axis 2, Setting function: how does the device notice?

Shingo's three detection methods map cleanly onto software. These are your inspection lenses, run all three over any interface and you will find hazards that a general code review misses.

The third principle: inspect at the source

Shingo separated source inspection from informative inspection, which finds the defect only after it exists and comes in two forms. Ranked best first, that is three places you can put the device.

1. Source inspection: check the conditions before the error can occur. Designed in where you can, enforced at runtime where you cannot. The type, the constraint, the signature.
2. Self-check (informative): the work checks itself as it happens. Runtime. Assertions, fail-fast, validation at the boundary.
3. Successive check (informative): the next station checks the previous one. Review, CI, QA.

Push every device as far up this list as it will go. A CI gate that catches a bad migration is good; a schema that makes the bad migration unwritable is better and costs less forever.

How to use this skill

Apply the method directly to the subject in front of you. A Terraform module, a support runbook, a spreadsheet everyone edits, a release checklist, a prompt template, an onboarding process, a physical workflow: the method works on any of them, because Shingo developed it on an assembly line, for people fitting springs into switches, and not for software at all.

Applying it directly means four steps, in order:

1. Name what is being done, and by whom. A device protects a specific action taken by a specific person or system. "The pipeline" is not an action; "an engineer re-runs the deploy job after it fails halfway" is.
2. Run the three lenses over that action, can the wrong thing fit, can an incomplete or wrong-sized set pass, can the steps happen in the wrong order. Most subjects yield something on at least one.
3. For each hazard found, state it as a mistake someone could make, what happens when they do, whether it is silent, and what exists today to stop it.
4. Propose the highest-rung device you can afford, and say which rung it reaches. If you land on Warning, say what Control would have required and why you did not take it.

Then apply the two rules in How to talk about this below: name the mistake rather than the mistaken, and never let the answer come out as "be more careful" or "document it". Those are rung zero, and the whole method exists because they do not work.

If the request is bare, /poka-yoke with nothing attached, look at what is actually in front of you: the current diff, the file under discussion, the thing the conversation has been about. Say what you picked in one line before starting, so it is cheap to redirect you. If there is genuinely no subject, ask what they want mistake-proofed rather than guessing.