Instrumented Share
The proportion of your known failure modes that something now stops automatically. Take the last twenty production incidents and ask, for each one, whether a recurrence would halt the work on its own or whether somebody would have to notice. Count the ones that would stop and divide by twenty.
What it is. A measure of how much of your control still depends on a person paying attention.
Every organization has a list of failures it has already seen. Some of them are now impossible to ship, because a check refuses to proceed. The rest are covered by a runbook, a training module, or somebody's memory, all of which require attention at the moment it matters.
When to run it. After any incident review, and once a year on the whole list. Also before approving a deployment that adds a new class of failure to the pile, because the number tells you whether the last several got closed or merely documented.
How to run it.
Take your last twenty production incidents. Not the worst twenty, not the interesting twenty. The last twenty, whatever they were.
For each one, ask a single question. If this recurred tomorrow, does something now stop the work automatically, or would somebody have to notice?
Count the ones that would stop.
Divide by twenty.
Reading the answer. The number is the share of your known failure surface that no longer costs attention. Everything outside it is a control running on somebody noticing, on a day you cannot pick, in a queue you cannot see.
Expect it to be lower than the room expects, and often close to zero. The standard response to an incident is a postmortem, a lesson, and an entry in a runbook. A runbook is a rule somebody has to read, hold in mind, and apply under load, which is the class of rule that fails first. Most incidents produce knowledge. Very few produce a gate.
What a bad answer looks like. A number derived from the incidents somebody remembers rather than the last twenty in the log. A check counted as a gate when it produces an alert rather than a stoppage; an alert is still a request for attention. A gate that exists in a pipeline nobody has run in a quarter. And a high share reported without anyone asking whether the gates are still pointed at things that can still happen.
What to do with it. Say it out loud where deployments get approved, and pair it with the fallback capacity ratio. That one asks whether the organization can recover the work. This one asks whether it still has to watch the work. Together they cover the two ways a control fails: the people cannot do it, and the people do not notice.
One honest limit. A high instrumented share is not safety. It says every failure you have already seen is now enforced by execution rather than attention. It says nothing about the failures you have not seen, and nothing about whether the specification the gates test against is the right one. Instruments cover defects. They are blind to purpose.