The Breaker Fired Correctly and Stopped Nothing

The alert fired at the right threshold. That's the part I want to start with, because it's the part most postmortems bury.

On August 24th, a daily cost breaker in my own infrastructure did exactly what it was built to do. It watched Firestore reads climb past its ceiling, and at 763,759 reads it fired and paused all four scheduled jobs. No human had to notice anything. The control worked.

243,287 more reads happened after that.

Not despite the breaker. Not because the breaker was wrong. Because the thing driving the reads was never a scheduled job in the first place. It was a local process on a workstation, running under my own credentials, doing a full collection scan it had no reason to repeat — fourteen times that afternoon, as it turned out, before anyone noticed.

A Cloud-side breaker can pause Cloud-side infrastructure. It cannot reach a laptop. So the alert fired, the schedulers stopped, the dashboard looked handled — and the actual runaway kept going for another fifty-some minutes, because the only thing that could stop it was a human closing a terminal window.

I've spent twenty years in security work watching this exact shape recur, in bigger and smaller forms: a control that is correct about the boundary it was given, and wrong about where the threat actually lives. A firewall rule that's airtight for network traffic and silent on a contractor's laptop. A DLP policy that catches every outbound email and nothing carried out on a USB drive. The control isn't broken. It's just answering a narrower question than the one you actually needed answered.

What made this one instructive to me wasn't the dollar figure — it was small, under two dollars in Firestore reads. It was the shape of the gap. I had built exactly the kind of control that looks complete on a dashboard: threshold set, alert wired, four jobs paused on cue. And it never occurred to me, until it happened, that "pause the infrastructure" and "stop the thing that's actually running" were two different problems that I'd quietly treated as one.

Here's what changed, concretely:

Read budgets moved into the client library, not just the scheduler. A tool that scans a collection now carries its own hard ceiling — a few thousand documents, well below anything a legitimate run needs and well above anything an accidental full scan should ever reach — and it raises before the next page loads, not after the fact. That control lives with the code that does the reading, so it doesn't matter whether a scheduler, a script, or a person on a laptop runs it.

A corpus that's meant to be read once gets cached once. The specific tool that caused this was reloading the same 121,580-document collection from scratch on every run. It now writes an immutable local snapshot the first time, and every subsequent run reads that snapshot at zero additional cost. Refreshing it is a separate, explicit act — never a side effect of just running the tool again.

The incident record itself became a control. Every later change that touches this path has to cite what this incident found, or it doesn't ship. Not as a formality — as a forcing function, so the next person building something adjacent has to read what happened here before they build past it.

The rule I actually took away, though, isn't about any of those specific fixes. It's this: a control that bounds infrastructure and a control that bounds the person operating it are not the same control, and building one does not give you the other. If you want to know whether a system is actually contained, ask where the humans with standing access sit relative to every boundary you drew — not just whether the boundary itself is correctly configured.

The guard was aimed at the right threshold. It was aimed at the wrong population. That's become the pattern I check for now, in everything I build: not "does this control work," but "who is this control actually watching, and who does it just assume is elsewhere."

AI recommends. Humans decide.

The corollary I didn't expect to need: a control recommends a boundary. A human still has to be inside it.