Use when designing safeguards, failure handling, or recovery boundaries for a workflow or system; do not use for ordinary feature implementation without a material failure-risk question.
