Hotfix Pattern — Enterprise Notes

Pattern: Hotfix
Component: enterprise-notes.md
Version: 1.1 | Updated: 2026-07-16

---

Authority and audit

Emergency speed does not erase evidence needs. Record IC, severity, digests, flag flips, and decision times in the incident system of record. Regulated industries often require this for after-action review.

Privacy and security join criteria

If personal data may have leaked or auth boundaries failed, IC escalates to privacy/security immediately. The coding agent does not notify customers or regulators.

Emergency exceptions

Skipped tests or abbreviated review must be time-boxed with an expiry and a follow-up ticket. Standing “hotfix culture” for non-incidents is a process failure.

Anti-claim

Successful containment is not a security certification, legal safe harbor, or proof that the durable fix is complete.