A platform team that reports elsewhere refuses the preventive fix your exercise proved — how do you proceed?

## The structural problem The team that proves a gap almost never owns the system that has it. You are asking a platform team that broke nothing, that does not report to you, and whose quarter is already committed, to spend capacity on work whose benefit lands on your side of the org chart. Evidence does not resolve that by itself, and treating the refusal as insubordination is the fastest way to lose the relationship you will need for the next twenty findings. ## Identify which refusal you are hearing Three different sentences arrive as one word, and each has its own answer. **I do not believe the finding.** The cheapest to resolve and the one you should welcome. You have a reproducible execution and the record it produced. Offer to run it again, on their cluster, with them watching. A demonstration in the room converts a disputed report into a shared observation, and it is often the moment the routing conversation actually starts. **It will break things.** This is a real engineering objection and answering it is your job, not theirs. Deploy the control in a report-only or audit mode first and come back with the concrete blast radius: how many current workloads violate it, in which namespaces, owned by whom. Nine times out of ten that list shrinks the argument to a small set of genuinely privileged components, which become an explicit exemption list — and the exemptions are then where you route a detection. You have turned a demand into a scoped migration with a known size. **It is not this quarter's work.** A prioritisation conflict wearing technical clothes. Arguing about the technique here is a category error; the conversation is about sequencing and who decides it. Ask for a date rather than agreement, and ask what would have to be true for it to earn a slot. ## Take the destination you own While that plays out, route what you can reach alone. A detection normally sits inside your own team's authority, so ship it — labelled interim, with the prevention row still open behind it. This is a genuine tactical win and also a negotiating fact: you have demonstrably done the cheaper half yourself rather than handing over the whole cost. Be honest with yourself about the trap, though: an interim detection that never gets retired is how an organisation accumulates permanent triage load in place of fixes, so give it a retirement condition tied to the prevention row. ## Make the residual explicit If refusal stands after all of that, do not leave an open row. Convert it into an **accepted gap**: what the technique is, what it reached, why the fix was declined, who declined it, and when the decision is revisited. Then ask that person to confirm it in writing. This is not a threat and should never be delivered as one. It is the correct operational outcome — someone with the authority to carry a residual risk has decided to carry it, and now that is visible instead of implicit. In practice, being asked to sign an acceptance changes more decisions than escalation does, because it converts an easy silence into a small explicit act. ## Escalate as a decision request, not a complaint If you do escalate, escalate the *decision*, not the behaviour: here is what was proven, here are the two destinations and their costs, here is what we can do unilaterally, here is what needs the platform team, and here is the date by which we need a yes, a no or an acceptance. A named question with a deadline is answerable. A grievance about another team is not, and it costs you the next negotiation. ## Fix it upstream for next time The durable improvement is procedural: agree before the exercise who is in the room when results are routed, and get the platform team's representative and the person who can accept risk into that session. A refusal made in a joint routing session is a decision with a name attached; a refusal made by ignoring a ticket is not even a refusal. Involving the owning team in scoping the exercise also changes their relationship to the result — findings from an exercise you helped design are much harder to dismiss as someone else's report. ## What a weak answer sounds like Opening a ticket in their backlog and declaring the finding routed. Escalating on day one. Arguing severity rather than blast radius. Or quietly writing a detection, closing the row, and never telling anyone that the underlying technique still works.