BLOG · 2026-06-20
Only John knows how this works
There's a phrase you hear in a lot of companies that should set off alarm bells: "oh, John handles that, only he knows how it works." If John gets sick, gets upset, or leaves for another job, part of your business walks out with him. And almost nobody treats it as a risk until it's too late.
The problem isn't John — it's that there's only John
John is probably good at his job. He built an automation that works, saved hours of labor, everyone's happy. The problem shows up the day John isn't around: nobody knows where it's set up, with which accounts, or what to touch if it breaks. The knowledge went on holiday with him.
In the technical world this has a name: the "bus factor." It's dark humor: how many people would a bus have to hit for your business to grind to a halt? If the answer is "one," you're at risk.
What this looks like in practice
- The automation goes down on a Friday. John's at a wedding. Nobody else knows where to even start.
- John leaves the company on good terms, but the passwords for the connections were in his personal email or in his head.
- Something small needs changing and it turns out only John knows that "you can't touch that part without breaking the other one."
None of these are John's fault. They're failures in how the knowledge is set up, not in the person.
What makes a system depend on a single person
- It's not written down anywhere. If the only documentation is "ask John," there is no documentation.
- The keys are personal. Accounts and passwords are in one person's name, not the company's.
- It's built "his way." Everyone has their quirks. If nobody else knows them, only the builder understands the system.
How to fix it (without firing anyone)
The good news: this is solved with order, not drama.
- Make the accounts the company's. Connections, passwords and services should be in the business's name, not a person's. If someone leaves, the keys stay.
- A one-page map. What automations exist, what each does, which services it talks to, and who to alert if it fails. You don't need a novel: one clear page is worth gold.
- An "off-boarding" button. When someone leaves, you should be able to revoke all their access at once — not go service by service, praying you remember them all.
The day someone leaves
This connects to something we care a lot about: when a collaborator stops working with you, their access should close completely and at once. Most companies take days to cut all the access of someone who left — and many leave one open forever. That loose end is an open door.
That's why at NUDAYOSH we treat access management as part of security, not paperwork. Knowing who has access to what and being able to cut it in one click isn't a luxury: it's what separates a calm staffing change from a security hole.