Before the arrival date gets scheduled, I want the departure test written.

That ordering sounds ceremonial. It’s structural: a deployment that needs its vendor forever hasn’t transferred capability, it’s created a dependency with an installation date, and the only way I know to prevent it is to define the exit while it can still shape the architecture.

Here’s the departure checklist we put in the statement of work. The institution’s own staff, observed but unassisted, must:

  • Restore the system from backup and prove the restored data serves.
  • Rotate a privileged credential without breaking a dependent service.
  • Retrieve a specific audit record from a specific week and explain it.
  • Apply an approved update, then roll it back.
  • Disable a user in anger, with the access change verified end to end.
  • Move an approved model into the isolated environment through the documented custody path.
  • Exercise the stop condition and bring the system back afterward.
  • Onboard a brand-new administrator using nothing but the deployed documentation.

Each item fails loudly on its own, and that’s the design. Documentation describing a generic reference build instead of this environment fails the new-administrator item. Credentials that quietly stayed in vendor custody fail the rotation item. Judgment that lives in one engineer’s head fails everything, which is the point of testing with the people who’ll own the work.

The checklist also reshapes the middle of the engagement, not just the end. Knowledge transfer can’t wait for a closing meeting, so institutional staff sit inside configuration, acceptance testing, failure drills, and updates while decisions are being made, because a runbook without the reasons won’t survive the first changed condition.

Two clarifications I always add. Choosing to keep outside help afterward is fine; needing it for ordinary work isn’t, and the difference is the whole test. And clear boundaries protect the vendor too: scoped support beats the endless informal rescue nobody’s budgeted.

My mission language stays blunt here. The engagement ends by design, the institution runs the system without us, and a deployment that requires us forever is a product I refuse to sell.