There is a particular kind of sentence nobody wants to hear at the wrong moment. The data is inaccessible, but there's a backup. The account is frozen, but there's an appeal process. The shipment is gone, but it's insured. The service is unavailable, but the provider guarantees compensation under the agreement.
None of those answers is necessarily bad. Depending on what failed, each may be exactly the protection we wanted. The problem is that the protection doesn't preserve the same thing that was lost. Insurance can preserve economic value without preserving the object. A backup can preserve data without preserving immediate access to it. An appeal can eventually restore an account without preserving whatever we needed to do while the account was frozen. A service-level agreement can compensate us for downtime without giving us those hours back.
We use these substitutions constantly because preserving everything directly would be extraordinarily expensive. Instead of eliminating failure, we decide which consequences we're willing to tolerate and arrange ways to recover afterward. Most of the time this works remarkably well. If my house burns down, keeping a second house permanently available in case I need it would be an absurd form of resilience for most people, so insurance accepts the possibility that the physical structure can be lost and attempts to preserve some of its economic value instead. If a database server fails, I don't necessarily need another machine containing a perfectly synchronized copy waiting beside it. Restoring a recent backup tomorrow morning may be completely adequate for what that database does.
The important question is what I thought I was protecting, because different protections preserve different properties. A backup protects recoverability. Replication can protect availability. Insurance transfers some financial risk. Redundant infrastructure can preserve service through certain failures. Local custody can preserve the ability to act without waiting for another organization. None of these means simply "safe." They answer different questions, and during normal operation those differences can be surprisingly difficult to see.
I click a button and the file appears. I present a card and the payment works. I enter a password and the account opens. I request a service and something happens. As long as everything is working, several very different arrangements can look functionally identical. The differences become visible when one of those paths stops working and I discover whether I possess the thing itself, a copy of it, the ability to reconstruct it, a contractual claim against someone who possesses it, or merely permission to use it while certain conditions remain true.
Those aren't interchangeable positions, although neither is one of them always superior. Possession creates capabilities that claims don't, but it also creates responsibilities that claims can transfer elsewhere. If I hold the only copy of something important, nobody can revoke my access to it, but nobody else is responsible for recovering it after I destroy it either. Custody removes some dependencies by accepting others.
Claims work the same way. They can look weak because they depend on another party performing later, but that other party may have resources I could never economically maintain myself. A regional disaster may overwhelm a local organization while a geographically distributed insurer continues operating. A cloud provider may recover from a hardware failure I couldn't repair for days. Sometimes distance is the resilience. Other times distance is the dependency. What matters is the particular failure we're trying to survive.
This is why I no longer find statements like "own the important things" precise enough. Ownership tells me something about authority, but it doesn't tell me whether the thing will survive. A server in my building is under my control, and so is the second server beside it. If the building