By Yair Knijn · December 10, 2025

The one engineer who understood the IP plan resigned. The map left with them.

You are the platform engineering manager. You signed the offboarding checklist, collected the laptop, revoked the SSO, and moved on. The assumption you never questioned: the network was documented because someone competent ran it. Two weeks later a team asks for a /24 and nobody can answer whether 10.40.0.0/16 is half-allocated or fully committed, because the person who knew is gone and the file that knew left in their home directory.

The address plan was never a system. It was one engineer plus a spreadsheet named ipam_final_v3.xlsx, and the real logic lived in the space between them. That space is now empty.

The bus-factor-of-one address plan

The bus factor is the number of people who have to vanish before a project stalls for lack of knowledge. Empirical work on it (see the arXiv study "Bus Factor In Practice") keeps finding the same uncomfortable number across real codebases: one or two. Address management is worse than code, because there is no compiler to tell you the model is wrong. The spreadsheet says 192.168.12.0/24 is free. The departed engineer knew it was quietly reserved for a DR cutover next quarter. That caveat existed in exactly one skull, and the skull took a job elsewhere.

A bus factor of one is not a documentation gap you patch later. It is a structural bet that a specific person never leaves, never forgets, and is always reachable. People leave.

What walks out the door at offboarding

The asset that leaves is not the file. You probably have a copy of the file. What leaves is the reconciliation that lived in someone's head: which rows are stale, which subnets were carved twice and never cleaned up, which VLAN actually owns a range versus which one the diagram claims owns it. Offboarding guidance talks about capturing tribal knowledge before the last day, and it is correct, but a 30-minute handover meeting cannot serialize three years of "oh, ignore that row, that migration got cancelled."

So the org starts reverse-engineering its own network. Engineers nmap their own ranges, diff DHCP leases against the sheet, ping addresses to see what answers, and treat their production network as a black box they have to probe from the outside. That is not analysis. That is archaeology, and it can run for months.

Why personal spreadsheets are an undocumented liability

A personal spreadsheet feels like documentation, which is exactly why it is dangerous. It has rows. It looks authoritative. But it has properties no shared system of record should have:

• It is a snapshot the moment it is saved, and reality keeps moving without it.
• It enforces nothing, so the same /26 can be handed to two teams with no warning.
• It has no audit trail, so you cannot ask who allocated an address or when, or why a range was reclaimed.
• It is owned by a person, not a role, so its accuracy and its accessibility both die when that person leaves.

The day you open an inherited IPAM spreadsheet, it is already wrong, and you have no way to tell which parts. A real system reconciles the claim against what DHCP and DNS actually serve and flags overlaps before they become a routing incident. A file does none of that. It just sits there looking trustworthy.

Centralized IPAM as continuity insurance

The fix is not a better spreadsheet or a stricter handover template. It is moving the address plan out of a person and into a shared, queryable system that anyone with access can interrogate at 03:00 without a phone call. When allocations are recorded with an owner, a timestamp, and a reason, an offboarding becomes an access change instead of a knowledge extinction event. The new hire reads the same source of truth the leaver used, because there was never a private copy to lose.

Spot IPAM keeps every subnet, allocation, and reservation in one Environment that survives any individual departure: each record carries who owns it and when it changed, conflicts get flagged instead of discovered in an outage, and the next engineer inherits the live map instead of a stale file. If your address plan currently lives in one person's head, that is the liability to retire first. See how Spot IPAM holds the line.