A county permit system uses active-passive databases with a manual promote during outages. Tabletop reviews show promote steps often miss the published RTO. What should the architect emphasize first?

When a county permit system still uses active-passive databases with a manual promote, tabletop reviews that miss the published RTO usually reveal process and automation gaps rather than a missing brand of database. The architect should emphasize detailed failover runbooks and automate promotion wherever possible so the promote path completes within the RTO. Runbooks remove ambiguity about who decides, which checks to run, and which promote command is authoritative; automation removes slow human steps that consistently burn the recovery clock during drills and real outages.

Keeping promote fully manual forever and only lengthening the published RTO after each missed drill fails conceptually because it rewrites the citizen-facing recovery promise instead of fixing the recovery procedure. Disabling health checks so operators never receive noisy failover alerts during business hours fails because it hides the very signals that should start promote workflows and leaves the passive side untested. Storing all promote scripts only on a single administrator laptop fails as a resilience pattern: that laptop becomes a single point of failure and a change-control risk for a countywide permitting outage.

Exam caveat: documentation alone is not enough if promote remains slow; SAA-C03 expects you to pair runbooks with automation and measured RTO validation. Operational check: time a production-like promote against the published RTO, store runbooks in a resilient repository reachable during primary failure, and require dual-control access rather than one laptop as the only copy of promote tooling.