Blame the caller if a precondition of an operation fails
Blame the called operation if the postcondition of an operation fails