Decision Principles and the Record
Seven irreducible rules, one log, and why honest decisions need both
The previous article stated the organisational wound behind “we already decided” — We Already Decided — where collective finality is confused with immunity from evidence. This article supplies the response: a minimal set of decision-making principles and the Architectural Decision Log — (A)DR framework that turn bind into durable, revisitable record.
The deeper injury from Where Everything Breaks also lives in rooms: Who really decided? Why wasn’t I heard? Why does the story change after the fact? Those are The Decision No One Made and The Buried Finding in organisational dress — truth’s status untracked, dissent unrecorded, accountability diffuse.
Part V already classified when to reinforce the bind and how (When the Commitment Boundary Needs Reinforcing, Strengthening the Commitment Boundary). Here we connect principles and log to the Genesis machinery you already have: commitment boundary, epistemic tiers, contestability, and L0 facts that survive politics.
The minimum set of principles
Seven principles form a closed system for psychologically safe, rationally defensible decisions in business strategy and software architecture — ordered as they apply in a real decision cycle. Each is a standalone Principles entry (e.g. Decision Making Principle 5: Reversibility Awareness). The first three establish who decides and how reasoning is conducted; the last four follow the path to bind — assumptions published, rigor scaled to reversibility, dissent recorded, then closure. Remove any one and the system breaks: skip the room preconditions and safety collapses; skip the bind sequence and commits deny uncertainty, mismatch rigor, or reopen as politics.
These are not culture slogans. They are preconditions for the record to mean anything. A log written under fear or hidden ownership is The Confident Deck in markdown — polished narrative without honest epistemic status.
Sharper doctrine: Finality means execute the commit and defend it against premature reopening — not against qualified new evidence. Delaying supersession after a fired trigger is usually worse than reversing early; decision reversibility class sets how fast “usually” becomes “mandatory.” The legitimate exceptions — noise below threshold, a declared execution runway (We Already Decided) — are real but narrow; Schelling-style “credible commitment” is usually credible commitment theatre — see We Already Decided.
Why decision logs capture truth
Genesis treats consequential choices as commit captures — L0 events at the commitment boundary. Everything before bind is pre-bind material: options, models, dissent, evidence snapshots. The log is not meeting notes. It is the institutional memory of the crossing.
Without a log:
- Ownership evaporates into “we decided” — accountability without commitment.
- Evidence is reconstructed after outcomes arrive — mutable history.
- Dissent lives in hallway whispers — The Buried Finding without the burial needing malice.
- Finality is negotiable forever — politics reopens settled questions because nothing was fixed at a moment.
An Architecture Decision Record (ADR) — industry form from Michael Nygard (2011) — already exists in engineering culture; (A)DR extends the same discipline to any consequential organisational choice, with fields aligned to Genesis: named owner, explicit assumptions and falsification plan, tiered claims, evidence refs, recorded dissent, decision reversibility class, quality mechanisms used, and a declared contest path. Full lineage and field comparison: Architectural Decision Records.
Explore the full field schema in the interactive Architectural Decision Log — (A)DR framework.
Epistemic tiers belong in the log
A decision log that only states conclusions without how strongly each premise was supported repeats the opening failure of this series: a guess stored as fact.
When a strategy names “the market will grow ten percent” or an architecture assumes “this load will stay below X,” those are claims with tiers — hypothesis, expert judgment, calibrated model output, not tier-two necessity. The log should say so explicitly (Every Statement Has a Tier). Downstream readers — and future you — inherit the weakest link along the reasoning chain (The Epistemic Ladder).
The Decision Framework map — When the Commitment Boundary Needs Reinforcing — tells you how much rigor the decision class requires. Tiers tell you how much rigor each premise earns. The next section adds what tiers alone do not: what must be watched, and what happens when reality diverges.
Every decision under uncertainty is a hypothesis
A decision committed under genuine uncertainty is not only a choice. It is a bet — a bundle of assumptions about a future the organisation cannot yet observe. If the log lists no assumptions at bind time, one of two things is true: either the decision was not uncertain (it was deterministic or already proven), or uncertainty was denied and baked into the conclusion as false certainty — the organisational form of inference-as-fact.
The (A)DR rule is blunt:
No listed assumptions → treat as claiming certainty. Either add the assumptions or downgrade the decision class.
Each assumption in the log is a parameter of the hypothesis, not decoration:
This is experiment architecture applied to strategy and architecture decisions, not only product A/B tests: pre-committed design, separate observation streams, outcome comparison, tier promotion or demotion when evidence arrives.
Why triggers must be automatic
Without pre-declared triggers, assumption failure reopens as politics:
- Someone notices the metric moved; raising it feels like attacking the owner — the opening move of unprincipled bind epilogue when the original room skipped the principles.
- Revision requires a meeting, a narrative, and coalition-building.
- The person who warned before bind says I told you so — personal risk attaches to being right too early.
- Or nobody raises it at all — present bias keeps comfort in the present until damage is significant.
Pre-committed monitors and triggers depersonalise revision. When activation_rate < 2% for two consecutive quarters, the ADR says review is mandatory — not because a rival pushed, but because the hypothesis failed a declared test. The owner is not humiliated; the record did what it promised. That is contestability working with time, not only against malice: reality contests the assumption; the trigger fires; supersession or correction follows as L0 facts (When Facts Are Wrong).
Software can implement this literally — metric alerts wired to ticket creation, policy gates that block further spend, model drift monitoring that reopens delegation. Human organisations can implement it procedurally — quarterly assumption reviews with the same triggers written in the log. The architecture is the same: closed-loop control (One Authority Per Invariant — At Scale), not open-loop confidence until catastrophe.
Honest uncertainty at bind
When dissent surfaced that an assumption might fail, record it — and still attach a trigger if the organisation commits anyway. Unresolved dissent at bind is not failure; unmonitored dissent is. An assumption marked tier-7 hypothesis with a named monitor and trigger is more honest than a tier-4 claim with no observables.
When tier was inflated by appetite — promotion focus, schedule pressure — say so in the dissent section if it surfaced; that is The Innovation Divide made visible before bind. Attach evidence refs (studies, load tests, models) as designated observations — not as proof the Real conforms to the model (Captured Evidence vs The Real).
A committed open question — we officially do not know X — is valid when the log also states what observation would resolve it and who watches for that observation. Ignorance with a monitor is structurally stronger than false certainty without one.
Contestability: never lose track of truth after bind
Principles 6 and 7 sit in tension with contestability by design — see Decision Making Principle 6 and Principle 7: dissent welcomed before, execute and support after — until qualified evidence warrants supersession.
Support after does not mean suppress doubt. It means: implement loyally while monitors run, triggers stay armed, and the contest path stays open. Confusing finality with epistemic freeze — treating “we decided” as permission to ignore contradicting observations — is how committed hypotheses become inference-as-fact in organisational dress. Errors compound downstream; a decision classified reversible at bind becomes de facto irreversible when revision waits too long.
Reopen only through mechanism, not mood:
What finality blocks is different: hallway re-litigation, rank-driven reopening, panic pivot on sub-threshold noise, and sunk-cost commitment masquerading as discipline (We Already Decided). Treating finality as commitment-as-immunity — ignoring qualified evidence after bind — is the mirror failure. Decision Making Principle 5 sets the speed of mandatory response once a path fires — reversible decisions should supersede quickly; irreversible ones need stronger evidence, not indefinite hold.
Without contestability:
- Finality becomes loyalty test — forced alignment instead of commitment.
- Errors persist because challenging the record is career risk — positional power overrides epistemic authority (But Commitment Is Not Enough).
- Refutation never propagates — the organisational twin of non-propagating refutation.
A decision log entry that declares who may contest, how, and within what timeframe — and then records every contest and resolution as its own L0 event — means truth can move forward without being rewritten backward. The original decision stays visible; correction travels as refutation propagation, not as quiet deletion.
This is why contestability is not bureaucracy bolted onto compliance. It is how an organisation keeps tracking truth when reality disagrees with a committed call — the same reason When Facts Are Wrong exists for software.
Quality mechanisms from Strengthening the Commitment Boundary — certification, blind peer review, AI stress testing, disclosed model disagreement — belong in the log when used. They are part of the evidence snapshot, not theatre.
Safety without manipulation
Workshop culture often teaches reframing — softer language so people do not trigger defensively. That can help reasoning; it can also feel like management when the intent is to steer reaction rather than clarify thought. People tolerate hard facts; they resist hidden steering.
The distinction that matters:
- Manipulative reframing hides sharp edges and avoids discomfort — trust erodes afterward.
- Cognitive / epistemic reframing preserves facts, depersonalises interpretation, and makes disagreement safer — especially when meta-communicated: “I’m naming assumptions, not evaluating people.”
Decision logs support the second kind by construction. They externalise reasoning: options, evidence, tiers, dissent — so the room can examine mechanics instead of identities. Sharp conclusions belong in the record; accusation does not. “This decision produced costly consequences” is not softer truth — it is precise truth without personal attack.
Invite resistance explicitly in the log template: “Dissent recorded below; challenge welcomed before bind.” That turns safety from rhetorical technique into permission encoded in the artifact.
Principles, proxies, and meta-loops
The seven decision-making principles and (A)DR discipline are not a magic wand. They do not eliminate metric gaming when the wrong proxy is watched, metric substitution, rank, fear, or ambition. Wiring closed-loop control — sensor, monitor, comparator, actuator at bind — creates control pressure on whatever you declared as the observable. A green dashboard on a gamed proxy can produce recorded false certainty worse than honest open-loop doubt.
Skipping the principles is not a real alternative. The epilogue section below shows what absence of structure costs: correction as personal attack, politics instead of mechanics, compounding error.
The honest posture is epistemic humility at two levels:
What the literature already knew
Charles Goodhart (1975): statistical regularities collapse when used as control targets. Donald Campbell (1979): social indicators corrupt and distort the processes they monitor when wired to high-stakes decisions. Marilyn Strathern (1997): the aphorism when a measure becomes a target, it ceases to be a good measure — audit culture, not Goodhart’s original sentence. Double-loop learning (Argyris & Schön, Organizational Learning, 1978) distinguishes single-loop adjustment (act within fixed assumptions) from double-loop learning (revise the governing variables — the metrics and assumptions themselves). Second-order cybernetics adds that the observer is inside the system: people know they are measured and respond to the measure.
Program evaluation long distinguishes measure of effectiveness (MOE) (did the aim move?) from measure of performance (MOP) (did the operational number move?) — easy to close the loop on performance while effectiveness drifts. Perverse incentives and Cobra effect stories are the extreme case: reward for the proxy produces the opposite of the aim.
A2 — working stance No settled proof prevents gaming under incentive pressure. Meta-loop discipline reduces risk; it does not abolish judgment.
Open paths above the closed loop — and weaponization
Some correction cannot be fully metricised — novel failure modes, qualitative harm, outsider signal, contest on grounds the table did not anticipate. Legitimate open paths — contestability, recorded human override, supersession on qualified evidence not yet in the trigger table — are not a return to open-loop confidence until catastrophe when declared at bind and logged as L0 events.
They can be weaponized: rank-driven reopening without observables (panic pivot), perpetual relitigation dressed as “meta-principled concern,” or reserve loops invoked selectively against rivals while one’s own binds stay one-way. That is decisions as one-way streets in reverse — politics wearing humility’s vocabulary. The defence is the same as at first order: mechanism on the record, not rhetoric — who may contest, what observables apply, what tier, what happens when the meta-signal fires.
Principles plus closed loops plus meta-loop humility relocate politics and surface proxy risk. They do not end the need for judgment. They make the organisation auditable about where judgment still lives — which is the only alternative to pretending the wand worked.
The epilogue when principles were skipped at bind
When the original decision violated the decision-making principles — ownership unclear, dissent unrecorded, assumptions implicit, ideas fused to identity — the cost is not only missing triggers. It is the default aftermath: the bind becomes someone’s decision, not a hypothesis on the record. When consequences surface, any correction attempt — especially from people not in the original room — is easily made or received as personal attack, even when the bearer follows principled language (observables, supersession, contest path).
That is unprincipled bind epilogue: the toxic second act where lack of structure at bind exports cost to every later repair conversation. Decisions as one-way streets is the cultural design that makes it normal — commits flow forward; correction has no designed return path. Open-loop confidence until catastrophe is the structural omission — no sensors or actuators wired at bind. Worse, introducing principles mid-crisis often fails to land — participants who lived the unprincipled bind hear new rules as weapons in the current fight, not as shared mechanics. Good-faith correction becomes more uncomfortable than silence; silence compounds error; forced alignment and organisational toxicity accelerate.
The remedy is not softer language alone. It is never skipping the principles at bind — and, when already in epilogue, retroactive record, mechanised contest, and explicit separation of organisational switching cost from owner face (We Already Decided, case 4). Principles are cheapest before the wound; they are still the only durable way to stop the epilogue from becoming permanent.
Outlook: draining politics from hard decisions
Politics in organisations often fills the vacuum where decision mechanics are invisible. When ownership is unclear, evidence is optional, dissent is punished, closure never arrives, and reversal is either impossible or costless, people do not stop caring about outcomes — they shift from truth-seeking to coalition-building. Rank substitutes for authority weight. Narrative replaces captured evidence. The buried finding does not need a villain; absence of record is enough.
An (A)DR discipline does not eliminate disagreement, ambition, or power. It relocates the fight to where it belongs: before bind, on shared evidence, with tiers and testable assumptions visible — then closes the debate into a named L0 commit with monitors, triggers, and a contest path afterward. Much of what passes for “politics” is the expensive re-enactment of debates that never happened on the record — or the personal reopening of questions that should have been triggered by observables instead of by rank.
That frees hard decisions of a large share of their poison — not by making them easy, but by making them auditable, revisitable, and survivable. Strategy and architecture become places where you can still lose an argument and win the organisation: because the log shows you were heard, the tier was honest, assumptions were named, and the future can correct on schedule — without erasing the past and without making revision a personal trial.
The Genesis series began with truth’s status untracked. Honest decision logs — together with the Architectural Decision Log — (A)DR — are how organisations track it when humans commit under uncertainty.