Migration Resistant Hazard Control

Reduce the pressure that generates a hazard and measure outcomes across every plausible destination so local blocking cannot pass as genuine risk reduction.

Why this archetype exists

A control can be locally effective and systemically ineffective at the same time. It may stop a hazardous expression at the point where the organization is looking while leaving intact the demand, load, incentive, source, conflict, contaminant, or adversarial objective that generated it. That unresolved pressure seeks another outlet. It can move to a neighboring place, another actor, a substitute product, a different interface, a later lifecycle phase, or a population with weaker safeguards.

This archetype prevents location-of-harm change from being mistaken for amount-of-harm reduction. Its distinctive unit of analysis is not the barrier alone but the complete sequence:

local control → unresolved generative pressure → transfer or return path → destination burden → weaker observation or accountability → apparent local success

The intervention succeeds only when it reduces or safely absorbs the pressure and produces a defensible decline in system-wide burden across an adequate time window.

Structural diagnosis

Risk migration is more specific than ordinary propagation. A hazard does not merely spread from an unchanged source; the intervention changes the route by blocking one expression. It is also more specific than leakage. Leakage can be a boundary defect, whereas migration includes a causal rerouting of unresolved pressure and often a change in who bears the harm. The signature commonly includes measurement asymmetry: the protected site has better data and stronger control than the destination, so organizational reporting improves precisely as the burden becomes harder to see.

The diagnosis should answer five questions:

1. What pressure remains after the control acts? This might be unmet demand, adversarial value, contaminant production, workload, financial exposure, conflict, scarcity, or a selection pressure.
2. Which manifestations are substitutes? The hazard may change location, target, channel, actor, timing, ownership, or category.
3. Where can it go? Map direct and multi-hop destinations, including informal, offshore, private, delayed, and low-observability zones.
4. Who becomes more vulnerable? A numerically similar burden can be more harmful where recovery capacity, control, voice, or support is weaker.
5. What would count as genuine reduction? Define a whole-system criterion before rollout, not after the local metric improves.

Intervention logic

The first move is to widen the accounting boundary beyond the control boundary. The second is to establish a baseline vector of burden rather than one focal number. The third is to instrument destination sites with comparable definitions and time windows. The fourth is to redesign the intervention around pressure reduction or safe absorption. The final move is governance: create a trigger that can pause, roll back, or redesign a control when it displaces risk.

Stronger barriers are not automatically stronger solutions. When pressure remains, a stronger barrier can increase rerouting, concentration, concealment, adaptive evasion, or stored-load rupture. Migration-resistant control therefore combines bounded protection with upstream work: reduce the source, provide a safe alternative channel, add legitimate capacity, remove the payoff, resolve the unmet need, remediate the contaminant, or redesign the process that continually recreates exposure.

Required components

Generative Hazard-Pressure Model

Represents the demand, incentive, load, adversarial objective, unmet need, contaminant source, or other upstream process that continues to generate the hazard even after one manifestation is blocked.

The model must distinguish the hazard manifestation from the process that replenishes it. A falling local incident count is not evidence that the pressure fell.

Migration-Field Model

Defines the set of sites, actors, channels, phases, jurisdictions, populations, and time windows to which the hazard can relocate after intervention.

The field should include low-observability and low-control destinations, not only administratively convenient units. Unknown destinations remain explicit residual-risk zones.

Accounting Boundary

States where hazard burden, exposure, control effort, and compensating effects will be counted so local success cannot be reported outside a system-level ledger.

Reuse the existing Conservation Accounting component. For this archetype the boundary should be wider than the control boundary whenever credible return or transfer paths cross it.

Transfer Path

Maps the physical, informational, behavioral, contractual, market, spatial, temporal, or organizational routes through which pressure or hazard burden can move.

Reuse the existing component. Include indirect substitution and multi-hop return paths, not only direct leakage across the nearest boundary.

Destination Vulnerability Map

Records how candidate destination sites differ in exposure, absorptive capacity, control strength, visibility, recovery resources, and political voice.

Equal event counts can imply unequal harm. Weighting should be transparent and contestable, especially where migration targets populations with weaker safeguards.

Displacement Monitor

Detects increases in hazard burden, precursors, substitutions, or evasive behavior outside the focal intervention site.

Reuse the existing Harmful Emergence Containment component, expanding it into a migration-field sentinel design with comparable pre/post measures.

Measurement Symmetry Rule

Requires comparable definitions, denominators, severity scales, and observation windows at the protected site and plausible destination sites.

A control must not claim success by improving measurement where it acts while allowing burden to move into places where measurement is absent or categorically different.

Local-vs.-System Outcome Crosscheck

Compares the local control metric with total and distribution-weighted hazard burden across the migration field, including lagged effects and uncertainty.

The crosscheck should show both aggregate change and who gains or loses. Non-comparable harms should be presented as a vector or scenario range rather than forced into a false scalar.

Pressure-Absorption Path

Specifies how the intervention reduces, safely dissipates, converts, services, or otherwise resolves the generative pressure instead of merely blocking its current outlet.

Examples include source removal, demand reduction, safe capacity addition, upstream redesign, legitimate alternative channels, remediation, or governed dissipation. Pure transfer is not absorption.

Whole-System Impact Map

Connects the focal control, source pressure, transfer paths, destination vulnerabilities, secondary controls, and downstream outcomes in one reviewable representation.

Reuse the existing Boundary Critique Audit component. The map is the shared object for engineering, operations, policy, affected-party, and governance review.

Adaptive Circumvention Monitor

Tracks whether strategic or evolving agents change tactics, identity, channel, timing, target, or population composition in response to the control.

When selection around a barrier becomes the dominant mechanism, link to the accepted child prime Vaccine Escape rather than treating all adaptation as generic displacement.

Stop-and-Redesign Trigger

Defines when observed or plausible migration invalidates the local intervention and requires pause, rollback, boundary expansion, or source-pressure redesign.

Triggers should include net-risk non-improvement, concentration in more vulnerable destinations, uncontrolled return paths, sink saturation, and loss of measurement coverage.

Accountability Owner

Assigns responsibility for system-wide outcomes across the migration field rather than only performance at the initiating site.

Reuse the existing component. The owner needs authority to request cross-boundary data, convene affected parties, change the intervention, and fund mitigation or restoration.

Residual-Risk Register

Records unobserved destinations, uncertain conversions between harm types, delayed effects, unresolved pressure, and assumptions that could hide continued migration.

Unknown does not mean zero. The register should influence rollout scale, monitoring investment, contingency reserves, and review cadence.

Optional components

Optional components become important when transfer is unavoidable, boundaries are contested, effects are delayed, or authority is fragmented. A Risk Transfer Boundary distinguishes honest residual-risk allocation from hidden displacement. A Boundary Assumption Log makes exclusions reviewable. Variance or Leakage Signals and Tolerance Thresholds support quantitative reconciliation where the units are defensible. Compensation and Restoration address harms that occurred despite prevention, while cross-boundary coordination keeps downstream units from being left with responsibility but no authority or resources.

Common mechanisms

Causal Loop Diagram

Type: method

Maps how the intervention, source pressure, local suppression, substitution, destination burden, enforcement, and feedback influence one another over time.

Mass Balance

Type: method

Reconciles a genuinely conserved material, energy, inventory, financial, or workload quantity across source, transfer, storage, transformation, and sink.

Whole-System Impact Map

Type: artifact

Provides a shared visual representation of protected sites, excluded zones, transfer routes, affected parties, and downstream consequences.

Hazard Analysis

Type: test_or_assessment

Identifies hazard states, initiating events, exposure pathways, controls, secondary effects, and plausible post-control destinations.

Fault Tree Analysis

Type: method

Traces combinations of control behavior and return paths through which an apparent local success can still produce system-level harm.

Cross-Boundary Hazard Ledger

Type: document

Tracks baseline and post-intervention burden, severity, exposure, transfers, uncertainty, and accountability across the migration field.

Migration Sentinel Network

Type: metric_or_dashboard

Places comparable leading and lagging indicators at plausible destination sites, including low-control and low-visibility regions.

Before–After–Elsewhere Evaluation

Type: test_or_assessment

Compares the protected site before and after intervention with plausible destination sites over matched observation windows.

Pressure-Absorption Redesign Workshop

Type: workflow

Reframes a blocking control around the source of generative pressure and develops source-reduction, safe-service, dissipation, or capacity alternatives.

Intervention Displacement Stress Test

Type: test_or_assessment

Challenges a proposed control with substitution, rerouting, timing shifts, actor shifts, jurisdiction shifts, and sink-saturation scenarios before rollout.

Adaptive Circumvention Red Team

Type: role_or_team

Simulates how strategic or evolving actors may evade, mutate around, arbitrage, or relocate in response to the control.

System-Wide Net-Risk Dashboard

Type: metric_or_dashboard

Displays local outcomes beside total burden, distribution, destination vulnerability, uncertainty, lagged indicators, and unresolved source pressure.

Cross-Jurisdiction Incident Review

Type: ritual

Reviews whether a control in one unit, market, region, or phase contributed to incidents elsewhere and assigns corrective actions across owners.

Source-Reduction or Safe-Dissipation Plan

Type: document

Specifies how the pressure is removed, reduced, converted, safely absorbed, or served through a legitimate alternative rather than displaced.

Agent-Based Experiment or Simulation

Type: software_or_tool

Explores heterogeneous adaptation, channel switching, target substitution, control escalation, and spatial or network relocation under competing policies.

Boundary Expansion Review

Type: workflow

Reopens the measurement and responsibility boundary when unexplained residuals or destination signals indicate the original scope was too narrow.

Mechanisms must be combined. A ledger without destination sentinels can reconcile only what is already visible. Sentinels without a pressure model can document displacement without changing it. A red team without a stop rule produces findings that operations can ignore. The archetype is the coordinated reasoning pattern that binds those mechanisms to a system-level outcome claim.

Parameter dimensions

Important dimensions include pressure persistence, substitution elasticity, path permeability, transfer cost, number of destinations, observability, destination vulnerability, control heterogeneity, adaptation speed, lag length, sink capacity, causal confidence, authority fragmentation, reversibility, and the comparability of harm types.

A fast, adaptive digital system needs continuous destination sensing and adversarial testing. A slow environmental or infrastructure system needs long lag windows, lifecycle accounting, and funded restoration. A cross-jurisdiction policy needs shared definitions and an owner with convening authority. A domain with non-substitutable rights or harms should use a vector of outcomes and hard constraints rather than a weighted total alone.

Invariants to preserve

The focal site cannot improve by silently worsening a weaker destination. Measurement must follow plausible migration paths. Accountability must follow burden. Unknown destinations and uncertain conversion rules remain visible. Essential services, legitimate access, privacy, due process, and safety remain protected. The control retains pause, rollback, remedy, and restoration pathways. Source-pressure reduction is demonstrated independently of local manifestation counts.

Target outcomes

The desired result is not zero incidents in one dashboard. It is lower total and distribution-weighted burden, fewer substitute manifestations, reduced recurrence, earlier discovery of return paths, and an honest distinction among elimination, reduction, storage, conversion, and transfer. A mature intervention also improves institutional accountability: downstream units receive data, authority, resources, and remedy rather than inherited risk without support.

Variants and naming policy

Spatial, actor, temporal, and channel displacement are retained as variants because the destination dimension changes implementation while preserving the same causal structure. Adaptive Barrier-Circumvention Response is a promotion candidate because selection changes the population and deserves Vaccine Escape-specific coverage. Capacity-Matched Governed Transfer is merge-sensitive: when transfer is explicit, consented, and capacity-tested, existing risk-transfer, sequestration, or governed-sink archetypes may be the proper parent.

“Risk Migration Control” is the direct alias. “Hazard-Pressure Absorption” names the preferred source-level move but omits monitoring and distribution. “Before–After–Elsewhere” is an evaluation mechanism, not the archetype itself.

Sanctuary Effect remains separate. A sanctuary is a low-contestation zone where an adversary regenerates and returns; risk migration is a burden relocated by the control. The two can interact when a control creates or strengthens the refuge, but neither should be collapsed into the other.

Tradeoffs and failure modes

The largest practical tradeoff is scope versus actionability. A boundary that is too narrow rewards local offloading; one that is too broad can make causality and ownership impossible. The design should expand along credible transfer paths, not toward an abstract “everything is connected” totality.

Common failures include local-metric victory, pressure-model omission, measurement asymmetry, vulnerability-blind aggregation, unobserved destinations, whack-a-mole escalation, adaptive circumvention, stored-load rupture, authority gaps, false conservation assumptions, surveillance overreach, and transfer mislabeled as elimination. The required mitigations are built into the component set: symmetric measurement, destination vulnerability, residual-risk logging, causal alternatives, a cross-boundary owner, and a stop/redesign trigger.

Neighbor distinctions

Conservation Accounting supplies the ledger but not the intervention redesign. Boundary Critique Audit and Boundary Reframing widen scope but do not require source-pressure reduction. Boundary Permeability Control, Diffusion Containment, Sequestration Containment, and Bulkhead Isolation control crossing, spread, or storage; each can create migration if evaluated too locally. Harmful Emergence Containment includes displacement as a guardrail, whereas this archetype makes displacement the central problem signature. Externality Internalization assigns outside costs but may not follow return paths or intervention-induced substitution. Entropy Export can be legitimate when a sink is explicit, governed, and capable; hidden export is migration. Risk Pooling vs. Reinsurance Layering Strategy is explicit allocation, not unacknowledged relocation.

The previous queue draft Agent–Environment Co-Shaping is also distinct. It manages environments that agents construct and later inherit. Migration-resistant control addresses what happens when a hazard-control boundary redirects unresolved pressure. A constructed environment can create migration, and migration controls can reshape environments, but their causal centers differ.

Examples and non-examples

The same test applies across domains: did the intervention reduce the source and the whole burden, or did it only move the expression? A cyber block that removes attacker payoff and monitors substitute channels fits. A place-based safety control that tracks adjacent sites, time shifts, targets, and reporting fits. A financial limit that follows exposure into affiliates and future liquidity events fits. A supply-chain rule that checks lower tiers and funds upstream capacity fits.

A verified source removal is not risk migration. Ordinary diffusion from an independent source is not risk migration. A misconfigured boundary leak is not necessarily migration. A pre-existing inaccessible refuge is Sanctuary Effect. Selection for resistant variants is the Vaccine Escape child pattern. A transparent, consented, capacity-matched transfer belongs primarily to the relevant transfer or containment archetype.

Common Mechanisms

• Adaptive Circumvention Red Team — Plays the motivated adversary against a control to find how it will be evaded and which under-defended destination the blocked pressure will be pushed toward.
• Agent-Based Experiment or Simulation — Plays the arms race forward in silico — a population of heterogeneous adaptive variants meets a candidate barrier portfolio over many rounds, so escape dynamics surface in simulation before they surface in the field.
• Before–After–Elsewhere Evaluation — Measures the target outcome before and after at the intervention site and — the defining addition — at the places the hazard could have moved to, so a local win cannot pass as reduction until 'elsewhere' clears too.
• Boundary Expansion Review — Deliberately widens the evaluation boundary until it contains the whole system that generates and receives the hazard, so a control cannot score a win by pushing the hazard just past where anyone is counting.
• Causal Loop Diagram — Draws the pressure behind a hazard, the feedback loops that regenerate it, and the delays between them, so a control can be aimed at the loop rather than the symptom it displaces.
• Cross-Boundary Hazard Ledger — A standing double-entry record that follows the hazard across every boundary, so a reduction booked in one place must reconcile against system totals or stand exposed as a mere transfer.
• Cross-Jurisdiction Incident Review — A recurring convening where separately-accountable jurisdictions pool their incident data, so a hazard that slips across the seam between them gets caught, owned, and made good instead of falling into the gap no one answers for.
• Fault Tree Analysis — Decomposes a single system-level harm downward through logical gates until the transfer path — and the exact boundary where risk crosses out of the controlled unit — becomes explicit.
• Hazard Analysis — Enumerates the hazards a control leaves behind — including the ones it displaces — and holds each residual against an explicit tolerance rather than against whatever the current design happens to achieve.
• Intervention Displacement Stress Test — A pre-deployment probe that grants the control its local success and asks the harder question — where would the blocked pressure go, who would absorb it, and how long until it surfaces — before you commit.
• Mass Balance — Applies conservation bookkeeping across a declared boundary so a hazard that 'disappears' from one channel must reappear as an outflow somewhere — and the unaccounted gap localises the leak.
• Migration Sentinel Network — A distributed set of watch-points placed at a hazard's likely destinations, giving early warning when a suppressed hazard reappears somewhere new rather than having genuinely gone away.
• Pressure-Absorption Redesign Workshop — A facilitated redesign session that, once a control is caught merely rerouting a hazard, reworks the system to give the residual pressure a safe place to go instead of a taller wall to push against.
• Source-Reduction or Safe-Dissipation Plan — A plan that attacks the pressure generating a hazard at its source — lowering the demand, load, or incentive that drives it — so there is less hazard to migrate at all, held to a stated tolerance for any residual that remains.
• System-Wide Net-Risk Dashboard — Sets local barrier performance beside system-wide net harm — displaced risk, shifting variant mix, uncertainty, and who bears the burden — so a control that looks like it is winning locally cannot hide that protection is decaying or merely moving.
• Whole-System Impact Map — Lays a control's full field of consequences — direct, indirect, delayed, and cross-boundary — on one artifact, so a local win can be netted against the system-wide effect that hides the displaced burden.

Compression statement

When a control suppresses a hazard at one site but leaves its source pressure intact, assume the burden may move across spatial, organizational, channel, actor, or temporal boundaries. Define the migration field, map transfer and return paths, establish measurement symmetry, compare local outcomes with distribution-weighted system burden, and redesign the intervention around source reduction, safe absorption, or explicitly governed transfer. Pause or reverse controls that improve the focal metric while preserving or worsening total risk.

Canonical formula: Let P be generative pressure, C a local control, H_i hazard burden at site or phase i, T_ij feasible transfer paths, V_i destination vulnerability weights, and U uncertainty. A valid reduction requires evidence that P decreases or is safely absorbed and that the post-intervention vector {H_i} across the migration field declines within an adequate lag window. Local ΔH_focal < 0 is insufficient when Σ(V_i·H_i) is unchanged, higher, incomparable, or hidden by U.

Related Abstractions

Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.

Built directly on (5)

• Boundary: Defines system limits.
• Conservation Laws: Quantities remain constant.
• Observability: Infer internal state externally.
• Risk: Exposure to a known distribution of possible outcomes.
• Risk Migration: An intervention that blocks a hazard at one site without absorbing the generative pressure behind it does not eliminate the hazard but relocates it across a permeable boundary to a less-monitored region, often where controls are weaker and measurement does not follow.

Also references 17 related abstractions

• Accountability: Responsibility for actions.
• Blockage Release Dynamics: A barrier stores accumulating flow until it fails, converting steady load into a single discontinuous release far larger than the original flow.
• Containment: Holding a hazard, process, or agent within a deliberately maintained perimeter to prevent its spread or uncontrolled interaction with the surroundings.
• Escape and Leakage: Constrained quantities exit through unintended pathways.
• Exposure Pathway: The chain of links by which a hazard travels from source to vulnerable target, breakable at any link, turning risk into a graph search over severable routes.
• Externality: Spillover effects.
• Feedback: Outputs influence inputs.
• Measurement: Mapping a target's attribute onto a scale via an instrument and procedure, yielding a value-plus-uncertainty tied to a unit and frame.
• Permeability: A bounded medium selectively passes some carrier through connected pathways.
• Propagation: The systematic spreading of a signal, effect, or state from a source through a medium or network, where the medium's structure governs how fast it moves, how it attenuates, and which paths it follows.

▸ Show 7 more

Variants

Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.

Spatial or Jurisdictional Displacement Control · scale variant · recognized

Prevents a locally blocked hazard from moving to another neighborhood, facility, region, market, or jurisdiction with weaker controls or visibility.

• Distinct from parent: The parent covers any destination dimension; this variant foregrounds geography, jurisdiction, and cross-border governance.
• Use when: Controls differ sharply across places or jurisdictions; The hazard, activity, or provider can relocate at lower cost than the control can coordinate; Local metrics improve while adjacent or offshore indicators worsen.
• Typical domains: public policy, environmental management, public safety, finance, supply chain
• Common mechanisms: migration sentinel network, cross jurisdiction incident review, before after elsewhere evaluation

Actor or Population Burden-Shift Control · governance variant · recognized

Detects and prevents interventions that lower risk for one actor by moving exposure, cost, work, liability, or failure onto another actor or population.

• Distinct from parent: The parent is destination-general; this variant emphasizes distribution, consent, liability, and power.
• Use when: Contracting, automation, eligibility rules, insurance, outsourcing, or organizational restructuring changes who bears downside; The receiving population has weaker monitoring, bargaining power, or recovery capacity.
• Typical domains: labor, healthcare, insurance, platform governance, supply chain
• Common mechanisms: cross boundary hazard ledger, whole system impact map, system wide net risk dashboard

Temporal or Lifecycle Displacement Control · temporal variant · recognized

Prevents a control from deferring hazard into a later phase, maintenance cycle, cohort, or failure event while declaring success inside a short evaluation window.

• Distinct from parent: The parent covers any migration dimension; this variant requires lag, accumulation, inheritance, and terminal-state accounting.
• Use when: The intervention stores load, debt, contamination, deferred work, or unresolved demand; Effects may reappear after monitoring ends, ownership changes, or a barrier fails.
• Typical domains: maintenance, finance, environmental management, software engineering, infrastructure
• Common mechanisms: cross boundary hazard ledger, fault tree analysis, source reduction or safe dissipation plan

Channel or Subsystem Migration Control · implementation variant · recognized

Prevents a hazard blocked in one interface, route, market, workflow, or subsystem from reappearing through a substitute channel or weakly coupled return path.

• Distinct from parent: The parent is broader; this variant emphasizes topology, routing, interoperability, and cross-channel observability.
• Use when: Multiple channels serve the same underlying demand or adversarial objective; Controls have uneven coverage across interfaces, protocols, products, or organizational units.
• Typical domains: cybersecurity, platform governance, operations, finance, communications
• Common mechanisms: causal loop diagram, intervention displacement stress test, adaptive circumvention red team

Adaptive Barrier-Circumvention Response · risk or failure variant · promote to full archetype candidate

Counters the compositional shift produced when a durable barrier removes susceptible variants and thereby selects for variants it cannot engage.

• Distinct from parent: Generic risk migration can occur without adaptation; this form requires selection, inheritance or learning, and coverage decay.
• Use when: The hazard-producing population reproduces, learns, mutates, or strategically adapts; Control effectiveness falls because population composition changes, not merely because activity moves location.
• Typical domains: biology ecology, cybersecurity, fraud control, platform governance
• Common mechanisms: agent based experiment or simulation, adaptive circumvention red team, system wide net risk dashboard

Capacity-Matched Governed Transfer · governance variant · merge review

Makes an unavoidable transfer explicit, consented, capacity-matched, monitored, compensated, and reversible rather than presenting it as elimination.

• Distinct from parent: The parent seeks migration-resistant reduction; this form manages residual transfer when source elimination is infeasible.
• Use when: Some burden cannot be eliminated at the present decision scale; A receiving actor, reserve, sink, insurer, or jurisdiction can genuinely absorb it under defined limits.
• Typical domains: insurance, waste management, infrastructure, incident response
• Common mechanisms: cross boundary hazard ledger, source reduction or safe dissipation plan

Near names: Risk Migration Control, Displacement-Aware Risk Reduction, Risk-Relocation Prevention, Hazard-Pressure Absorption, Migration-Resistant Intervention Design, Before–After–Elsewhere Control.