Control-Removal Burden of Proof¶
Governance rule — instantiates Calm-State Fragility Guarding
Flips the default so that relaxing or removing a long-quiet control requires positive proof it is safe, rather than a stretch of silence being taken as permission.
This is a standing rule about who has to prove what when someone proposes to remove, weaken, or waive a control that has been quiet for a long time. The intuitive argument during calm is seductive — "this check has never caught anything in five years, so it is overhead we can cut." The burden-of-proof rule inverts the default: the control stays unless the party proposing to remove it can positively demonstrate that its protection is no longer needed. Its defining move is procedural, not analytical — it does not measure the risk itself, it decides which way the doubt cuts. Silence is treated as the control doing its job, not as evidence the job is unnecessary, so the very calm that tempts removal becomes the reason removal must clear a high bar.
Example¶
An airline's engineering team proposes dropping a recurring inspection from a maintenance program — a borescope check that, in eight years, has never once found the crack it looks for. Under a burden-of-proof rule, "it never finds anything" is not an argument for removal; it may be exactly why nothing has failed. To retire the task, the proposer must show affirmatively — via the manufacturer's data, fleet-wide findings, and a documented engineering rationale — that the failure mode is genuinely covered by other means. Here the analysis shows the check is partly redundant but still the sole detection for one crack location, so it is trimmed in frequency rather than removed, and the change is formally re-authorized and recorded. The default did the work: absent proof, the guard would simply have stayed.
How it works¶
- Assign the burden to the remover. The party proposing to relax a control produces the evidence; keeping it requires no justification.
- Treat quiet as protection, not redundancy. A long incident-free run is read as the control working, and explicitly not as grounds for removal.
- Require affirmative, recorded proof. Removal proceeds only on documented evidence that the risk is otherwise covered, logged as a decision someone owns.
- Re-authorize, don't drift. Any reduction in posture is an explicit, dated decision passing through a gate — never an erosion that simply accumulates.
Tuning parameters¶
- Proof bar height — how much evidence removal demands; a high bar preserves protection but can ossify genuinely obsolete controls, a low bar frees resources but invites drift.
- Scope of coverage — which controls fall under the rule; applying it to everything is safe but sclerotic, reserving it for safety-critical controls keeps it proportionate.
- Approver independence — whether the remover's own manager signs off or an independent safety authority must; independence resists local pressure to cut.
- Sunset vs. standing — whether trimmed controls get a review date or a permanent decision; sunsets force reconsideration but add churn.
- Waiver expiry — how long a granted removal or relaxation stays valid before it must be re-proven, so a one-time approval cannot silently become forever.
When it helps, and when it misleads¶
Its strength is that it directly counters the single most common way calm manufactures fragility — the steady, reasonable-sounding removal of protections that "never do anything" until the day one of them would have. It preserves a floor of readiness and forces every relaxation to be a visible, owned choice; it is the precautionary default applied to a system's own safeguards.[n1] Its weakness is that applied bluntly it ossifies — genuinely obsolete controls survive purely because no one can be bothered to clear the proof bar, and cost accretes. The classic misuse is the rule invoked selectively to block changes someone dislikes for other reasons, dressed up as safety. The discipline that guards against both is to pair the rule with a real, funded path to retire controls that do clear the bar, so the default protects without freezing the system, and to keep the proof standard proportionate to what each control actually guards.
How it implements the components¶
calm_period_reauthorization_gate— it is the gate: no long-quiet control is relaxed without an explicit, evidenced re-authorization passing through it.readiness_floor— by holding controls in place absent proof, it maintains the minimum protective posture below which the system is not allowed to quietly sink.
It sets the rule; it does not measure the drift that should trigger it — the exposure and slack meters are slack_erosion_guardrail and utilization_or_leverage_cap, which also govern the standing risk-appetite reset — nor does it assess overall readiness, which is calm_period_readiness_review, or rehearse the response it protects.
Related¶
- Instantiates: Calm-State Fragility Guarding — it stops the quiet, rational erosion of protections that a long calm invites.
- Consumes: calm_period_readiness_review supplies the readiness picture a removal proposal is judged against.
- Sibling mechanisms: calm_period_readiness_review · slack_erosion_guardrail · utilization_or_leverage_cap · Game Day Exercise · Tabletop Exercise · minor_stressor_learning_review
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Flips the default so that relaxing or removing a long-quiet control requires positive proof it is safe, rather than a stretch of silence being taken as permission, making its operative form a standing rule, threshold, contractual commitment, or policy constraint governing future conduct.
Independent corroboration: The frozen evidence defines Control-Removal Burden of Proof as 'Flips the default so that relaxing or removing a long-quiet control requires positive proof it is safe, rather than a stretch of silence being taken as permission', so its operative form is Rule, Policy & Commitment.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Law & Governance
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Procedural law cohered burden-of-proof rules that determine which way uncertainty cuts when a party seeks to alter the status quo.
Related originating lineages:
- Engineering & Design — Safety engineering applies the rule to require affirmative retirement evidence for quiet safeguards.
- Philosophy — The precautionary principle supplies the normative default that absence of observed harm is not proof of safety.
Review resolution: Burden-of-proof rules are juridical in origin; safety engineering and the precautionary principle jointly explain why uncertainty defaults toward retaining a safeguard until affirmative retirement evidence exists.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- The Future We Want: Rio Principle 15 and the Precautionary Approach
- HSE General Principles of Good Control Practice
Notes¶
[n1] The precautionary principle — where an action risks serious harm and the evidence is unsettled, the burden of proving it safe falls on the party taking the action, not on those who would be harmed. Here the "action" is removing a safeguard, and the rule places that burden on the remover. ↩