Skip to content

Intake Pause

Protocol — instantiates Net-Additive Contribution Intake

A pre-authorized stop that halts all new intake when protected work, sponsor bandwidth, or maintenance capacity is at risk — trading incoming help for the primary work already underway.

The Intake Pause is a pre-authorized stop lever: a standing, legitimate authority to temporarily halt all new contribution intake when the system's protected work is under threat. It is deliberately binary. Where other mechanisms filter, sort, or redirect the stream, the pause simply closes the door for a defined stretch — because the specific danger it addresses is not a bad offer but too much intake at once, where even good offers displace the primary work that must not slip. Its defining feature is that the authority to stop is granted in advance, so pulling it is a legitimate operational act rather than an awkward ad-hoc apology, and the trigger is tied to an explicit read of how badly incoming help is starting to crowd out core work.

Example

A disaster-relief organization opens a donation and volunteer intake after a flood. Within days it is overwhelmed: unsolicited goods pile up faster than they can be sorted, walk-up volunteers need supervising by the very staff running the actual relief, and the core work — getting supplies to shelters — is visibly slipping. Rather than let goodwill quietly sink the operation, the incident lead invokes a pre-agreed Intake Pause: new material-donation and walk-up volunteer intake is closed for 72 hours, announced plainly ("we are at capacity; please hold offers until [date]"), with a stated resume condition — the sorting backlog cleared and supervisors freed.

The pause is not a rejection of anyone; it is a protection of the shelters. Because the authority was arranged in advance, the lead pulls it without hesitation or reputational cost, the relief work catches up, and intake reopens on schedule instead of collapsing under its own inflow.

How it works

What distinguishes the pause from ordinary triage is that it is a system-wide, pre-authorized off switch:

  • A watched trigger. The pause is tied to an explicit signal that core work is being displaced — a backlog crossing a line, a coordination budget spent, supervisors pulled off primary tasks.
  • Pre-granted authority. Who may pull the lever, and under what conditions, is decided before the crisis, so invoking it is legitimate rather than improvised (an andon-cord style stop).[1]
  • A bounded stop with a resume condition. The pause names when and how intake reopens, so it protects core work without silently hardening into permanent closure.

Tuning parameters

  • Trigger sensitivity — how much displacement of core work is tolerated before the pause fires. A hair-trigger over-protects and frustrates willing contributors; a slow one lets primary work slip before help stops arriving.
  • Pull authority — who can invoke it, and how many approvals it takes. Broad authority means the stop is available when it's needed; narrow authority prevents overuse but may leave no one able to pull it in the moment.
  • Scope — whether the pause halts all intake or only the overloaded category. A total stop is simple and unambiguous; a selective one keeps useful streams open at the cost of a subtler rule.
  • Resume condition — what must be true to reopen, and any default duration. A concrete condition prevents an indefinite quiet closure; a fixed timer is simpler but blind to whether the pressure has actually eased.

When it helps, and when it misleads

Its strength is that it protects primary work from being drowned by well-meant help, and it makes stopping legitimate — a declared, bounded pause preserves far more goodwill than the alternative, which is silently ghosting a flood of offers the system can no longer manage.

It misleads when the "temporary" stop is left on. A pause with no real resume condition becomes a de-facto closure that no one ever announced, and the backlog and contributor goodwill both decay behind it. Triggered too readily, it also trains contributors that the door is usually shut. The discipline that keeps it honest is a bounded duration paired with an explicit, checked resume condition — a pause must always be a pause, not closure by neglect.

How it implements the components

The Intake Pause realizes the protect-and-halt components — the ones a stop protocol owns:

  • protected_primary_work_boundary — the pause exists to defend this boundary; halting intake is the act that keeps incoming help from crossing it.
  • coordination_budget — it is triggered when the coordinator's finite bandwidth (sponsor, supervision, maintenance capacity) is spent, making the budget the thing the pause guards.
  • core_work_displacement_signal — the pause is armed to a read of how much intake is crowding out primary work; that signal is its trigger condition.

It does not send the paused offers anywhere — relocating surplus to alternates is Overflow Redirection — and it does not communicate individual refusals, which belong to Clean Rejection Notice.

Notes

The pause is a blunt, system-wide stop for acute overload. For a system that is chronically over capacity rather than momentarily spiking, redirection (Overflow Redirection) or a tighter standing screen is the better tool — reaching for the pause repeatedly is a sign the steady-state intake rule needs fixing, not that the brake needs pulling more often.

References

[1] The andon cord of the Toyota Production System — any worker's pre-authorized right to stop the line when something is wrong. Its power comes from the authority being granted in advance, so stopping is a legitimate act rather than an escalation; the Intake Pause borrows exactly that pre-authorization. ↩