Skip to content

Stop-or-Scale-Back Gate

Decision gate — instantiates Eventual-Occurrence Containment Design

A pre-committed rule that halts or throttles operation the moment cumulative risk crosses a set line, so stopping doesn't depend on someone finding the nerve in the moment.

All the modelling in this archetype is inert unless something acts on it. Stop-or-Scale-Back Gate is the pre-committed rule that does: it names, in advance, the line of cumulative risk or observed harm at which operation must stop or scale back — and, at a lower line, the threshold at which the design's posture flips from mostly-prevent to actively-contain. Its defining feature is that the decision is made before the pressure, not during it. When the horizon math or the incident rate crosses the line, the gate fires by rule: there is no debate to lose, no optimism to indulge, no sunk cost to protect. It converts "we should probably slow down" — a sentiment that reliably loses to momentum — into a commitment that binds.

Example

A clinical trial defines, before enrolling anyone, a pre-specified stopping rule: if serious adverse events cross a set statistical boundary, enrollment halts and the trial pauses for review. Midway through, the boundary is crossed. Because the rule was fixed in the protocol and monitored by an independent board, the trial stops — automatically — without the sponsors (who have every incentive to continue) getting to relitigate whether this signal really counts. A softer, earlier threshold had already switched the trial's posture weeks before: extra monitoring and tighter data review kicked in when the event rate first drifted upward, well short of the hard stop.

The gate's whole value is that the hardest decision — to halt something with momentum and money behind it — was made by people without skin in the game, in advance, when they could still think clearly. In the moment, that decision almost never gets made; pre-commitment is what makes it survivable.

How it works

  • Pre-commit the criteria, in writing, before operation starts: the hard stop line (cumulative risk or harm at which you halt) and the softer posture-switch line (at which you shift from prevention-led to containment-led and add scrutiny).
  • Bind the criteria to a monitored signal — an incident rate, a cumulative-probability estimate, an exposure count — so a crossing is observed, not argued.
  • Make firing low-friction and hard to veto: the default on a crossing is stop-or-scale-back, and any override must be explicit, logged, and accountable.
  • Define the path back: what must be true — a fix, a re-assessment — before operation resumes past the gate.

Tuning parameters

  • Where the lines sit — how much cumulative risk triggers the posture switch and the hard stop. Lower lines are safer but stop good operations too often; higher lines run hotter. This is the core dial and the one most bargained against.
  • Stop vs. scale-back — a full halt or a throttle (reduce volume, restrict scope, add controls). Scale-back preserves value under uncertainty; a full stop is unambiguous but costly.
  • Override friction — how hard it is to overrule a firing. High friction protects the gate's whole purpose; too high and a genuinely wrong stop can't be corrected.
  • Monitoring independence — whether the party watching the signal has a stake in continuing. Independent monitors resist the pressure to explain a crossing away; embedded ones react faster but bend.
  • Reset condition — how demanding the bar to resume is. A strict bar prevents premature restart; too strict and the gate becomes a permanent, ignored roadblock.

When it helps, and when it misleads

Its strength is that it defeats the specific human failure this archetype is up against: in the moment, with momentum and sunk cost pushing forward, almost no one voluntarily stops — so the decision has to be pre-committed to a rule and, ideally, handed to someone without skin in the game. The gate is where all the upstream risk numbers finally get teeth.

Its failure modes are about the line and the will to honour it. A stop line set so high it never fires is security theatre; one that fires constantly gets habitually overridden until the override is the real policy and the gate is decorative. The classic misuse is waiving it under pressure — the exact moment it exists for — or, run backwards, setting the threshold after looking at the data so it lands just beyond wherever operations already are. The discipline that keeps it honest is to fix the criteria before operation and before the data, to give the monitoring to a party that does not benefit from continuing, and to log and review every override so an eroding gate stays visible.[1]

How it implements the components

  • stop_operation_criterion — the gate is the pre-committed rule for halting or scaling back when risk or harm crosses the hard line.
  • posture_switch_threshold — it also carries the softer line at which the design shifts from prevention-led to containment-led and adds scrutiny, short of a full stop.

It only decides to stop, throttle, or switch posture. The cumulative-risk number it triggers on comes from Repeated-Trial Probability Calculator and Cumulative Risk Horizon Table; the residual-risk record it weighs is Probabilistic Safety Assessment's; and the containment that runs once it fires belongs to siblings like Automatic Isolation Trip.

Notes

Distinguish the gate from its automatic cousin: Automatic Isolation Trip fires a machine response (cut the connection, drop the load) in milliseconds to contain a failure already underway; this gate is a governance decision — halt or scale back the whole operation — made against accumulating risk, often before any single failure. One protects against the incident in progress; the other protects against continuing to run a system whose horizon-scale odds have quietly become unacceptable.

References

[1] A pre-specified stopping rule — a criterion fixed in advance (as in clinical-trial protocols monitored by an independent data-safety board) that commits the operator to halt when a stated boundary is crossed, precisely so the decision is not made under in-the-moment pressure by a party invested in continuing. ↩