Basins and walls

An organisation occupies a basin: a stable configuration that its constraints hold in place. The target of a transformation is another basin, a durable state the organisation can hold once it arrives, not a milestone it passes through. Between the two stand walls, and for the programmes worth treating this way the target is infeasible at the outset because at least one wall has no room in it. The work of transformation is manufacturing feasibility: relaxing the wall that binds, and then crossing when the slack has run out and not before.

Walls are concrete, not abstract. A wall is a bonus structure that rewards the old behaviour, a pricing engine that cannot represent the new product, a supplier's roadmap that does not include your release, a regulator's timetable, a deadline with money attached. Naming the wall in those terms is the first thing the method asks for, because a wall you can name has an owner, a dimension and a quantity of slack, and those three facts decide which move is even available.

Slack is the room that remains between where the organisation sits and a wall, projected over time. It can be positive, in which case you are choosing whether to cross; zero, in which case you are at the trigger; or negative, in which case the basin is already infeasible and you are managing a forced transition under degraded conditions. Most burning platforms are the negative-slack case. Converting forced transitions into chosen ones, by acting while slack remains, is the purpose of the discipline and the sentence in which its return can be stated.

What triggers a crossing is criticality, not magnitude. A large movement of a wall with plenty of room in it is weather; a small movement of a wall at zero slack is the event. Regulated sectors are full of walls with no interior slack at all, where the smallest instance of the conduct is the breach and the only question is which side of the wall you are on.

The six moves

When a wall binds, making the target feasible means buying slack against it, and slack against a wall is a function of a fixed set of arguments: where the wall sits, where the organisation sits relative to it, the dimension along which the gap is measured, whether the wall is on the critical set at all, and the time available before the gap closes. To add slack you must act on one of those arguments; one further move adds no slack but changes which wall matters. There is no other term to act on, so there is no seventh class. That is what makes the repertoire a taxonomy rather than a list.

The running example is an airline, because every planning action an airline takes can be watched from outside and every one of them falls into a class.

1. Move the wall. Change where a constructed limit sits. The airline acquires or trades take-off slots years ahead. Cost currency: negotiation and political capital, because the wall usually has an owner.
2. Move the organisation. Change your own position until you clear the wall. The airline swaps aircraft between routes to push seats into a market. Cost currency: the effort and disruption of moving.
3. Reframe the dimension. Change the axis along which the boundary binds. The airline re-points capacity from business demand to leisure demand. Available only when the axis is a construct and not a fact; reframing a statutory or physical axis is not a move, it is laundering.
4. Reroute. Resequence so that a slacker set of boundaries becomes the critical set. The airline re-paths services around closed airspace. Cost currency: coordination, because every reroute creates interfaces, and its characteristic failure is hidden coupling: taking one wall off the critical path and putting two others on it.
5. Buy time or buffer. Extend the interval, slow the rate, or hold reserve. The airline's block-time buffers absorb delay and disruption. Bought time is only slack if the landscape holds still while you spend it; against a wall that is itself advancing, waiting consumes the very slack it was meant to create.
6. Re-target. Change which basin you aim for. The airline scraps a declining route and commits capacity to a rising one. The only move that buys no slack, because it concedes the objective, and therefore the move of last resort: objectives are conceded knowingly at the end of the repertoire, never absent-mindedly in the middle of it.

Two questions discipline the choice. Who owns the wall? Your own wall makes moving it cheap; a stakeholder's wall makes it a negotiation; an exogenous wall removes the class from the table. Is the dimension real or constructed? If the axis is statute, safety or arithmetic, reframing is unavailable; if it is a specification someone once chose, reframing may be the cheapest honest slack on offer.

One guard completes the repertoire. A move launched in response to anything other than slack exhaustion is tampering, in Deming's sense: a structural response to ordinary variation inside the basin, which adds variance and manufactures nothing. A ready move is not a reason to move, and neither is a new financial year, a competitor's announcement or a bad quarter inside a stable basin.

The soundness check

Before any apparatus is deployed, the transformation is tested as scoped, in minutes rather than weeks. Four hard gates, each answered on its own, and any single red stops the work until the decision it exposes is taken above the programme.

1. Is the finish line statable? One sentence, and the people who matter would state it the same way. Success described in adjectives, with two seniors defining arrival differently, is a red gate: a programme with two imagined targets is heading to two places at once.
2. Is the sponsor real? A senior person genuinely willing to spend political capital when the change meets resistance, and you know who they are. A name on a chart who will be elsewhere when it gets uncomfortable is a spectator, and a sponsor unwilling to spend capital is a wall at zero slack in front of every move that needs authority.
3. Does authority match the goal? You can make, or directly command, the changes success depends on. Responsibility without matching authority is not a job; it is exposure.
4. Can scope, deadline and resource all be true at once? At least one of the three is genuinely allowed to move. All three corners nailed, with numbers that do not add up, is a decision to fail that has not happened yet.

No score is added up, because some points are fatal on their own. A red is not offset by three greens, and it is not softened into a caveat. A method that can return "do not attempt" is a method whose positive verdicts mean something.

Run the soundness check on your own programme

The readiness ladder

Readiness belongs to a move, not to an organisation. There is no such thing as an organisation at level six; there is a specific move, of one of the six classes, against a named wall, at some level of demonstrated readiness. Relabelling a readiness ladder as an organisational maturity scale is the category error this method exists to avoid.

Nine rungs, each gated by two questions, and the move sits at the lower of the two answers: does it work, meaning has the move been shown to relax the wall it targets; and can we keep it safe, meaning has whatever could go wrong been shown to be watched and stoppable.

1. Constraint identified: the wall is named and the hypothesis that the move relaxes it is stated.
2. Move classed: one of the six, with the mechanism named.
3. Proof of concept: analysis on real numbers that the move relaxes this wall without erecting a worse one.
4. Validated in simulation: the move has survived cheap trial.
5. Validated in a representative slice: run in a bounded but genuine slice, with the problems that surfaced recorded rather than explained away.
6. Piloted: with a stop condition stated in advance, and the stop exercised at least once, because a stop rule never tested is a stop rule that does not exist.
7. Deployed under monitoring: someone is watching the numbers that would show it failing.
8. Transition confirmed: the organisation has arrived and the new state holds without heroics.
9. Held: through a full cycle, without the old problems reappearing in new clothes.

The ladder goes down, and that is it working. A move that loses its grip on the new basin regresses; a move that suffers a control failure regresses further, to the highest rung whose evidence still holds. A readiness scale that only ever goes up is not an instrument; it is a ratchet for optimism.

On this site the ladder appears as honest self-placement. Its value is almost entirely in the ten-minute conversation in which someone says "we are at proof of concept, not pilot, because no real user has seen a real change", and the team stops planning as if evidence existed that does not. It is a mirror, not a badge.

People and machines

Modern transformations change people and AI systems together, and the doctrine treats them as one coupled population: human and machine actors sharing workflows, decision rights or accountability such that the work of either conditions the other. Two facts about that coupling carry most of the weight. Machines admit change at the level of a specification, which can be written, versioned and changed by decision; people admit change mainly as individuals and teams, with weak central control. A programme that paces both alike will mis-pace both.

The Error-Correlation Law states when a coupled population can catch its own mistakes. On any given decision, its self-correcting capacity is greatest when the human error mode and the machine error mode are different, and it falls to nothing as they come to coincide. The residual risk that survives coupling is concentrated in the failures the two populations share. The casual claim that AI automatically corrects human bias dissolves on contact with the law: correction is decision-specific, and the difference in error modes has to be engineered and evidenced, not presumed.

The leading shared failure mode is framing. The person anchors on the first number and is moved by whether a fact is stated as gain or loss; the model anchors on the prompt and is moved by how the question is posed. That is why the person checking the machine's work must be framed differently from the machine, and why an independent assurer is valuable for a testable reason: their errors are different from the delivery team's. Independence stops being a procurement heuristic and becomes a design property.

Two further instruments follow. Say/do divergence, the gap between what an organisation declares and what its rewards reveal, is a first-class sensing input, instrumented at the level of roles rather than individuals. And the RAID log is read as a boundary-sensing instrument: risks are potential wall movements, issues are movements already occurred, dependencies are walls owned by others, and assumptions are unverified walls carrying the highest prior of being wrong.

What the method refuses to do

A method is defined as much by what it will not do as by what it does, and these refusals are structural rather than stylistic.

• No aggregate scores. Four gates are never averaged, a readiness level is never rolled up into an organisational number, and a verdict is never presented without the distribution behind it. A single collapsed number hides exactly the point that is fatal on its own.
• No verdict without its distribution. Where the firm states an aggregate about itself, the per-person figures sit beside it. The same rule applies to a client's numbers.
• No move launched on noise. A bad quarter inside a stable basin, a ready solution, a new leader's playbook or an appetite for visible action is not a trigger. Only slack exhaustion on the critical set is.
• No readiness badge. The ladder is a mirror for self-placement, not a badge to be performed and not a status to be awarded. The moment a team starts performing its level rather than reading it, the ladder has failed in its purpose.
• No reframing of a real dimension. Statute, safety and arithmetic are not axes to be redrawn. Remeasuring reality is a move; redescribing it is not.
• No model output unattended. A named founder stands behind every recommendation, and a named person on the client side can stop any live move.