A decision can be made revisable in two ways. It can carry a general promise to look again when circumstances change, or it can carry a rule written beforehand that names the result which would undo it. The first leaves the moment of reversal to whoever is watching. The second fixes it in advance, and in doing so it commits the decider to a test, a count and a tolerance. This paper studies records of the second kind. Its question, put to a set of records rather than to any one case, has two parts: when a decision record writes down in advance the result that would reverse its own recommendation, what does that condition commit the decider to, and what does the record say about where the numbers in the condition come from?
The records are twelve authored cases from AEGIS, the safety and protection studio of the RISCON family. They are synthetic. AEGIS describes them as fictional cases for training, made by correcting an earlier numbered list of candidate items, and it says in each record that all institutions and events are settings and that its figures, periods, samples and switching thresholds are training assumptions rather than measurements, performance or legal obligations. The paper therefore makes no claim about how any real council, agency or armed force decides. It studies how a body of authored records writes a reversal rule: what it counts, how much failure it tolerates, which way it leans, and how it describes the standing of its own numbers. The question bears on a practical matter: a later reader of a decision record can judge a reversal rule only if the record says what the rule's numbers rest on.
The argument in brief
The paper makes four claims about the set and one about the method.
First, every case writes its reversal as a count over a small test that it names. Six of the twelve samples are of three items, and the largest is twenty. The tolerance is one failure or none. A rule written this way is strict in a precise sense: a single observation decides it.
Second, the rules lean one way. In the four cases whose recommended choice is the more restrictive one (stopping a delivery, switching all authentication, requiring prior consent, running auxiliary power), the record reverses its recommendation only if the whole sample comes back clean. In the other eight, where the recommended choice is a middle course accepted under conditions, a single failure, or the failure of a single item, reverses it. Across the set, a restrictive choice stays until a clean record frees it, and a conditional permission falls at the first failure.
Third, the records name the cost of every option. Each of the thirty-six choices carries a clause saying what it gives up or what it accepts: the investment schedule, the option to refuse case by case, update speed, continuity of work. The lean in the reversal rules is therefore not the result of ignoring the costs of caution; the costs are written beside the choices, and the rules lean anyway.
Fourth, every record says where its numbers come from. Ten name something as the original's (the earlier text the records say they correct), eleven name a figure as added by the author for the exercise, and three call a figure a design or setting value; five records go further and say that a claim or prescription of the original was not adopted. Across all 6,540 authored AEGIS cases only 58 give the source of a number in these words; twelve of them are these records, and most of the rest stand in two further groups, one programme with 12 and three review sets with 13.
The methodological claim is that these features can be told apart from AEGIS's template by measurement. A count of repeated five-word runs, the method the RISCON series uses to separate a studio's frame from its findings, shows that the parts of each record that carry the reversal rule, the unknowns, the deadlines and the choices use each case's own words, while the statements of role and scope are wholly templated. The presence of a numbered reversal rule is the programme's design, as its scope says; the paper reads the shape of the rules.
The debate this paper enters
Four bodies of work bear on writing a reversal rule in advance, and they pull in different directions.
The first asks when it is wise to bind a future decision at all. Cass R. Sunstein and Edna Ullmann-Margalit, Second-Order Decisions (1999), describe how people and institutions, reluctant to calculate costs and benefits case by case and knowing they may err, adopt strategies for deciding how to decide: rules or presumptions, standards, delegation, small steps, picking rather than choosing. Some of these strategies put high costs before the decision and low costs at the time of deciding; others export the high costs at the time of decision to someone else. Jon Elster, Ulysses Unbound: Studies in Rationality, Precommitment, and Constraints (2000), argues against the common-sense view that more options are always better, holding that people may benefit from being constrained in their options. On this paper's reading, a reversal rule written before a test is a second-order decision of the rule kind and a precommitment in Elster's sense: it removes from the moment of the test the option of reading the result generously.
The second body of work treats revision as part of planning under uncertainty. James A. Dewar, Assumption-Based Planning: A Tool for Reducing Avoidable Surprises (2002), traces unwelcome surprises to the failure of assumptions an organisation did not anticipate or had forgotten it was making, and gives steps for rooting out vulnerable assumptions, monitoring them and preparing for their failure. Marjolijn Haasnoot, Jan H. Kwakkel, Warren E. Walker and Judith ter Maat, in Dynamic Adaptive Policy Pathways: A Method for Crafting Robust Decisions for a Deeply Uncertain World (2013), describe committing to short-term actions while setting signposts to monitor whether adaptation is needed. Brian A. Nosek and others, in The Preregistration Revolution (2018), make a related argument in science: defining the questions and analysis plan before observing outcomes separates prediction from postdiction and protects findings from hindsight. As this paper reads them, these works agree that a condition for revision should be stated before the evidence arrives, and leave open what its numbers should rest on.
The third body of work concerns the standing of numbers. Jeroen P. van der Sluijs and others, in Combining Quantitative and Qualitative Measures of Uncertainty in Model-Based Environmental Assessment: The NUSAP System (2005), describe a system that joins a quantitative analysis of a parameter's sensitivity with a qualitative review of its strength, called pedigree analysis, so that uncertainties can be ranked by what is known about the limits of the available knowledge. Theodore M. Porter, Trust in Numbers: The Pursuit of Objectivity in Science and Public Life (1995), argues that quantification grows from attempts to develop a strategy of impersonality in response to outside pressure, and becomes most important where private negotiation is suspect and trust is short. The two works pull against each other on this paper's question. A threshold written into a reversal rule makes a decision impersonal in Porter's sense; a pedigree statement in the sense of the NUSAP system says how much that number deserves to be trusted. The AEGIS records, as the case sections show, do both at once.
The fourth body of work concerns what a small clean test can show and how far caution should go. James A. Hanley and Abby Lippman-Hand, If Nothing Goes Wrong, Is Everything All Right? (1983), address inference from a study in which none of the events of concern occurred, a zero numerator, and note that no events tends to be viewed as very different, in quantity and in kind, from one or more. Cass R. Sunstein, Laws of Fear: Beyond the Precautionary Principle (2005), argues that the principle of acting against uncertain harms is incoherent because risks lie on all sides and precautionary steps create dangers of their own, and proposes close attention to costs and benefits instead. A reversal rule that waits for a clean sample before relaxing a precaution sits at the meeting point of these two works: it treats zero as decisive, and it decides in advance that the burden of proof lies on the side of relaxing.
Contribution
The paper contributes in three narrow ways. It gives a measured description of how one authored record set writes reversal rules before a decision: counts over small named samples, a tolerance of one or none, and a lean that keeps restrictive choices in place until a clean result and lets conditional permissions fall at the first failure. It shows that the same records mark the standing of their numbers, naming inherited figures, added exercise values and design values, and in five records claims they declined to adopt, a practice rare across AEGIS's authored cases. And it places the set within the debate above, arguing that the records take the side of precommitment and preregistration on when to state a reversal, while, on this paper's reading, their own pedigree statements supply the caution about precision that the literature on numbers and on zero numerators points to. Chapter 1 sets out the data and method and reads the cases in two sections; Chapter 2, an appendix, gives the records read; the conclusion returns to the debate.