Risk decides which capabilities run and how hot. Contracts decide how their work flows on. This page defines both.
Every capability sits on a four-step dial at all times. The live risk mix moves the dials.
A risk is two questions, and they answer to different scales. Conflating them is what makes a risk register unreadable.
| Question | Answers to | Behaviour |
|---|---|---|
| How much rides on it? | Level | Stable. It does not move as the work progresses — what is at stake was settled when the work was scoped. |
| How sure are we? | Intensity | Moves. Low confidence on something that matters drives its capability to Peak; as we prove it out, it cools. |
The dial is a label on the capability, never on the risk or the product item.
| Step | Meaning |
|---|---|
| Dormant | present but idle; re-activates on the right signal |
| Low | live but light — a check or a spike |
| Active | a primary workstream now |
| Peak | the dominant demand |
Dormant is not absent. Capabilities turn down, never off.
The recurring kinds of "riskiest unknown." Each names an unknown, activates a set of capabilities at a dial, and produces an output that becomes available as input to whatever fires next. Shapes co-occur, recur, and persist — the order they fire in is not fixed.
Dial values are authored drafts. They have not been reviewed, and no page or document recorded them before now.
Are we solving the right thing?
a qualified direction, a defined outcome, a constraint set, a risk shortlist.
Will anyone care enough to change behavior?
evidence the value holds — or the call to redirect or stop.
Can it be built within the hard limits?
a working slice and proof of buildability within constraints.
Is the probabilistic system trustworthy on real data?
eval evidence against a reliability bar, and the controls to run it safely.
Do the economics, scope, and price hold?
a confidence-tiered envelope and price.
Will the wider org trust and use it?
evidence of uptake and an adoption path.
Can we show it's true, not just claim it?
evidence against the bar, and acceptance.
Can they run it safely once we're gone?
a client able to run and own the system.
The load-bearing handoffs between capabilities. A seam is the interface between two capabilities: what must cross, in what form. This is the floor — the minimum for a valid handoff. It holds regardless of tool; AI carries the artifact across, judgment decides whether what crossed is right.
A scoped commitment — what's promised, at what confidence, what's still an open bet.
A guarantee of outcomes we haven't earned.
A SOW written as certainty: roadmap and deliverables promised as done before any risk is retired.
A testable definition — problem, outcome, constraints.
A wish list.
Requirements that can't be built or tested from.
A runnable artifact — built in real components against the token system, extended in place.
A static mock, a screenshot, or a written description of a screen.
A screenshot in a ticket, or engineering rebuilding behavior from a description.
Evidence against a bar set up front.
"Looks done."
Acceptance on subjective sign-off.
A confidence-tagged commitment call — what the evidence now earns the right to scale, price, or commit, and what it doesn't.
"We're done, here's the next phase."
Scaling or re-pricing on the calendar instead of the signal, or a green light no signal backs.
A change lands mid-delivery. This is what it does to the shape of the work — six moves, in order, ending on the first thing to attack.
Which risk shapes re-fire, which newly appear, which subside. Name the new riskiest unknown.
Invokes: Risk framing
Per capability, the intensity shift and why. Flag dormant to active, where a capability surfaces that nobody was staffing, and peak to low, where work in flight may now be throwaway.
Does the change cross the product-vision line? If it changes what the thing is, it re-opens go / redirect / stop — not a change order.
Never: Processing a vision change as a change order because the paperwork is easier.
Invokes: Direction qualification
Which seats the new dials require, at what level. Where the needed level is unavailable, name the bench gap as a delivery risk rather than staffing under it.
One question, in two currencies: what does this cost, in money and in time. Emergence allowance or a new envelope — the test is whether it changes what it takes to clear a gate. Tier by confidence: fixed on proven, ranged on directional, gated spike on collapse risk. Name any new gate inserted. Then the timeline consequence, derived not negotiated — the date holds and scope flexes, the date moves by the validation spike, or the date holds and confidence drops.
Never: Letting the date hold on lower confidence without saying so out loud. That is the one outcome that must never be the default.
Invokes: Pricing under uncertainty, Confidence-based estimation, Commercial scoping & envelope shaping
One slice, testing one assumption, with the signal defined before it is built. The pass ends here because this is the point of running it — the first thing to attack, not a revised estimate.
Invokes: Slice building, Signal design
It proposes. L4s decide. It never silently absorbs a vision change.
Seams are checked throughout rather than as a move: a change that moves work across a seam without changing what crosses it is a smaller change than it looks.