Judgment Proo

Judgment Proo

Recovering Human Wisdom

Seth C. Oranburg

Judgment Proo —

The Reign o

the Sa — ety Machine versus the Recovery o — Human Wisdom

Copyright © 2026 by Seth C. Oranburg All rights reserved.

ISBN: [Pending] Library o — Congress Control Number: [Pending]

No part o

this publication may be reproduced, distributed, or transmitted in any

orm or by any means without the prior written permission o — the author, except — or brie — quotations in critical reviews and certain noncommercial uses permitted by copyright law.

Pre-Print Dra

t

Printed in the United States o

America To those who are willing to bear the weight. “Legislators make the citizens good by — orming habits in them, and this is the wish o — every legislator, and those who do not e —

ect it miss their mark, and it is in this that a good constitution di —

ers — rom a bad one.” — Aristotle, Nicomachean Ethics, Book II, 1103b (322 B.C.E.)

“The per

ection o — the body is antecedent to the per — ection o — the soul. But the per — ection o — the soul is the ultimate end.” — Moses Maimonides, The Guide — or the Perplexed, Part III, Chapter 27 (1190 C.E.)

“Baby, don’t hurt me / Don’t hurt me / No more.” — Haddaway, “What Is Love” (1993) Contents Pre — ace viii Chapter 1: Haddaway’s Law 1 Chapter 2: The Con — usion 23 Chapter 3: The Great Retreat 41 Chapter 4: Prudence as Transaction Cost 61 Chapter 5: Harm-Prevention Architecture 79 Chapter 6: Wisdom o — Not Knowing 97 Chapter 7: Nobody Knows Everything 119 Chapter 8: Boeing 137 Chapter 9: The Sa — ety Machine 157 Chapter 10: The Gymnasium 171 Chapter 11: Aristotle’s Algorithm 185 Chapter 12: The Hardware 199 Chapter 13: The Silicon Havruta 215 Chapter 14: Anti-Utopia 229 Notes and Re — erences 246 Pre — ace

I teach business law to students who will spend their careers inside the sa — ety machine that this book describes. Every semester, I watch them learn compliance. They arrive with the intuition that law has something to do with justice, and they leave with the pro — essional understanding that law has something to do with documentation. I do not say this with contempt. The curriculum re — lects what the pro — ession actually demands. My students learn to identi — y risk, construct de — ensible paper trails, ensure that every decision their — uture employers make can be traced to a rule rather than to a person. They learn to become judgment-proo — . I trained at the University o — Chicago Law School, where I absorbed the law-and-economics — ramework that Chapter 1 describes. Cost-bene — it analysis replaces the messiness o — judicial discretion. Legal rules are evaluated by whether they maximize social wealth. The conviction was that law could be practiced as a science rather than an art. I believed it, taught it — or years, and built my published scholarship on it. When I tell you in this book that the Chicago School’s — ramework was elegant and that its best practitioners were clear-eyed about its limitations, I am speaking

rom inside the tradition. Chicago gave me the analytical tools I still use, and those tools helped me see what was breaking. What they could not show me was what the breaking had cost: what had been lost when the — ramework succeeded on its own terms and the institutions it built stopped producing the judgment they depended on. The argument o — this book grew gradually, but the experience that — orced it into — ocus was speci — ic. Pre — ace ix

In the summer o ---  2022, I was a law pro --- essor at the University o ---  New Hampshire Franklin Pierce School o ---  Law. The school advertised itsel ---  as o ---

ering the most — lexible and accessible path to a JD in the nation. That summer, I was assigned to work a schedule that included Saturdays. I told the administration I could not work on Saturday because I am a Jew. Shabbat is a requirement o — my identity, not a pre — erence and not a scheduling inconvenience. In any — unctioning institution the response would have been immediate and uncomplicated. What — ollowed was a bureaucratic process so tangled that the people running it could not determine, over a period o — weeks, whether they would accommodate an observant Jew’s re — usal to work on the Sabbath. I do not mean they re — used. I mean they could not — igure out whether they would. The institution that claimed to be the most — lexible law school in America had built an administrative architecture so rigid that a straight — orward request (one that any competent principal, any community leader, any person with ordinary judgment would have resolved in a conversation) became a Ka — kaesque procedural trap. I did not work on Saturday. But the resolution came despite the institution, not through it. Most o — the people involved were sympathetic. They simply could not act, because the institution had been designed so that acting was not something the structure permitted. The structure permitted process, and process is what I received. I already had, by that point, an intuition about where to look — or an alternative. I had been studying Judaism seriously as a practice rather than as an academic exercise, and the tradition I was learning operated on principles that were the precise inverse o — the compliance architecture I was living inside at work. When I brought the Shabbat problem to my Jewish community, the response was x Judgment Proo —

immediate and unequivocal. Nobody needed to consult a policy manual. The tradition had already worked out, over centuries o —

practice, what Shabbat observance requires and what a community owes to someone who observes it. In the vocabulary o — the tradition, this was not a question. The clarity came not — rom simplicity but

rom a legal and moral tradition that had preserved, in its institutional design, the conditions under which judgment could be exercised. The contrast was unbearable. On one side, a modern American institution with a diversity o —

ice, an accommodation policy, a Title VII compliance — ramework, and a bureaucracy that could not, over the course o — weeks, — igure out whether to let a Jewish pro — essor observe the Sabbath. On the other, a tradition that had been governing questions like this since the twel — th century and could answer in an a — ternoon. That contrast sent me to Maimonides. Not immediately; I did not open the Guide — or the Perplexed that summer and — ind the answer on page one. But I knew, — rom my study o — Jewish law, where to look when I needed a — ramework that could explain what I had experienced. Maimonides was a physician, a philosopher, and the most systematic legal thinker o — the medieval Jewish tradition. His distinction between tikkun ha-gu — (the material in — rastructure o —

social order, the physical security and institutional stability that make everything else possible) and tikkun ha-ne — esh (the cultivation o — understanding, moral capacity, and practical wisdom) gave me the structural vocabulary I could not — ind in the contemporary literature on regulation. Law serves two purposes. Compliance can build the — oundation, but compliance alone cannot raise the sca —

olding. Pre — ace xi

Maimonides was not alone. Aristotle had made the same structural distinction. Aquinas had built institutional architecture around it. Elinor Ostrom had documented, empirically, across cultures and centuries, the design  --- eatures that made institutions capable o ---  preserving the judgment their governance required. The havruta — the Talmudic study practice in which your partner’s

unction is to challenge your reading — encodes an institutional design principle that Ostrom’s commons research validated independently. The Western tradition, and the Jewish tradition within it, had already solved a problem that modern regulatory theory does not know how to pose. I direct a program at the Classical Liberal Institute at NYU Law, and I should be transparent about where I stand. The “classical liberal” label — its parts o — my argument but not all o — it. None o — the thinkers this book draws on most heavily — Aristotle, Maimonides, Aquinas — would have recognized it. All three were institutionally serious about the cultivation o — human judgment in a way that precedes and exceeds any modern political category. This book’s argument is that the architecture can be rebuilt (not demolished, rebuilt) so that the institutions we depend on can do what they were designed to do: cultivate the judgment their own legitimacy requires. The argument begins, o — course, with a Eurodance hit song. Chapter 1: Haddaway’s Law

Where Fun Comes to Die I arrive at the University o — Chicago Law School in August wearing shorts. This turns out to be a mistake. The wind o —

Lake Michigan cuts through the campus with a cold that — eels deliberate, as though the weather itsel — has internalized the school’s uno —

icial motto: Where — un comes to die. I go home — reezing and underdressed. I am not disappointed. I have not come — or — un. Chicago promises clarity in an age o — con — usion. The law, as I encounter it be — ore arriving, is a mess: competing values in collision, vague standards proli — erating, judicial discretion that — eels arbitrary, outcomes that vary wildly depending on which judge draws which case. People are hurt by this unpredictability. Real people, su —

ering real consequences — rom what amounts to an institutional lottery. Chicago o —

ers an answer: its version o — law and economics (the school that Coase and Posner and Becker built) applies mathematical rigor to legal questions that had previously been resolved by intuition, precedent, and what Cardozo described as the trained practical instinct, the accumulated wisdom o — experienced judges brought to bear on the resolution o — disputes.1 The Chicago School’s core insight is that legal rules produce consequences, that those 2 Judgment Proo —

consequences can be measured, and that measurement allows us to evaluate rules by something more reliable than judicial temperament. I remember the moment I — eel the — ull appeal o — this. The class is analyzing Hawkins v. McGee, the hairy hand case, a staple o —

irst-year contracts. George Hawkins burns his hand on an electrical wire. A physician named McGee persuades him to undergo a skin gra — t, guaranteeing a “per — ect hand.” The surgery

ails. McGee gra — ts skin — rom Hawkins’s chest onto his palm. The chest skin grows thick hair. The hand is worse than be — ore. Traditional legal analysis spirals into questions that resist quanti — ication: How does one compensate a young man — or a dis — igured hand? What is the worth o — what he has lost? The economic analysis cuts through this. Hawkins expected a per — ect hand. He received something worse than what he had. The di —

erence between expectation and reality is calculable. Law should give him that di —

erence, and the incentives thus established should discourage — uture physicians — rom making promises they cannot keep. The — ramework has genuine elegance. It replaces sympathy with arithmetic and the resulting clarity is, — or a twenty-two-year- old — irst-year student, exhilarating. The school rested on a genuine insight. In 1960, Ronald Coase published a paper demonstrating that in a world with zero transaction costs, parties will bargain to the e —

icient outcome regardless o — how law assigns initial entitlements.2 The insight was descriptive: legal rules matter in the real world because transaction costs are never zero, in — ormation is incomplete, and — riction prevents parties — rom bargaining their way to wel — are-maximizing arrangements. Coase wanted his — ollowers to study that — riction, to understand how institutions shape the way humans act in a world o — imper — ect in — ormation and incomplete contracting. Chapter 1: Haddaway’s Law 3

His  --- ollowers did the opposite. They converted his description into a prescription. I ---  transaction costs prevent e ---

icient outcomes, then law must reduce transaction costs. I —

riction produces suboptimal results, then the goal o — institutional design becomes the elimination o —

riction. The aspiration becomes a world without constraints on rational exchange. The logic has a remorseless simplicity. Constraints hurt people. Friction causes pain. The purpose o — law is to prevent hurt. There — ore: eliminate — riction. I did not see the problem until I started watching what the approach built.

Haddaway’s Law In 1993, a Trinidadian-German musician named Haddaway released a dance single that topped charts across Europe. The song poses one question, repeated with increasing desperation over a — our-on-the-

loor beat: What is love? And o —

ers one answer, delivered in the chorus: Baby, don’t hurt me. The song is absurd. It is also, as an unintended description o —

modern legal thought, almost per

ect: What is law? Baby, don’t hurt me. Ask a contemporary legal scholar, a legislator, or a regulatory o —

icial: What is law — or? You will receive sophisticated answers about social ordering, dispute resolution, behavioral modi — ication, and public policy. Strip away the academic vocabulary, and you — ind the same structure as Haddaway’s chorus. Law exists to prevent harm. It protects consumers — rom dangerous products, workers 4 Judgment Proo —

rom unsa — e conditions, investors — rom — raud, the environment

rom pollution, citizens — rom violence. Law de — ines its purpose by what it prevents. This is not wrong. Prevention matters. A legal system that cannot prevent murder, the — t, and — raud is not a legal system. Haddaway was not wrong either; love that systematically harms is not love. The problem is not the negative de — inition. The problem is that the negative de — inition has become the only de — inition. I call this Haddaway’s Law: the institutional imperative to prevent hurt, pursued without limit, without acknowledgment o —

what it costs, without any vocabulary

or what law should enable rather than merely — orbid, and without the epistemic capacity to know whether the hurt it prevents outweighs the judgment it destroys. Modern regulatory, compliance, and administrative systems operate under this imperative. They prevent investors — rom losing money. They prevent pilots — rom making errors. They prevent judges — rom exercising inconsistent discretion. They prevent the grandmother at the bank counter — rom wiring money to a hurricane relie —

und without ninety minutes o — interrogation about the source o — her pension and the exact news broadcast that moved her to charity. Three blocks — rom that grandmother, a Delaware shell company with nominee directors in Cyprus wires three million dollars through the same institution. No human examines the transaction. The algorithmic risk score registers as acceptable. The compliance boxes check out per — ectly. The transaction clears in three seconds. The global — inancial system spends $274 billion annually on this architecture.3 The Sa — ety Machine stops the grandmother and escorts the shell company to the vault. It cannot distinguish between them because Chapter 1: Haddaway’s Law 5

distinction requires human discernment, and the machine is built speci — ically to replace human discernment with process. The machine produces two related conditions that together constitute the title o — this book: institutions that are, in the precise legal and moral sense, judgment-proo — .

Two Ways to Be Immune In law, a judgment-proo — de — endant is one — rom whom no judgment can be collected. She has been sued; the plainti —

has won; the court has entered a verdict. None o — this matters, because the de — endant possesses no assets — rom which the judgment can be satis — ied. She can be condemned in principle and remain immune in practice. The

ormal apparatus o — accountability operates, but accountability does not. Modern institutions have achieved a more ambitious version o —

this condition. They are judgment-proo

not merely because they lack assets but because they have engineered out the — aculty o —

pro

essional discernment against which accountability would operate. When no one judges, no one can be said to have judged wrongly. Failure becomes a technical mal — unction rather than a human error. The institution can point to the algorithm, the checklist, the compliance report, the peer-reviewed risk model. The paperwork is immaculate. No one is responsible. No one exercised discretion. No one can be held to account — or the assessments that were never made. Institutions become judgment-proo — in the liability sense precisely because they have become judgment-proo — in the epistemic sense. The two meanings are not a rhetorical coincidence. They describe a causal relationship. Eliminate judgment, and you 6 Judgment Proo —

eliminate accountability

or wisdom that was never applied. No one exercised deliberation. No one can be assigned responsibility — or outcomes that deliberation might have changed. This double meaning is the subject o — this book.

Planes without Pilots The Boeing 737 MAX is the paradigm case. In 2011, Airbus launched the A320neo, — eaturing new engines promising a — i — teen percent reduction in operating costs.4 Boeing

aced a competitive choice: design an entirely new aircra — t, a decade’s work and tens o — billions o — dollars, or re-engine the existing 737 air — rame. Boeing chose speed. Engineers mounted larger, more — uel- e —

icient LEAP-1B engines on the 737, moving them — orward and slightly higher to — it beneath the low-slung — uselage. The repositioning altered the aircra — t’s aerodynamic behavior. At high angles o — attack, the engine housings generated additional li — t, causing the nose to pitch upward, a characteristic that, i — le — t unaddressed, would require pilots to receive extensive training to manage.5 Training, however, was the problem. Airlines would not purchase the 737 MAX i — it required pilots to complete a new type rating. The business model demanded that the aircra — t maintain its existing certi — ication, keeping transition costs minimal. Traditional aviation philosophy would have addressed the aerodynamic change by developing the judgment o — the pilots who would — ly it: simulator time, procedural training, the development o — what engineers call “stick and rudder” skills that allow pilots to manage an aircra — t’s handling characteristics across its — light envelope. This approach Chapter 1: Haddaway’s Law 7

required

riction. It required time, money, and human adaptation. It

treated the pilot as an agent who needed to develop capacity.

Boeing chose automation. Engineers designed the Maneuvering

Characteristics Augmentation System, MCAS, to push the nose

down automatically when sensors detected a steep pitch angle.6

Pilots did not activate the system. Pilots were not in

—

ormed o

—

its

existence. The aircra

—

t was redesigned to

—

unction without pilot

authority in the

—

light regime where the aerodynamic problem lived.

The

—

riction o

—

training was eliminated. The pilot’s capacity to

compensate manually was never developed. The machine would

handle it.

The FAA processed this design through an institutional

architecture built on compliance delegation. Under the

Organization Designation Authorization program, the FAA

delegated certi

—

ication activities to Boeing itsel

—

the manu

acturer authorizing its own aircra — t.7 Boeing characterized MCAS as a minor modi — ication o — an existing speed trim system. The FAA, delegating up to eighty-seven percent o — certi — ication activities to Boeing, processed the characterization accordingly.8 The paperwork was impeccable. Every box was checked, every protocol satis — ied, every required — orm — iled. On October 29, 2018, a — aulty angle-o — -attack sensor — ed — alse data to MCAS on Lion Air Flight 610. The so — tware executed its

unction — lawlessly, repeatedly commanding the horizontal stabilizer to push the nose down. The pilots — ought a system they did not understand, using skills they had not been trained to develop. The aircra — t impacted the Java Sea at high speed, killing all 189 people aboard.9 Boeing issued an advisory. The global — leet continued to — ly. 8 Judgment Proo —

 Four months and eleven days later, on March 10, 2019, Ethiopian Airlines Flight 302 encountered the same  --- ailure. The timeline bears reproduction in  --- ull, because the temporal precision reveals the mechanical inexorability o ---  the architecture.
 At 8:38 AM, the aircra --- t li --- ts o ---

runway 07R at Addis Ababa Bole International Airport. Seconds into the climb, the le — t angle- o — -attack sensor — ails, — eeding — alse data to the — light computer. At 8:39, the stick shaker activates, the control column vibrating violently in the captain’s hands, warning o — a stall that is not occurring. The autopilot disengages. At 8:40, MCAS activates, commanding the horizontal stabilizer nose-down. The pilots pull back on the yoke with immense — orce, — ighting the machine. MCAS activates again. And again. At 8:41, the pilots execute the runaway stabilizer trim cutout procedure, cutting electrical power to the trim motor. MCAS is neutralized, but the aircra — t is now accelerating to well beyond its designed speed. At 8:42, the pilots attempt to turn the manual trim wheels on the center pedestal. Aerodynamic — orces on the tail at this speed exceed what human arms can overcome. The wheels will not move. At 8:43, the pilots restore electrical power to the trim motor, hoping to regain control o — the stabilizer. MCAS immediately commands another massive nose-down pitch. At 8:44, six minutes a — ter takeo —

, the aircra — t enters an unrecoverable dive. Flight 302 strikes the ground near Bisho — tu.10 All 157 aboard are killed. The combined death toll is 346 people.11 They died because the machine had eliminated the — riction o —

judgment. Boeing designed an aircra

t that did not require pilot judgment in the relevant — light regime. The pilots never practiced compensating — or the pitch characteristics. They never developed the embodied, habituated skill — what Aristotle would have called Chapter 1: Haddaway’s Law 9

hexis — that would have made manual recovery possible. The automation was not incidental. It was the architecture. MCAS was the Sa — ety Machine built in aluminum and so — tware. When MCAS

ailed, it — ailed in the direction o — the very harm it was designed to prevent. The humans operating within the system lacked the capacity to intervene, because the system had been designed on the premise that no such capacity would ever be needed. The compliance documentation was immaculate. The ODA delegation was legally sound. The aircra — t was per — ectly legal and

undamentally lethal. The institution was judgment-proo — in both senses.

What We Forgot The argument o — this book is not that sa — ety is bad. It is not that regulation is a mistake or that — riction should be maximized — or its own sake. The Boeing 737 MAX is not an argument against aviation regulation; it is an argument about what happens when the wrong kind o — regulation is pursued with the wrong kind o — logic. The argument is this: we have — orgotten that law has two purposes, not one. We have — orgotten that law has limits built into its nature: limits on what it can legitimately speci — y, limits on what it can e —

ectively accomplish, limits that arise not — rom external constraints but — rom what law is. And we have — orgotten that these two amnesias are connected, that — orgetting law’s second purpose and — orgetting law’s inherent limits are two expressions o — the same underlying error. The — irst purpose o — law is — oundational. It suppresses violence, secures persons and property, establishes the basic ordering o — social li — e that makes everything else possible. The Romans called this pax 10 Judgment Proo —

and ordo. Maimonides, the twel

th-century rabbi and physician o —

medieval Cairo, called it tikkun ha-gu

, the per — ection o — the body, the physical in — rastructure o — social existence.12 This purpose is genuine and essential. A legal system that cannot prevent murder,

raud, and the — t is not a legal system. The — oundation must be built be — ore anything else is possible. The second purpose o — law is architectural. It cultivates the judgment, character, and practical wisdom that trans — orm a collection o — surviving individuals into a civilization capable o —

lourishing. Aquinas stated this with characteristic precision: “The purpose o — human law is to lead men to virtue, not suddenly, but gradually.”13 This is not pious sentiment. It is a structural claim about the relationship between legal institutions and human development. Law develops the capacity — or wisdom by creating conditions: structured encounters with di —

iculty, habitual patterns o — action, the expectation o — wise deliberation. Maimonides called this purpose tikkun ha-ne — esh, the per — ection o — the soul, the cultivation o — understanding. Law’s second purpose is not to replace judgment but to create the conditions in which judgment can grow. These two purposes are sequential: you build the — oundation be — ore you raise the sca —

olding. But they are not equal in rank. The

oundation exists to make the sca —

olding possible. The sca —

olding is the point. You do not build a — oundation so you can admire the

oundation. You build it so the house can rise. Modern law stopped building. We became obsessed with

oundations. We built elaborate structures to prevent every conceivable harm: regulatory agencies to protect consumers, licensing boards to screen practitioners, permitting regimes to control innovation, compliance systems to monitor behavior. We Chapter 1: Haddaway’s Law 11

measured success by harms prevented and never asked what we were preventing — rom existing. Haddaway’s Law names this amnesia. Baby, don’t hurt me. Law de — ines itsel — by what it — orbids, protects against, and prevents. It has no vocabulary — or what it enables. It cannot articulate what human beings might become i — law created space — or them to grow rather than merely preventing them — rom — alling.

Law Has Limits We also — orgot something deeper: law has limits. Not merely prudential limits o — the kind that pragmatists invoke, but limits built into the nature o — law itsel — . Law speaks in general terms. But wise action requires judgment about particulars. Law can prohibit murder. It cannot speci — y in advance what courage looks like in every circumstance. Law can en — orce contracts. It cannot tell the entrepreneur which risks are worth taking. Law can protect property. It cannot determine which innovations will serve human needs. Aristotle drew a — undamental distinction between two modes o —

practical knowledge: technē, the knowledge o

how to produce things, and phronēsis, the knowledge o — how to act well.14 The cra — tsman who knows how to build a table exercises technē. His knowledge terminates in the table; the table is external to the cra — tsman; when the table is built, the knowledge has been — ully expressed and the task is done. The judge who knows how to sentence wisely exercises phronēsis. Her knowledge does not terminate in the sentence; the sentence is the expression o — a capacity cultivated through years o — practice, a capacity that is 12 Judgment Proo —

inseparable

rom the character o — the judge hersel — and that can only develop through the exercise o — judgment in actual circumstances. Technē can be systematized, encoded, and transmitted. A recipe is codi — ied technē. An algorithm is codi — ied technē. The ambition o —

modern regulatory design is always the ambition to replace slow, variable technē with — aster, more consistent technē, to encode best practices and en — orce them uni — ormly. This is sometimes legitimate and even admirable. A hospital’s surgical checklist really is better than idiosyncratic surgeon intuition about sterile technique, because sterile technique is technē: there is a best practice, and it is the same best practice every time. Phronēsis cannot be systematized without ceasing to be phronēsis. The capacity — or practical wisdom in particular circumstances develops only through the practice o — discernment itsel — . It cannot be encoded, because encoding replaces the exercise with its output, and it is the exercise, not the output, that constitutes the capacity being developed. You can encode the conclusion o — a phronetic judgment. You cannot encode the sagacity that produced it. The physician who recognizes pneumonia through years o — auscultation has developed a perceptual capacity that cannot be transmitted to someone who has only read descriptions o — what pneumonia sounds like. The practice is the knowledge, not merely the vehicle — or it. The Chicago School classi — ied pro — essional discretion as technē subject to optimization. But judgment in law’s second — unction — the Sca —

olding — unction — is phronēsis constituted by exercise. The error is not one o — e —

iciency. It is ontological. The consequences are not suboptimal institutions. They are institutions that systematically destroy the capacity they were built to depend upon. Chapter 1: Haddaway’s Law 13

Deskilling Loop When an institution replaces judgment with rules, it does not merely eliminate a single discretionary decision. It eliminates the practice that would have developed the capacity — or all — uture acts o —

discernment in that domain. The de

icit, once created, justi — ies its own extension. The logic runs as — ollows. Institutions replace judgment with rules to eliminate variance and to establish what lawyers call a compliance de — ense: documentary evidence that every decision was made in accordance with applicable protocols. The rules, by eliminating judgment, ensure that the humans operating within the institution do not develop the capacity to handle situations the rules do not address. When those situations arise (and they always do, because the world generates more situations than rules can enumerate), the institution lacks the practical wisdom to handle them. The institutional response is to write more rules. Each additional rule expands coverage at the cost o —

urther judgment development. The coverage expands. The capacity contracts. The institution writes more rules. I call this the Deskilling Loop, and its operation is visible at every scale o — institutional li — e. The pilots o — Lion Air 610 and Ethiopian 302 were not bad pilots. They were trained pilots operating within an institutional architecture that had systematically removed — rom their practice the precise skill they needed to survive. MCAS was the Deskilling Loop implemented in so — tware. The FAA’s delegation — ramework was the Deskilling Loop implemented in procedure. The airlines’ maintenance and training programs, calibrated to the approved type rating and nothing more, completed the circuit. When the sensor

ailed, the loop closed on 346 lives. 14 Judgment Proo —

 The compliance o ---

icer at the major bank is not a bad pro — essional. She is a trained pro — essional operating within an institutional architecture that has replaced the discretion o — loan o —

icers, risk managers, and relationship bankers with models, algorithms, and documented compliance processes. The mortgage origination crisis o — 2008 was not a — ailure o —

raudulent individuals, though there were — raudulent individuals. It was a systemic — ailure o — institutions that had eliminated the considered assessments o —

underwriters and replaced them with quantitative models calibrated to a world o — stable correlations, then discovered, when correlations dissolved in August 2008, that the practical wisdom they had replaced was the only thing that could have weathered the discontinuity.15 The legal brie —

iled by attorney Steven Schwartz in Mata v. Avianca is not the product o — a negligent lawyer in the ordinary sense. Schwartz used an arti — icial intelligence tool to conduct legal research, and the tool produced citations to cases that did not exist.16 The court’s response (sanctions, public censure, a ruling that became a cautionary tale — or the pro — ession) — ocused, appropriately, on the

ailure to veri — y. But the deeper — ailure was architectural. Reading a case, evaluating its holding, tracing its application across a line o —

authority, and determining its relevance to particular

acts is not a mechanical operation. It is an act o — legal discernment, the practice through which legal phronēsis develops. When the — rictionless inter — ace o — the AI replaces that practice with a polished output, it does not skip a step. It removes the curriculum. The attorney who accepts the output without veri — ication is not simply lazy. The system was designed to invite precisely that acceptance, because the entire logic o — the tool is the elimination o — the — riction that develops judgment. Chapter 1: Haddaway’s Law 15

Tikkun Ha-Gu

, Tikkun Ha-Ne — esh The Deskilling Loop is not an accident o — institutional design. It is the predictable consequence o — a philosophical trajectory that Western law has been traveling since the seventeenth century. The classical tradition understood law to serve both o — its purposes. Aristotle held that legislators make citizens good by

orming habits in them.17 Aquinas held that law must establish general principles while leaving space, determinatio, — or those acting in particular circumstances to speci — y the concrete shape o — right action.18 Maimonides understood that you cannot coerce wisdom: the per — ection o — the soul depends on the exercise o — a — aculty that disappears the moment it is replaced rather than cultivated.19 Then the Wars o — Religion destroyed the consensus that had made the second purpose operationally possible. The catastrophe o —

con

essional war — are, the Thirty Years’ War alone killed perhaps a third o — the German-speaking population,20 demonstrated with lethal clarity what happens when states optimized — or the cultivation o — the highest good encounter populations that violently disagree on what the highest good is. The Sca —

olding — unction, in a world o —

ractured theological consensus, did not produce wisdom. It produced massacre. The intellectual response was a retreat traced through Grotius, Hobbes, Locke, and Mill. Each thinker narrowed law’s legitimate scope in response to genuine historical catastrophe. Hugo Grotius, writing amid the Dutch Revolt, grounded natural law in sociability rather than theology, securing a minimum grammar o — coexistence that Catholics and Protestants could share.21 Thomas Hobbes, writing while England was still cooling — rom its own civil war, eliminated the summum bonum entirely and replaced it with the universal aversion to violent death: law exists not to make men good 16 Judgment Proo —

but to keep them alive.22 John Locke drew a strict line between civil interests and the care o — souls, insisting that the state had no legitimate authority over the latter and that coerced religious con — ormity was not merely ine —

ective but wrong.23 John Stuart Mill articulated the principle that would become the operating rule o —

modern liberalism: the only legitimate basis

or state coercion is the prevention o — harm to others.24 Each o — these moves was responsive to genuine catastrophe. The retreat was not motivated by cynicism. It was motivated by the corpses o — those who had died because states that claimed the authority to cultivate souls had exercised that authority with — ire and sword. The problem was not the retreat. The problem was what happened to the retreat once it succeeded. A modus vivendi designed

or survival was mistaken — or a permanent architecture o — political li — e. The emergency sca —

olding was taken as the permanent building. The minimum grammar o — coexistence (don’t kill your neighbors, keep your promises, respect their property) became not the — loor o — legitimate law but its entire scope. Once the scope was

ixed, the only way to demonstrate that law was doing its job was to demonstrate that harm was being prevented. Prevention became not merely law’s — irst — unction but its exclusive one. Haddaway’s Law

ollowed with the logical inevitability o — a corollary.

Architecture o

Forgetting But even the philosophical genealogy does not — ully explain how we arrived at the world o — the 737 MAX, the compliance industrial complex, the ninety-minute interrogation o — the charity-motivated grandmother. The intellectual retreat — rom law’s second purpose Chapter 1: Haddaway’s Law 17

was completed by an institutional architecture that converted that retreat into an en — orcement mechanism. Frank Knight, the Chicago economist whose 1921 monograph Risk, Uncertainty, and Pro — it drew what should have been an indelible distinction between calculable risk and genuine uncertainty, understood that some situations involve probability distributions you can estimate and some situations involve conditions so novel that no historical distribution o —

ers reliable guidance.25 Risk can be managed by algorithm. Uncertainty requires judgment. The distinction was precise, empirically grounded, and almost immediately ignored by Knight’s intellectual successors. The — inancial innovations o — the late twentieth century — Value-at-Risk models, the Black-Scholes — ramework, the collateralized debt obligations rated AAA by agencies that relied on historical correlation data — were built on the systematic con — lation o — risk with uncertainty.26 Roger Lowenstein, writing about Long- Term Capital Management’s collapse in 1998, identi — ied the core error: the partners had built an architecture — or the domain o —

calculable risk and assumed it covered the domain o

genuine uncertainty.27 LTCM had — ourteen principals with seventeen Nobel Prize invitations among them. The models were right until the world delivered a situation that had no historical precedent. The models had nothing to say about such situations, because models are calibrated to history. The administrative state that grew alongside these — inancial innovations built its own version o — the con — usion. The Administrative Procedure Act o — 1946 established a constitutional covenant — or agency rulemaking: publish, invite comment, respond in writing, submit to judicial review.28 The covenant held — or roughly three decades. Then the courts, applying what they called 18 Judgment Proo —

the “Hard Look” doctrine, began requiring agencies to demonstrate exhaustive consideration o — every relevant — actor and every viable alternative.29 Rational administrators responded by asking whether

ormal rulemaking could be avoided. The answer was yes: guidance documents, Dear Colleague letters, en — orcement actions converted into consent decrees, compliance standards embedded in insurance requirements and accreditation conditions. All o — this carries the practical weight o — law while remaining, in the agency’s own characterization, technically non-binding. The shadow regulatory state is a system — or achieving the e —

ect o — law without the procedural requirements that make law accountable.30 Steven Teles called the result “kludgeocracy”: a system o —

accumulated complexity, each layer added to solve an immediate problem, whose aggregate e —

ect is a legal environment that no single person can comprehend.31 The Code o — Federal Regulations exceeds 185,000 pages. The compliance o —

icer exists because the law has become unintelligible to non-initiates. The consequence is an industry whose product is — riction management and whose continued existence depends on the — riction remaining unresolved. This is the architecture o — the machine: the institutional — orm that Haddaway’s Law takes when implemented through the administrative state. The architecture is not the product o — malice. It is the product o — a logic that is internally coherent and historically intelligible. The tragedy is not that individual actors behaved badly. The tragedy is that the architecture produces bad outcomes reliably, predictably, and with the — ull cooperation o — everyone operating in good — aith within it. Chapter 1: Haddaway’s Law 19

What Maimonides Saw A word on what this book is not. Barry Schwartz and Kenneth Sharpe’s Practical Wisdom and Michael Sandel’s What Money Can’t Buy occupy adjacent terrain, and both make the case — or practical wisdom well. This book’s argument is di —

erent. It is about the institutional mechanism that destroys wisdom and the architectural alternatives that preserve it. The diagnosis is mechanistic. The prescription is structural. The question is not whether we should want wise physicians, wise judges, and wise bankers. The question is what happens to the institutional machinery when we build systems that depend on judgment and then engineer judgment out. This book makes — our connected claims. The — irst is historical. The Western legal tradition understood, until approximately the seventeenth century, that law serves two purposes: — oundation and sca —

olding, tikkun ha-gu — and tikkun ha- ne — esh, and that it operates within inherent limits that prevent it

rom speci — ying what can only be judged. This understanding was not vague philosophy. It was the operational basis o — actual legal systems built by men who also happened to be among the most penetrating thinkers their civilizations produced. We lost this understanding through a process o — retreat that was initially intelligible and gradually catastrophic. The second claim is epistemological. The ambition o — modern regulatory design (to eliminate uncertainty through more complete speci — ication, to substitute rule — or judgment, to achieve through institutional architecture the sa — ety that wisdom might have provided) is not merely ine —

icient. It is impossible in principle, because it requires a kind o — knowledge that cannot be centralized. Frank Knight’s distinction between risk and uncertainty, Aristotle’s distinction between technē and phronēsis, Michael Polanyi’s account 20 Judgment Proo —

o

tacit knowledge, all converge on the same conclusion: there is knowledge that can only be exercised, and institutions that eliminate its exercise also eliminate the capacity to acquire it.32 The third claim is institutional. The Deskilling Loop is not an accident. It is the predictable consequence o — institutional design optimized — or Haddaway’s Law. When you build systems that replace judgment with rules, those systems will produce actors who cannot exercise judgment. When those actors encounter situations that rules did not anticipate, and they will always encounter such situations, the institutional response is more rules, which produces more atrophy, which produces more rules. This is not a spiral that eventually — inds equilibrium. It is a spiral that terminates in the catastrophic — ailure o — the system that generated it. The — ourth claim is prescriptive. Recovery is possible. Not by returning to the twel — th century (we cannot and should not) and not by eliminating regulation, because — oundations matter and some modern problems require modern solutions. Recovery requires something more demanding: rebuilding the institutional conditions under which judgment can be developed and exercised. This means designing — riction back into systems that have engineered it out. It means distinguishing between the — riction that produces compliance and the — riction that produces wisdom. It means recovering the vocabulary o — law’s second purpose, not as an abstraction but as an operational commitment with structural implications — or how institutions are designed, how pro — essionals are trained, and how law de — ines what it owes to the people it governs. The next — our chapters trace the intellectual descent: the con — usion o — risk and uncertainty that produced the — inancial architecture o — the past hal — -century; the great retreat o — early Chapter 1: Haddaway’s Law 21

modern philosophy that eliminated law’s second purpose in response to genuine catastrophe; the moment when prudence became a transaction cost and compliance replaced judgment as the pro — essional ideal; and the administrative architecture that converted these philosophical commitments into the regulatory state as we currently inhabit it. The chapters that — ollow examine what the descent has cost us: in occupational licensing and the dignity o — work; in criminal justice and the possibility o — restoration; in drug regulation and the invisible graveyard o — lives not saved. The book concludes with an argument — or recovery, not a program but a

ramework, the terms on which institutions that have — orgotten law’s second purpose might begin to remember it.

Haddaway Was Wrong Return to that 1993 song. What is love? Baby, don’t hurt me. The answer is insu —

icient. Love is not merely the absence o —

harm. It is presence, attention, commitment, sacri

ice, and joy. You cannot de — ine it by listing what it is not, any more than you can de — ine light by cataloguing everything that is not light. Haddaway’s question deserved a better answer than Haddaway could give it, and the song’s pathos derives precisely — rom the gap between the magnitude o — the question and the poverty o — the response. So with law. You cannot de — ine law by what it prevents any more than you can de — ine love by what it does not do. Law is not merely the absence o — chaos. It is the presence o — order, the structure that enables cooperation, the — ramework within which human beings can pursue their own — lourishing in ways that serve the

lourishing o — others. It is, as Aristotle understood, the institution 22 Judgment Proo —

through which political communities work out, over time and through lived experience, what it means to live well together. Haddaway’s answer was not wrong. It was incomplete. Love should not hurt. Law should prevent harm. But prevention is not purpose. It is precondition. You clear the ground so you can build. You establish — oundations so the sca —

olding can rise. You prevent the worst so the best becomes possible. The — oundation is necessary. The sca —

olding is the point. Modern law has — orgotten this. We built institutional architecture around Haddaway’s answer, and the architecture has become so elaborate, so pervasive, and so internally sel — -rein — orcing that it has acquired the appearance o — inevitability. It is not inevitable. It is a choice made by intelligible actors in intelligible circumstances — or intelligible reasons that produced consequences none o — those actors intended and that no single actor can reverse. This book is an argument that the choice can be made di —

erently. That the — ramework exists to make it di —

erently. That the cost o — not making it di —

erently is measured in the 346 dead at Bisho — tu and the Java Sea, in the grandmother at the bank counter, in the compliance o —

icer who has never learned to lend and the attorney who has never learned to read a case and the administrator who has never learned to govern. The cost is measured in a civilization that has optimized — or the prevention o — hurt and has thereby prevented itsel —

rom building anything worth protecting. The next chapter begins the account o — how we arrived here. Chapter 2: The Con — usion

The ambition to prevent all harm has a

inancial corollary. Be — ore anyone can build a machine to eliminate risk — rom institutions, someone has to believe risk can be eliminated — rom markets. In the summer o — 1998, that belie — was tested.

A Wager The problem that destroyed Long-Term Capital Management was not a problem its — ounders could predict. That is, precisely, the problem. In late August 1998, the partners o — Long-Term Capital Management were watching something their models said could not happen. Dozens o — positions (each calibrated to historical relationships between asset classes that had held — or years, in some cases — or decades) were moving against the — und simultaneously. The correlations the models treated as stable properties o — the

inancial world were dissolving in real time, all at once. By the end o — August, the — und had lost $1.9 billion. By mid-September, it had lost $4.4 billion more. On September 23, William McDonough, president o — the Federal Reserve Bank o — New York, convened a meeting o —

ourteen major — inancial institutions and told them that 24 Judgment Proo —

i

LTCM — ailed in an uncontrolled unwinding, the consequences — or global credit markets were unpredictable. The — ourteen institutions contributed a combined $3.6 billion to take over the — und and wind it down in an orderly — ashion.33 The most sophisticated risk management apparatus in the history o —

inance had just required a

ederal rescue to prevent a cascade no one could — ully anticipate. To understand how this happened, understand what the — und was built to do. In 1994, John Meriwether assembled what was arguably the most credentialed team in the history o — American — inance. The

und’s principals included Myron Scholes and Robert Merton, who would share the Nobel Memorial Prize in Economic Sciences three years later, awarded speci — ically — or their work on the mathematical pricing o — derivative securities. LTCM was — inancial theory made liquid: a demonstration that rigorous mathematics could identi — y and exploit mispricings in global — ixed-income markets, converting the apparent randomness o — bond spreads into a reliable, calculable stream o — return. Where other — unds employed — inancial theorists, LTCM was built to embody their conclusions. The — und also counted among its partners David Mullins, the — ormer vice chairman o — the Federal Reserve, who had helped design the regulatory architecture o — global — inance and now proposed to pro — it

rom its ine —

iciencies. The partners o — Long-Term Capital Management had access to more sophisticated analytical machinery, more historical data, and more accumulated intellectual capital than any comparable enterprise had ever assembled. For — our years, it worked. By 1997, LTCM had generated annualized returns exceeding — orty percent. Assets under management had grown to roughly $126 billion, supported by equity o — approximately $5 billion: a leverage ratio approaching 25- Chapter 2: The Con — usion 25

to-1. The number expressed con

idence as mathematics. The — und’s models indicated the risk was bounded. History supported this reading. The models had been right. The models had been measuring the wrong thing. In August 1998, Russia de — aulted on its domestic sovereign debt. The catastrophe was not the Russian de — ault itsel — but what happened in markets with no direct exposure to Russian bonds. Investors globally shed risk simultaneously, and the correlations between asset classes (the historical relationships that LTCM’s models had treated as permanent — eatures o — market structure) dissolved. Assets that were supposed to move independently moved together. Spreads that were supposed to converge diverged instead, and then kept diverging. The — und’s convergence trades, each individually grounded in observed historical relationships, collapsed in concert because the historical relationships had been a property o — normal times, and these were no longer normal times. LTCM lost $4.6 billion in less than — our months. In a spectacular reversal, the most sophisticated risk management apparatus ever assembled, operated by men who had received the highest — ormal recognition the economics pro — ession can bestow, — ailed in a way that threatened not merely the — und’s investors but the broader system in which the — und was embedded. Roger Lowenstein, whose account o — the collapse remains the essential text, identi — ied the core error with surgical economy: the pro — essors had con — used the measurable with the manageable.34 They had built an architecture — or the — irst and assumed it covered the second. This con — usion (between the domain o — calculation and the domain o — judgment) is the subject o — this chapter, and the deeper subject o — this book. 26 Judgment Proo —

The Prophet Chicago Ignored To understand what Merton and Scholes got wrong, it helps to understand what their predecessor got right. Frank Knight arrived at the University o — Chicago in 1917 and published, — our years later, a doctoral dissertation re — ined into a monograph that would de — ine the conceptual vocabulary o —

economic risk

or the next century. Risk, Uncertainty, and Pro — it drew a distinction that was simultaneously simple in its — ormulation and radical in its implications.35 Risk is a situation in which you — ace multiple possible outcomes but know, or can estimate, the probability distribution governing those outcomes. Rolling a die is risk. The — aces are — ixed; the probabilities are known. An insurance company — acing a large port — olio o — car accidents is in the domain o — risk: individual outcomes are unpredictable, but aggregate outcomes are stable enough to price. The underlying structure is stable. Uncertainty is something else entirely: the condition in which you — ace outcomes whose probability distribution you cannot speci — y because the — uture involves genuinely novel situations, structural breaks, innovations, and events that have no historical precedent o —

ering reliable guidance. The entrepreneur deciding whether to build a — actory — or a product that does not yet exist — aces uncertainty. The general anticipating a new — orm o — war — are — aces uncertainty. The regulator designing oversight — or a technology she does not — ully understand — aces uncertainty. In Knight’s taxonomy, these actors cannot calculate their way to the right answer. They must exercise judgment: they must make decisions under conditions where no algorithm, however sophisticated, can substitute — or the quality o — the decision-maker’s mind. Chapter 2: The Con — usion 27

The distinction mattered because it mapped directly onto the theory o ---  pro --- it. In a world o ---  pure risk, Knight argued, competition would eventually eliminate excess returns: i ---  an advantage is calculable, it is replicable, and replication drives prices to equilibrium. Genuine, sustained, above-normal pro --- it requires something that cannot be calculated and replicated. It requires success --- ul judgment under genuine uncertainty. Entrepreneurial judgment is the capacity that generates the returns pure theory cannot explain.36
Knight’s  --- ramework was a claim about epistemic humility. Economists’ tools are power --- ul within their domain (risk, stable probability distributions, repeated games) and powerless outside it. To  --- orget this boundary is to mistake the map  --- or the territory and make large bets accordingly.
Frank Knight’s Chicago was a Chicago o ---  disciplined limits. Mathematical machinery was sharp within its domain. To know where the domain ended was the task o ---  serious thinking.

What Coase Actually Said Knight’s Chicago respected the boundary between the calculable and the unknowable. The next generation erased it. In 1970, Eugene Fama published a paper that conventionally dates the shi — t: “E —

icient Capital Markets: A Review o — Theory and Empirical Work,” in the Journal o — Finance.37 Fama’s E —

icient Market Hypothesis argued that asset prices, in a well- — unctioning market, rapidly incorporate all available in — ormation. Prices are not per — ect (they are, in Fama’s care — ul — ormulation, e —

icient with respect to available in — ormation, meaning that no investor can systematically 28 Judgment Proo —

earn above-normal returns by trading on public data). Markets are not prescient; they are, as economists say, in — ormationally e —

icient. The hypothesis was sophisticated, care — ully hedged, empirically grounded, and enormously consequential in ways its author did not

ully intend. The problem was not the hypothesis but its migration. In Fama’s original — ormulation, EMH was descriptive: it claimed that prices in liquid markets rapidly incorporate available in — ormation. In the decades that — ollowed, it became prescriptive: a — ramework — or treating — inancial risk as calculable and manageable. The dri — t was gradual, understandable, and institutionally catastrophic. I — markets are e —

icient, price movements are essentially random, but in a speci — ic technical sense: random like a — air coin, with a known distribution governing the noise. This allowed

inancial economists to apply probability theory to asset prices, generating option pricing models, port — olio theory, and risk management — rameworks that became modern — inance’s in — rastructure. The mathematics succeeded in the domain it described: a world where outcome distributions were stable, where historical patterns re — lected structural — eatures that would persist, where the — uture resembled the past in the ways that mattered most. Knight’s distinction was — orgotten rather than re — uted. Modern

inance’s intellectual machinery was built — or risk and then quietly deployed against uncertainty, without acknowledging the shi — t. When Merton and Scholes applied their tools to global bond markets in 1994, they were making a sophisticated mistake: the kind that generates — our years o — corroborating evidence be — ore it destroys you. In 2004, the Basel Committee on Banking Supervision institutionalized the mistake, incorporating Value-at-Risk models Chapter 2: The Con — usion 29

into the capital adequacy requirements that governed bank balance sheets globally.38 Value-at-Risk, or VaR in the industry’s shorthand, is a speci — ic answer to a speci — ic question: what is the maximum loss, at a given con — idence level, over a given holding period, within the distribution suggested by historical price data? It is a use — ul tool — or measuring the risk that resides within a stable probability distribution. It is systematically silent about the risks that reside outside such distributions (the events that are too rare to appear in historical data, or that represent structural breaks in the patterns history records). VaR told risk managers what the worst normal day looked like. It had nothing to say about abnormal days. The Basel — rameworks, which governed capital requirements — or the world’s major — inancial institutions, were calibrated to a measure incapable o — detecting the risks most needing detection. Regulators built this — ramework not

rom ignorance but because VaR was mathematically tractable, auditable, and comparable—three properties institutional risk management requires and better tail-risk measures do not provide. The manageable drove out the accurate. Knight’s distinction between risk and uncertainty became an operational inconvenience.

Ludic Fallacy Nassim Nicholas Taleb named the con — usion. The Ludic Fallacy, as Taleb de — ined it in The Black Swan (2007), is the error o — treating the complex, non-repeating, structurally evolving world as a structured game with — ixed rules and known probability distribution.39 Ludus is Latin — or game; the Ludic Fallacy is the mistake o — building — rameworks suited to games and applying them to situations that are emphatically not games. 30 Judgment Proo —

 A casino exempli --- ies the calculable world. The house sets the rules, payo ---

s are — ixed, probabilities computed — rom — irst principles, and the law o — large numbers converts individual randomness into predictable aggregates. In the long run, the casino wins by a known margin, and a competent statistician can state that margin precisely be — ore play begins. Financial models were built — or this world. But the world is, in Taleb’s phrasing, more like a — orest: structurally open, where novel organisms appear, where interaction rules change over time, where critical events have never happened be — ore and appear nowhere in historical — requency tables. The normal distribution — ails catastrophically in systems that generate large, discontinuous, structurally novel events. Taleb called these Black Swans: events o — large magnitude, radical rarity, and retrospective inevitability (they seemed inevitable in hindsight but were invisible within probability — rameworks in use be — ore they occurred). The mathematical error deserves scrutiny. Financial models assuming normally distributed returns are calibrated to a distribution whose tails — all o —

rapidly: extreme events get vanishingly small probabilities. But observed — inancial returns do not — ollow a normal distribution. Their tails are “ — at”: extreme events occur — ar more — requently than the normal distribution predicts.40 A model calibrated to normal distribution assigns correct probabilities to eighty or ninety percent o — ordinary days and systematically underestimates ten or twenty percent o — extraordinary days. This is backwards — rom what risk management needs. As an institutional disposition, the Ludic Fallacy is as signi — icant as a mathematical error: the pre — erence — or quanti — ied, auditable risk estimates over acknowledgments o — genuine uncertainty. The Ludic Fallacy persists not — rom ignorance but because acknowledging it Chapter 2: The Con — usion 31

produces no workable replacement. Knight’s uncertainty is real but institutionally unusable. An audit requires a number. A capital adequacy requirement requires a calculation. A board requires a report. Acknowledging that some risks cannot be quanti — ied without systematic distortion satis — ies none o — these institutional requirements. The Ludic Fallacy is the product o — in — rastructure that rewards quanti — ied answers and has no mechanism — or receiving honest expressions o — ignorance: a — ailure o — design, not individuals. This is why Taleb’s diagnosis cuts deeper than a methodological critique. Institutions built to govern by models cannot hear the argument against models. The argument arrives in a — orm the institution cannot process.

Turkey Problem Taleb captured the problem most economically in a stark thought experiment. Consider a turkey.41 For a thousand days, the turkey is — ed and sheltered. Each day adds evidence to the turkey’s inductive case — or the benevolence o — the — arming arrangement. By day 999, the turkey’s con — idence in its security has never been higher. The historical record supports this con — idence comprehensively. The pattern is unbroken. The data is unambiguous. Day 1,001 is the day be — ore Thanksgiving. Inductive reasoning — rom stable historical records — ails catastrophically when those records were generated under conditions about to change structurally. The Turkey Problem reveals why con — idence peaks at maximum peril. The turkey’s con — idence is highest when its circumstances are most dangerous: because the — arm’s apparent bene — icence was always a — unction o —

32 Judgment Proo

conditions (the turkey’s immaturity, the

armer’s timing, the approaching holiday) that the turkey could not observe and its data could not capture. Translate this to institutions. A regulatory — ramework optimized — or the historical distribution o — observable risks will — ail when the structural conditions generating that distribution change. Its con — idence will be highest just be — ore the break. Its capital bu —

ers, calibrated to normal-distribution tail estimates, will be sized

or the wrong catastrophe. Its models will generate reassuring outputs until the reassurance terminates abruptly. In 2008, the — inancial crisis exempli — ied, among other things, a Turkey Problem at institutional scale. The banks, the rating agencies, and the regulatory bodies that governed them had accumulated years o — evidence that the — ramework was working. De — aults were rare; correlations between housing markets in di —

erent regions were low; the models were per — orming. The Basel VaR requirements were producing the capital cushions they were designed to produce. The records were clean. And then the conditions that had generated the records changed: mortgage origination standards deteriorated across the industry simultaneously, regional housing markets began moving together, the instruments that had been calibrated against historical de — ault rates encountered de — ault rates with no historical precedent, and the entire architecture discovered, in short order, that it had been measuring the wrong thing with extraordinary precision.42 Taleb’s broader — ramework explains what the Turkey Problem alone does not. In Anti — ragile (2012), Taleb distinguishes three responses to volatility.43 Fragile systems are harmed by volatility (they lose more — rom disorder than they gain, and their ideal condition is stasis). Robust systems are neutral to volatility (they Chapter 2: The Con — usion 33

neither gain nor lose, merely surviving). Anti

ragile systems gain

rom volatility (they improve under stress, extract in — ormation — rom disorder, emerge — rom turbulence better calibrated than they entered it). Most living systems are anti — ragile in some respects. Biology o —

ers the mechanism: hormesis, the phenomenon by which organisms exposed to sub-lethal stressors become more resistant. The human immune system does not merely survive pathogens; it requires exposure to build competence. Bones stressed by weight- bearing grow denser. Muscles under load generate the micro- damage that triggers growth. The anti — ragile system must encounter controlled disorder or — or — eit the capacity to handle uncontrolled disorder. A system designed to eliminate all volatility does not become more robust. It becomes more — ragile. The suppression o — small, recoverable disturbances eliminates the — eedback that allows adaptive systems to calibrate themselves and accumulates the invisible — ragility that will discharge catastrophically when a disturbance arrives that is too large to suppress. Sa — ety machines are — ragile in Taleb’s technical sense. By suppressing small — ailures that would reveal structural weaknesses, they produce a pro — ile that is tranquil until it is catastrophic. The VaR — ramework did not eliminate unmeasurable risks; it concealed them until they had accumulated beyond hiding. The turkey is the canonical image, but the mechanism is general: the institution optimized — or minimum observable — ailure is maximally vulnerable to — ailure it cannot observe. This is a claim about institutional design, not individual malice or incompetence. The architects o — the Basel — rameworks were solving a real problem: how to make capital adequacy auditable, 34 Judgment Proo —

comparable, and en

orceable across thousands o — institutions in dozens o — jurisdictions. They solved it with available tools—tools calibrated — or risk and deployed against uncertainty. The distinction between these domains was not, in 2004, obscure. Knight had made it in 1921. But institutional in — rastructure runs on tractable quantities, not philosophical points. The Lindy E —

ect explains why the con — usion sel — -perpetuates.

or non-perishable things (ideas, institutions, laws, practices), expected remaining li — espan is roughly proportional to current age.44 A tradition surviving a thousand years is likely to survive another thousand. A — ive-year-old technology may or may not persist. The Lindy E —

ect is a statistical claim about what long survival implies: not nostalgia dressed as probability, but that a thing persisting through centuries o — turbulence carries embedded in — ormation about robustness that recent competitors, however theoretically sophisticated, do not yet possess. Measured in decades, VaR, the Basel requirements, and quantitative risk management — aced a common law tradition measured in centuries—the very tradition they were asked to complement and in some domains to replace. The Lindy E —

ect does not say common law is correct on any given question. It says an institution tested against centuries o — novel conditions and still standing carries in — ormation about survival that a — ramework calibrated to twenty years o — data cannot replicate. Discarding the older tradition — or the newer model is a wager whose odds have not been care — ully calculated. Chapter 2: The Con — usion 35

Metastasis The con — usion between risk and uncertainty began in — inance. It did not stay there. The con — usion entered legal and regulatory institutions through the conviction that measurable outcomes were the right outcomes to optimize, that unquanti — iable judgment was a residue o — pre- scienti — ic thinking, and that the appropriate response to a governance problem was a well-speci — ied model. Be — ore examining what the replacement produced, take seriously why it seemed necessary. Unstructured pro — essional discretion had a documented record o —

ailure that judgment’s de — enders could not easily dismiss. Sentencing research in the 1970s and 1980s revealed enormous disparities: de — endants convicted o —

identical o

enses received sentences varying by years, with variance correlating to — actors (appearance, judge’s — atigue, order o — cases) no de — ensible theory o — justice could sanction. Parole boards exercised unreviewable discretion that studies — ound barely superior to chance.45 The case — or structured instruments was initially as much a civil rights argument as an e —

iciency argument: an attempt to bring human decision-making’s arbitrariness under discipline o —

consistent, reviewable standards. The impulse was legitimate. The instrument it produced was not. Algorithms arrived to reshape governance, presented as immune to human bias. Predictive models were o —

ered as more reliable than individual o —

icer assessments. Risk scores replaced parole board deliberations. Actuarial instruments displaced clinical judgments. The argument was consistent: the model is transparent, auditable, consistent; the human is opaque, unaccountable, variable. The argument contained genuine insight and concealed catastrophic error. 36 Judgment Proo —

Human judgment is susceptible to identi --- iable, systematic biases. Anchoring, availability heuristics, racial stereotyping, and dozens o ---  cognitive distortions have been documented rigorously enough to indict unstructured discretion.46 A sentencing judge imposing harsher sentences be --- ore lunch than a --- ter is a mal --- unctioning instrument by any reasonable standard, and a tool smoothing this variability serves a legitimate goal.47
The model’s apparent objectivity is a property o ---  outputs, not inputs. A model trained on historical data inherits embedded biases. A model calibrated to predict recidivism in a population where law en --- orcement has systematically over-surveilled certain communities encodes those surveillance patterns as predictive signals. The model observes not an objective world but a historical record itsel ---  the product o ---  human decisions. It encodes human bias as mathematical

act. The algorithm launders the bias, trans — orming it — rom something a court can recognize and interrogate into something presenting as mathematics. ProPublica’s 2016 investigation o — COMPAS (Correctional O —

ender Management Pro — iling — or Alternative Sanctions, deployed in sentencing across dozens o — jurisdictions) documented this laundering with unambiguous speci — icity.48 Among 7,000 Broward County de — endants, COMPAS’s risk scores were racially asymmetric in error rates: Black de — endants who did not reo —

end were labeled high-risk at nearly twice the rate o — white de — endants with identical subsequent conduct. The inverse error was equally pronounced. The algorithm was di —

erently inaccurate than a human judge. Its inaccuracy was encoded in a — ormat substantially harder — or the legal system to challenge than a human opinion. Beyond epistemic concerns, the challenge is doctrinal. A de — endant questioning a judge’s reasoning may, under most Chapter 2: The Con — usion 37

procedural

rameworks, demand that reasoning be articulated. A de — endant questioning an algorithm’s output — aces a harder problem: the algorithm’s weights and training data are o — ten proprietary, the mathematical relationship between inputs and outputs is technically opaque, and the system producing the score is in most jurisdictions not subject to the same scrutiny as human testimony. The model is, in the legal system’s own vocabulary, harder to cross-examine than a person.49 The child wel — are system — ollowed. In 2016, Allegheny County, Pennsylvania deployed the Allegheny Family Screening Tool: a predictive instrument generating a 1-20 score based on — amilies’ interactions with public service systems, where higher scores predict increased child abuse or neglect likelihood.50 The algorithm synthesizes in — ormation about prior child wel — are involvement, mental health treatment, housing assistance, and other public records. The output is a number in — luencing decisions about investigation, removal, or services. Virginia Eubanks identi — ied the structural problem that makes the Allegheny instrument a case study in con — usion rather than progress.51 The algorithm draws on data about public service usage only. Administrative data reveals a — undamental bias. Families with no public service history (because they are a —

luent enough to purchase services privately) leave no data trail and score lower risk by de — ault. Families relying on public services are more extensively documented and scored accordingly. The instrument is not measuring child wel — are risk; it is measuring the density o —

administrative surveillance. The two are correlated, but the correlation re — lects policy choices about who gets surveilled, not neutral discovery about danger to children. 38 Judgment Proo —

 A human caseworker can account  --- or the di ---

erence between a

amily whose history appears in public records because they sought help and a — amily whose history does not appear because they never needed to. The algorithm cannot make this distinction; the distinction is not in its data. Replacing case-speci — ic discernment with a procedure that is auditable, consistent, and systematically blind to the most important variable ensures the algorithm’s inadequacy. This is the signature o — the metastasis. Because it drove the Basel Committee to adopt VaR, the same institutional logic also drove the courts to adopt COMPAS and the child wel — are system to adopt the Allegheny instrument. In each case, the legal system adopted algorithmic tools not because they were better but because they were measurable; they produced outputs that could be audited, de — ended in court, compared across jurisdictions, and reported to oversight bodies. The manageable drove out the accurate. The con — usion between risk and uncertainty migrated — rom the bond trading — loor to the sentencing hearing to the caseworker’s decision. VaR, COMPAS, and the Allegheny instrument are all risk tools in the Knightian sense: they measure observable historical patterns and extrapolate. None handles novel situations: the de — endant with no historical analog, the — amily whose risk pro — ile matches no cluster in the training data, the market movement outside every calibrated distribution. None o — them knows what it does not know. This structural silence is constitutive o — tools that measure risk in the Knightian sense. It cannot be engineered away, because it is what such tools are. Chapter 2: The Con — usion 39

Knight Was Right The — ailure was predictable — rom inception and haunts — inancial and legal history. Knight predicted it in 1921. Taleb diagnosed its mechanism precisely enough that readers o — The Black Swan had the conceptual tools to anticipate 2008. ProPublica’s investigation o —

COMPAS documented what the

ramework produced in criminal sentencing, and that documentation has been in the scholarly record

or a decade. Practitioners are largely aware o — the critique. They have known it — or some time. The question that awareness cannot answer is: why do the instruments persist? They persist because the alternative is not available. The alternative to algorithmic sentencing tools is a judge’s discretion. The alternative to predictive risk scores is a caseworker’s assessment. The alternative to VaR is honest acknowledgment that certain risks cannot be quanti — ied—an acknowledgment no regulatory — ramework, capital requirement, or board report can accommodate. The con — usion persists because institutions cannot

unction on the honest answer. Sta —

are largely aware o — the limitations. It makes no di —

erence. An institution saying “we do not know” per — orms no recognizable — unction. It protects no one, satis — ies no accountability requirement, generates no auditable record. Deeper than any particular tool, the Sa — ety Machine’s commitment to producing de — ensible outputs demands a number. Models mistaking risk — or uncertainty will always — ail eventually. This is a theorem, not a — inding. Far more interesting is why institutions remain committed, structurally and apparently without exit, to the proposition that governance problems can be solved by su —

icient measurement. Why did replacing discretion 40 Judgment Proo —

with calculation seem (and to many thought

ul people still seems) not like a choice but like inevitability, the natural direction o —

progress? This is a question about the history o — an idea: how the — unction o — law and governance came to be understood, over centuries o —

intellectual development, in a way that made the Sa

ety Machine seem not merely desirable but necessary. It is a question about what institutions decided they were — or—what goals were legitimate, what methods appropriate, what outcomes they could pursue—and how those decisions — oreclosed alternatives. Answering it requires going — urther back than LTCM, — urther back than the Chicago School, — urther back than the statistical tools developed by — inancial economists in the twentieth century. It requires returning to the moment when the — oundational idea was decided: when architects o — modern political and legal thought chose, under genuine pressure and with genuine reasons, to build a certain kind o — institution rather than a di —

erent kind. The choice — elt like necessity. It always does. Chapter 3: The Great Retreat

Every philosopher in this chapter was trying to stop people

rom killing each other. They succeeded. What their success cost was law’s second — unction: the cultivation o — judgment itsel — .

Summum Bonum Between 1524 and 1648, Europe tested what happens when rival communities each possess what they believe to be the summum bonum: the highest good, which each understands itsel — authorized and obligated to en — orce. The test was not theoretical. The Thirty Years’ War killed approximately one-third o — the German-speaking population.52 The French Wars o — Religion, the English Civil War, the Dutch Revolt: each demonstrated a — oundational legal idea in catastrophic — ailure mode. For roughly two thousand years, the Western legal tradition understood law to serve two — unctions. The — irst was — oundational: suppression o — violence, security o — persons and property, and basic social ordering that makes everything else possible. The second was architectural: cultivation o — judgment, character, and practical wisdom that trans — orm surviving individuals into a civilization capable o —

lourishing. 42 Judgment Proo —

 These two  --- unctions were not equal in rank, though sequential in time. The Foundation came  --- irst because it had to. You cannot teach prudence to someone being stabbed. Physical security is the precondition  --- or everything else. But it was understood as a precondition, not an end. The Sca ---

olding (law’s capacity to — orm citizens capable o — governing themselves wisely) was the point. The Foundation made the Sca —

olding possible. The Sca —

olding made the Foundation worth having. Thomas Aquinas stated this with characteristic precision: “The purpose o — human law is to lead men to virtue, not suddenly, but gradually.”53 The claim carries structural weight: law exists to cultivate wisdom, not merely suppress violence. The political order, in the Thomistic-Aristotelian synthesis that dominated Western legal thought — rom the thirteenth century — orward, exists to make wisdom possible—not replace it, simulate it, or insure against its absence, but cultivate it. Medieval jurists understood legislation as pedagogy at scale. Good law operates as a good teacher does: through structured — riction, graduated di —

iculty, and the expectation that capacity will eventually be internalized. Aristotle made the underlying argument in the Nicomachean Ethics. Legislators make citizens good by — orming habits in them, he wrote, and this is every legislator’s wish.54 The claim was not that law could manu — acture virtue by — iat but that law could create conditions where virtue develops: habitual action patterns, structured encounters with di —

iculty. The state was a gymnasium: an institution designed to exercise human capacities by subjecting them to calibrated resistance. The Thomistic synthesis connected individual virtue to political order to divine purpose. Temporal peace maintained by the king was not the — inal word but the plat — orm on which wisdom’s Chapter 3: The Great Retreat 43

cultivation could occur. The state exists to enable what Maimonides, writing — rom a di —

erent but closely related tradition in the same century, called tikkun ha-ne — esh (the per — ection o — the soul) by — irst securing tikkun ha-gu — (the per — ection o — the body).55 Prior in time but subordinate in rank: law’s physical in — rastructure precedes character cultivation. This was the baseline. The question this chapter must answer is: what happened to it?

Catastrophe The per — ectionist state requires agreement about what — lourishing means. When Catholics and Lutherans and Calvinists agreed on the basic content o — the good, the Sca —

olding — unction was merely pedagogically demanding. When they disagreed, it became a machine — or civil war. Law that exists to promote the true religion, applied in a society that has radically — ractured over what the true religion is, does not produce virtue. It produces massacre. The Thomistic — ramework, constructed — or a world in which theological consensus provided the shared vocabulary — or de — ining human — lourishing, proved vulnerable once that consensus

ractured. The Re — ormation destroyed it with a thoroughness that no subsequent ecumenical movement has — ully reversed. The tradition’s vulnerability was circumstantial, not philosophical: its operating conditions had been destroyed beneath it. Early modern philosophers, responding to this collapse like physicians trying to stop the bleeding, produced an intellectual architecture that solved the immediate problem with a thoroughness that created a di —

erent, slower, less visible problem 44 Judgment Proo —

downstream. That architecture still operates. It is the Sa

ety Machine’s — oundation.

Grotius’s Modus Vivendi Hugo Grotius was a Dutch jurist writing in the — irst decades o — the seventeenth century, amid the Dutch Revolt and the Thirty Years’ War’s opening salvos. He understood what was at stake as well as any man alive. His task was to — ind a basis — or binding legal obligations that could survive the — racture o — Christian unity: something Catholics and Protestants, Dutch and Spanish, could acknowledge without — irst agreeing on which Pope was legitimate or which Scripture reading was authoritative. His solution was methodological audacity. In the prolegomena to De Jure Belli ac Pacis, published in 1625, Grotius asserted that natural law’s — oundational principles (keep your promises, do not take what is not yours) would retain their validity “even i — we should concede that there is no God, or that the a —

airs o — men are o — no concern to Him.”56 The etiamsi daremus principle, as it became known: law grounded not in theology but in human sociability’s nature. We are creatures designed — or association. The norms making association possible are there — ore binding on us whether or not God exists to en — orce them. Grotius was a devout Christian who spent much o — his career working — or Protestant-Catholic reuni — ication.57 The etiamsi daremus was a methodological stratagem: a way to construct a minimum legal grammar that con — licting parties could share without resolving theological di —

erences. You can agree to keep your promises even i — you disagree about why keeping promises is obligatory. Chapter 3: The Great Retreat 45

Grotius o ---

ered, in later philosophical language, a modus vivendi: a working arrangement, a way to stop the killing without requiring the restoration o — unity the killing had shown was no longer available. He was saving what he could. The evidence that he regarded this as saving and not celebrating is unmistakable: he longed — or Christian unity, wrote extensively toward its recovery, and viewed Christendom’s — racture as a tragedy to be healed.58 The minimalist natural law was not his ideal. It was his emergency measure. Grotius accepted the retreat — rom the Sca —

olding — unction because he had to. He understood it as a retreat. He did not claim it as a victory.

Hobbes’s Inversion Thomas Hobbes made the truly radical move. Where Grotius sought a common denominator within the tradition (rescuing what was possible — rom the wreckage), Hobbes decided the tradition was the wreckage. The per — ectionist state, in his analysis, was not an ideal corrupted by theological con — lict but the cause o — the con — lict. Attempting to use state power to en — orce the summum bonum was inherently, inevitably, a recipe — or civil war, because there is no summum bonum. The idea is a philosophical error, and an expensive one. Hobbes was explicit. In Leviathan, published in 1651 while England still recovered — rom its civil war, he attacked the “old moral philosophers” directly: “there is no such Finis Ultimus [utmost aim] nor Summum Bonum [greatest good] as is spoken o — in the books o —

the old moral philosophers.”59 Good and evil are not properties o

the world. They are names we give to our appetites and aversions. 46 Judgment Proo —

Since appetites vary

rom person to person and change within the same person over time, no single account o — the good can ground law. Felicity, Hobbes wrote, is “a continual progress o — the desire,

rom one object to another.”60 It does not terminate in beatitude. It terminates in death. Hobbes o —

ered not another conception o — the good but a single, universal aversion: the — ear o — violent death. This, he argued, is the one thing all human beings share regardless o — religion, philosophy, or class. Whatever else we disagree about, we agree we do not want to be killed. From this minimal shared premise, Hobbes constructed the entire architecture o — the modern state. From this premise, the political implications become stark. I — the only state — unction is to prevent the summum malum—the greatest evil, which is the state o — nature’s “war o — all against all”—then the Sca —

olding — unction disappears entirely. Law becomes the command o — whoever holds su —

icient — orce to en — orce it. Auctoritas, non veritas — acit legem: authority, not truth, makes law.61 The law is not a teacher. It is a guard. Its job is keeping people — rom killing each other. What they do with the resulting peace is their own a —

air. This is a pro — ound inversion o — the original hierarchy. In Thomistic synthesis, the Foundation (physical security) was prior in time but subordinate in rank. The Sca —

olding (cultivation o —

wisdom) was the point. In Hobbes, the hierarchy is reversed: the Foundation becomes the entire project. Sa — ety is not the plat — orm

or wisdom. Sa — ety is the goal. The sca —

old is not what you build so you can build the building. The sca —

old is the building. He was satis — ied with it. He did not view the neutral secular state as a second-best compromise with a — ragmented world but as the only rational structure — or any society in any world, because the per — ectionist alternative was a conceptual error. Grotius regretted Chapter 3: The Great Retreat 47

the loss o

Christian unity. Hobbes regarded Christian unity as the source o — the problem. The shi — t — rom the modus vivendi to the intrinsic ideal changed everything that — ollowed. Notice what has happened to the Sca —

olding. In Grotius, it survives in attenuated — orm: natural law still cultivates something like civic sociability, even i — it can no longer reach all the way to divine beatitude. In Hobbes, the Sca —

olding has been taken down entirely. Law has no interest in what kind o — people you are, only in whether you are killing your neighbors. The cultivation o —

discernment, character, and practical wisdom has been privatized (handed o —

to — amilies, churches, and civil associations) and law has been relieved o — any responsibility — or it. The logic holds. I — you believe that attempting to use law to cultivate virtue caused the Wars o — Religion, then removing that

unction looks like the rational response. And the relie — is real: removing the Sca —

olding — unction does prevent a particular catastrophe. The catastrophe it enables is di —

erent and slower to arrive.

What Locke Moralized Away John Locke completed the work Grotius began and Hobbes radicalized, but in a di —

erent register. Where Hobbes was a rationalist rejecting the Sca —

olding — unction because he thought it philosophically incoherent, Locke was a Christian rejecting it because he thought it theologically impermissible. The distinction matters. Grotius’s retreat was a concession to necessity. Hobbes’s retreat was a philosophical conclusion. Locke’s retreat was a moral duty. By the time Locke — inished, the question was no longer whether the state should re — rain — rom cultivating 48 Judgment Proo —

souls. The question was whether a state that tried to cultivate souls was violating a sacred obligation. The argument, laid out in the Letter Concerning Toleration o —

1689, proceeds in two steps. First, Locke draws a strict line between civil interests and the care o — souls. Civil interests (“li — e, liberty, health, and indolency o — body; and the possession o — outward things”) are the magistrate’s jurisdiction.62 The care o — souls is not. It is not committed to the civil magistrate by God. It is not consented to by individuals entering civil society. It — alls outside the legitimate scope o — state power. Second, and more importantly — or what — ollows, Locke argues that even i — the magistrate could coerce religious con — ormity, he would be causing harm rather than preventing it. “True and saving religion,” Locke writes, “consists in the inward persuasion o — the mind.”63 You cannot — orce someone to believe something. You can

orce them to per — orm belie — ’s outward motions, but coerced per — ormance is not — aith; it is hypocrisy, which is a sin. The magistrate trying to save your soul through compulsion is not being paternalistic. He is being cruel. He is leading you into damnation while believing he is leading you toward salvation. The epistemological corollary — ollows naturally. I — the magistrate cannot compel genuine — aith, it is partly because — aith resists compulsion and partly because the magistrate has no special access to the truth about salvation. “The one only narrow way which leads to heaven,” Locke observes, “is not better known to the magistrate than to private persons.”64 The king has no theological authority that the ordinary believer lacks. His expertise is civil governance. He is not quali — ied to administer the Sca —

olding

unction, and claiming to do so is an act o — presumption that endangers rather than advances the souls in his care. Chapter 3: The Great Retreat 49

This is a crucial move. Grotius’s argument  --- or neutrality was pragmatic: we cannot agree on the good, so law must be grounded elsewhere. Hobbes’s argument was metaphysical: there is no good to agree on. Locke’s argument is moral and theological: the state’s attempt to cultivate souls is an act o ---  usurpation violating both

aith’s nature and the limits o — human epistemic authority. Where Grotius conceded, Locke corrected. The retreat had become an obligation. By trans — orming the retreat into a moral imperative, Locke hardened it considerably. A modus vivendi can, in principle, be revisited when circumstances change. A philosophical conclusion can be challenged by better philosophy. But a theological duty (a claim that the state’s attempt to cultivate virtue is an act o —

impermissible overreach) resists revision in ways that a pragmatic arrangement or a philosophical argument does not.

Baby, Don’t Hurt Me (1859) Haddaway’s — our-word plea became a dance- — loor anthem in 1993. John Stuart Mill had already given it the — orce o — law in 1859. The harm principle is “don’t hurt me” rendered as political philosophy: the only legitimate reason — or society to exercise power over an individual is to prevent harm to others. Everything else—your character, your choices, your soul—is your own a —

air. I — Locke supplied the theological argument — or neutrality, Mill supplied its secular operationalization. Writing in 1859 in a world reorganized by the American and French revolutions and the early industrialism those revolutions had unleashed, Mill posed the governing question directly: when is the state entitled to coerce its citizens? 50 Judgment Proo —

The answer he gave was crisp and became, in time, almost de --- initional  --- or the liberal tradition: “the only purpose  --- or which power can be right --- ully exercised over any member o ---  a civilized community, against his will, is to prevent harm to others.”65 His own good, physical or moral, is not su ---

icient warrant. Over himsel — , over his own body and mind, the individual is sovereign. This is the Harm Principle, and it completed the structural work that Grotius, Hobbes, and Locke had begun. Where earlier thinkers had argued that the state should not cultivate virtue, Mill argued that the state could not cultivate virtue without violating something sacred. The harm principle establishes a categorical limit on coercion: not a prudent guideline about when intervention tends to go well, but a boundary whose violation constitutes tyranny regardless o — intent. The state’s entire authority rests on the mandate to prevent harm to others. Anything beyond that mandate is tyranny, however benevolent. For the Sca —

olding — unction, the consequence is complete. Aristotle’s legislator — orms habits in citizens by requiring them to per — orm virtuous acts, on the theory that repeated practice o — virtue gradually produces virtue as a settled disposition. This is precisely what the Harm Principle prohibits. The citizen who is harmless to others is beyond the state’s reach, even i — she is developing no virtuous dispositions whatsoever, even i — she is becoming progressively less capable o — the practical wisdom that Aristotle considered the crown o — human development. Her atrophy is her own concern. Mill was aware that this position required a de — ense against the charge that it produced exactly the moral vacuum the pre-modern tradition had worried about. His response was that human excellence develops better through — reedom than compulsion; that Chapter 3: The Great Retreat 51

the

ree exercise o —

aculties, including discernment, is itsel — the gymnasium o — human development.66 This argument has genuine

orce: the history o — compulsory virtue is not encouraging. But it rests on an assumption not guaranteed by the principle: that — ree societies would cultivate the institutions and practices that develop judgment. The Harm Principle tells us what the state cannot do. It says nothing about what civil society must do to — ill the resulting space. When civil society — ails to — ill it, the principle o —

ers no remedy.

Per

ectionist State The catastrophes o — the twentieth century con — irmed the liberal retreat with a — orce that no previous argument had been able to muster. Fascism and Soviet Communism were, among other things, experiments in what a per — ectionist state looks like when it has access to modern administrative machinery, mass communication, and the technology o — industrial killing. The result settled what earlier generations had argued about in theory. Stalin’s collectivization o — Soviet agriculture enacted this catastrophe at civilizational scale. The policy eliminated local agricultural judgment—peasant — armers’ generations o —

accumulated knowledge about soil conditions, planting schedules, crop rotation, and seasonal weather patterns speci — ic to their regions—and replaced it with centralized planning directives issued

rom Moscow. Bureaucrats without knowledge o — local conditions mandated grain quotas and planting schedules determined by theoretical models and political targets rather than by the distributed practical wisdom o — the people who worked the land. The result was the Ukrainian — amine o — 1932–33, the Holodomor, in 52 Judgment Proo —

which millions died because centralized planners, lacking dispersed knowledge available to local — armers, imposed agricultural requirements catastrophically unsuited to local conditions.67 This was not the un — ortunate cost o — a well-intentioned mistake. It was the logical outcome o — eliminating situated judgment in — avor o —

centralized speci

ication: the book’s entire argument made visible in the deaths o — millions. Judith Shklar, writing in 1989 in the a — termath o — those experiments, gave the liberal position its most honest sel — - description. She called it the “liberalism o —

ear”68: a politics organized around the imperative to prevent cruelty rather than the aspiration to achieve any positive good. Not the good li — e, but the avoidance o — the worst. Cruelty- — irst is the political philosophy o —

people who have witnessed what political philosophies produce. This is the inheritance that shaped Rawls. The liberalism o —

ear was a civilization’s traumatized response to the demonstration that certain mistakes are irreversible (a settlement imposed by catastrophe rather than reasoned — rom — irst principles). The summum malum that Hobbes described as abstract — ear o — violent death had become, by 1945, a documented historical experience on a scale — oreclosing easy argument. The case against the per — ectionist state was no longer merely philosophical. It was empirical. The result was a determination that the retreat had not gone — ar enough, that the liberalisms o — Hobbes and Locke and Mill had still le — t too much room — or the state to impose its vision o — the good on citizens who disagreed. The solution was to make neutrality more robust, more systematic, and more immune to the kind o — historical revision that had allowed per — ectionist states to arise again and again despite the earlier lessons. Chapter 3: The Great Retreat 53

When Justice Became Procedure By the time John Rawls published A Theory o — Justice in 1971, the intellectual work had been prepared by three centuries o — argument and con — irmed by the most consequential political history in human experience. What Rawls contributed was systematic architecture: a

ramework rigorous enough to serve as the — oundation — or an entire tradition o — jurisprudence, constitutional theory, and institutional design. Rawls crystallized the structure into its — inal, most systematic

orm. His central claim was that justice is the “ — irst virtue o — social institutions” and that just institutions must be neutral among the “comprehensive doctrines” (the — ull conceptions o — the good li — e that citizens hold).69 The state cannot — avor Christianity over atheism, classical virtue ethics over utilitarian hedonism, or any other substantive account o — what makes a human li — e go well. Its job is to maintain the — air — ramework within which citizens can pursue their own conceptions o — the good. The right is prior to the good.70 The architecture o — the argument is recognizable — rom the earlier tradition. Rawls, like Locke, grounds neutrality in an account o — what reasonable people can agree to: his — amous “veil o —

ignorance” thought experiment, in which parties choosing principles o — justice do not know their own place in society, their natural talents, or their conception o — the good.71 The principles chosen under this veil are ones that could be accepted by anyone, regardless o — their particular commitments. This is public reason: the constraint that coercive laws must be justi — iable in terms accessible to all reasonable citizens, not merely those who share a particular — aith or philosophy. The Sca —

olding — unction, in this — ramework, is not merely unnecessary. It is unjust. A state that uses law to cultivate a 54 Judgment Proo —

particular conception o

virtue (say, Aristotelian practical wisdom, or Maimonidean character — ormation) is imposing a comprehensive doctrine on citizens who may reasonably reject it. The state’s job is to secure the conditions under which citizens can cultivate whatever virtues they choose. It cannot tell them which virtues to choose without violating their equal standing as moral agents. Rawls was a rigorous and care — ul philosopher, and he was aware o — the tension at the heart o — this position. He acknowledged, in Political Liberalism, that the neutral state is itsel — a substantive commitment, not a view — rom nowhere.72 The requirement that laws be justi — iable through public reason is a principle that many reasonable citizens (including many religious citizens) might reject. He struggled, without — ull success, to explain why this particular

orm o — neutrality was itsel — neutral rather than another comprehensive doctrine dressed in procedural clothing. But these internal tensions, however real, did not prevent the

ramework — rom becoming dominant. By the late twentieth century, Rawlsian political liberalism was the operating system o — the liberal legal academy. Its principles organized constitutional doctrine, administrative law, and institutional design. The state was a re — eree: it organized the terms o — competition without prescribing what counted as winning. It provided the — ramework within which human — lourishing could occur and was disquali — ied — rom de — ining

lourishing itsel — .

Hollow State The result o — this — our-hundred-year retreat is the peculiar institution that governs contemporary li — e: the Hollow State. Chapter 3: The Great Retreat 55

The Hollow State is, by historical standards, enormously active. It runs public schools,  --- unds universities, licenses physicians and attorneys and pilots, mandates healthcare coverage, subsidizes artistic production, and employs hundreds o ---  thousands o ---

bureaucrats whose work involves, in some

orm, cultivating human capacities. In its actual operations, it sca —

olds continuously. But it can only speak o — the Foundation. Available to the modern liberal state — or justi — ying its own actions are vocabularies o — prevention, correction, and harm reduction. The school system exists because education corrects — or market — ailures in human capital production. The healthcare mandate prevents the externalities o — uninsured risk. The arts

unding corrects — or the public-goods underproduction o — cultural markets. Every enabling activity must be translated into prevention’s grammar be — ore it can be legitimized. We speak o —

“human capital” when we mean wisdom. We speak o

“transaction costs” when we mean the bonds o — community. We speak o — “risk” when we mean the possibility o —

ailure inseparable — rom the possibility o — genuine achievement. This translation is not merely imprecise. It is structurally distorting. Lacking any internal limiting principle, the vocabulary o — harm prevention expands without natural boundaries. Every new harm justi — ies an extension o — the prevention apparatus. Every extension generates new harm categories requiring — urther extension. The logic is sel — -rein — orcing because it is one-directional: there is no point at which the vocabulary o — harm prevention can say “enough; we have prevented su —

icient harm, the Sca —

olding is no longer needed.” The Precautionary Principle illustrates this mechanism in its clearest — orm. In its canonical — ormulation, the Precautionary 56 Judgment Proo —

Principle holds that where there is a threat o

serious or irreversible damage, lack o —

ull scienti — ic certainty shall not be used as a reason

or postponing measures to prevent environmental degradation.73 This seems reasonable. The problem is structural: the principle tells regulators when to act (whenever harm is possible) but provides no equivalent principle — or when to stop. It has an accelerator but no brake. Every additional category o — possible harm (environmental, psychological, reputational, dignitary) activates the apparatus. No category o — achieved sa — ety deactivates it. The machine cannot declare victory and stand down, because the vocabulary in which victory could be declared does not exist.74 The vocabulary o — the Thomistic tradition had a limiting principle: tikkun ha-gu — is prior in time but subordinate in rank. Physical security makes wisdom possible; it does not replace it. The Foundation is the sca —

olding — or the Sca —

olding. This hierarchy gives the political order something to be — or beyond its own perpetuation. It makes the question “when have we done enough?” answerable: when citizens have developed the wisdom to govern themselves, the law’s pedagogical work is complete. Unlike the Thomistic — ramework, the vocabulary o — harm prevention has no equivalent limiting structure. Harm is open- ended. Its de — inition expands with the administrative apparatus that measures and addresses it. What begins as “harm” meaning physical injury gradually expands to include economic injury, psychological injury, dignitary injury, environmental injury, expressive injury. Each expansion is locally de — ensible (there are real people being hurt by things that earlier categories missed). But the cumulative result is a machine with no governor, no mechanism — or asking whether the cost o — prevention has begun to exceed the cost o — the harm being prevented. Chapter 3: The Great Retreat 57

The Hollow State’s borrowed vocabulary is not its only problem. Its deeper problem is that it actively obscures what the state is actually doing and why. A government that justi --- ies public education as “human capital  --- ormation” has hidden  --- rom itsel ---  the reason education was worth building. It cannot, within its own justi --- icatory  --- ramework, explain why wisdom matters; only why productivity matters. When the two diverge, as they sometimes do, the  --- ramework has no resources  --- or choosing wisdom. It can only choose productivity.
This is the intellectual condition o ---  a civilization that has systematically stripped its governing institutions o ---  the vocabulary they would need to ask whether any given prevention measure is worth its costs to human capacity. Not the costs in dollars; those can be quanti --- ied and analyzed. The costs to discernment, discretion, and the development o ---  practical wisdom that occurs only through the exercise o ---  practical wisdom. The Hollow State cannot see these costs because its vocabulary has no name  --- or them. They do not show up in the cost-bene --- it ledger. They are the transaction costs that turn out not to be waste.

Chicago’s Inheritance Chapter 1 described the intellectual appeal o — the Chicago School o —

Law and Economics: the promise o

mathematical precision applied to legal problems, the hope that su —

iciently care — ul modeling could prevent the harm caused by arbitrary and inconsistent judgment. Chapter 2 described what that promise cost: the con — usion o — risk with uncertainty, the atrophy o — capacities that develop only through con — ronting problems that resist modeling. 58 Judgment Proo —

Neither chapter  --- ully explained why this particular  --- ramework arrived when it did and achieved the dominance it achieved. The Chicago School’s analytical tools were power --- ul. But power --- ul tools appear in many eras and  --- ail to take hold  --- or want o ---  a receptive environment. Law and economics conquered legal academia in the 1970s and 1980s because the analysis arrived in a society that had already, over  --- our centuries, dismantled the vocabulary it would have needed to resist what the analysis implied. The quality o ---  work mattered; the receptive environment mattered more.
The liberal state had already been persuaded, through  --- our centuries o ---  the process described in this chapter, that it had no authority to cultivate judgment. The Chicago School arrived with mathematical apparatus to measure  --- riction and demonstrate its costs with a precision the neutral state’s existing vocabularies could not match. The  --- ramework  --- it the Hollow State’s pre-existing shape per --- ectly (because it had already been hollowed out by the project o ---

extracting virtue

rom law’s legitimate purposes). Reasonable in its time, the Grotian modus vivendi was a — itting response to an emergency. The Hobbesian inversion solved a real problem while creating a di —

erent one. The Lockean moralization was an internally coherent theological and philosophical argument. The Rawlsian crystallization addressed genuine injustices o — the per — ectionist tradition. None o — these thinkers was wrong about what they were responding to. The wars were real. The gulags were real. The costs o — a per — ectionist state gone wrong are among the worst things a civilization can in — lict on itsel — . But the aggregate result o — these reasonable responses to real problems is a governing — ramework that cannot tell the machine when to stop. Not because no one is paying attention. Because the vocabulary to articulate the stopping condition was abandoned — our Chapter 3: The Great Retreat 59

centuries ago, in the justi

ied panic o — a civilization watching itsel —

tear itsel

apart over what it meant to be human. Law’s Sca —

olding — unction was abandoned: its capacity to cultivate judgment, character, and practical wisdom (the capacity to act under uncertainty, exercise discretion, and take responsibility

or outcomes that rules cannot — ully determine). The Foundation alone was installed in its place: harm prevention, physical security, procedural order, and the endless production o — rules to govern the spaces where judgment used to live. The Sa — ety Machine is the Foundation without the Sca —

olding. People o — considerable intellectual sophistication built it deliberately, trying to solve real problems. They solved them. And in doing so they created the conditions — or a di —

erent kind o —

problem: one that arrives not in the

orm o — a catastrophe legible enough to demand a response, but in the — orm o — a slow atrophy that looks, — rom inside the machine, like progress. The Chicago School inherited this condition and equipped it with better math and sent it — orward. The next chapter traces what the inheritance built. Once the philosophical vocabulary — or law’s second purpose was gone, judgment itsel — became a cost — and an entire industry arose to eliminate it. Chapter 4: Prudence as Transaction Cost

Three developments during the 1970s through the 1990s share a common logic. Richard Posner published the — ramework that classi — ied judgment as a transaction cost subject to optimization. American schools adopted zero-tolerance discipline policies that removed — rom principals the authority to distinguish a — irst-grader’s camping utensil — rom a weapon. And the compliance industry grew

rom an incidental back-o —

ice — unction into one o — the country’s largest pro — essional sectors.

Pro

ession without Judgment In 1970, the United States Bureau o — Labor Statistics did not track compliance o —

icers as a distinct occupational category. The pro — ession was too small to merit a line in the — ederal employment surveys. By 2022, more than 353,000 Americans held the title: a

igure that excludes the attorneys, auditors, risk analysts, and consultants whose primary — unction is identical but whose business cards say something else.75 Major — inancial institutions now employ more compliance sta —

than trading sta —

. American hospitals dedicate entire administrative — loors to documentation whose primary purpose is litigation de — ense rather than patient care. 62 Judgment Proo —

Universities maintain o

ices sta —

ed by dozens o — Title IX coordinators, accreditation specialists, and institutional review board administrators whose collective — unction is to ensure that every decision that could become the subject o — a lawsuit is traceable to a rule rather than to a person.76 The compliance industry generates an estimated $270 billion annually in the United States alone.77 Most o — this investment goes to documenting the absence o — liability, not to preventing harm. The compliance o —

icer’s core product is a de — ensible paper trail. The compliance industry grew alongside the century’s most consequential institutional — ailures. Enron, the 2008 — inancial crisis, the opioid epidemic, the Boeing 737 MAX: each occurred inside institutions drowning in compliance documentation. Boeing held impeccable FAA certi — ication records — or MCAS. Enron had — our sets o — outside auditors. The nation’s largest opioid distributors — iled hundreds o — thousands o — suspicious activity reports precisely as required. The machine ran exactly as designed. What the compliance architecture could not supply was the judgment to notice that — ollowing the procedure was producing the catastrophe. The procedure was the entire point. The procedure was the de — ense. The growth o — compliance as a pro — ession maps almost precisely onto the penetration o — the Chicago School’s — ramework into institutional li — e. Understanding one explains the other.

A Category Error Chapter 1 described how Ronald Coase’s 1960 insight migrated — rom description to prescription. Coase showed that transaction costs, not legal rules, determine economic outcomes. The prescription

ollowed directly: eliminate — riction, replace judgment with rules, Chapter 4: Prudence as Transaction Cost 63

build institutions where optimal outcomes emerge automatically

rom correct rule structures. Richard Posner’s Economic Analysis o — Law, — irst published in 1973, supplied the operational — ramework.78 Where Coase had described how transaction costs shape behavior, Posner prescribed how institutions should be designed to minimize them. Legal rules should be evaluated by whether they maximize social wealth. In this

ramework, judgment—the discretion exercised by judges, administrators, pro — essionals, principals—becomes a source o —

uncertainty, inconsistency, and delay. Judgment is a transaction cost. It consumes time, produces variance, and cannot be audited — or e —

iciency. This classi — ication was deliberate. The economic argument — or eliminating judgment is, within its own terms, correct. A rule is cheaper to apply than a judgment. A bright-line standard is cheaper to apply than a contextual standard. An algorithm is cheaper to apply than a deliberation. The calculation is straight — orward. The error is taxonomic. Aristotle distinguished two modes o — practical knowledge: techne, the knowledge o — how to produce things, and phronesis, the knowledge o — how to act well.79 The cra — tsman who knows how to build a table is exercising techne. His knowledge terminates in the table; the table is external to the cra — tsman’s character. The cra — tsman can retire when the table is built. The judge who knows how to sentence wisely is exercising phronesis. Her knowledge does not terminate in the sentence; the sentence is the expression o — a capacity that has been cultivated through the practice o — judgment and that is inseparable — rom the character o — the judge hersel — . Techne can be systematized, encoded, and transmitted. A recipe is codi — ied techne. An algorithm is codi — ied techne. Optimization is 64 Judgment Proo —

always the replacement o

slow, variable techne with — aster, more consistent techne. This is legitimate and o — ten admirable. A hospital’s surgical checklist is better than the idiosyncratic intuitions o —

individual surgeons about sterile technique. The checklist is more reliable because it encodes a best practice that is best: the same procedure every time really is the right answer. Phronesis cannot be systematized without ceasing to be phronesis. The capacity — or wise deliberation in particular circumstances develops only through the practice o — judgment. Aristotle described this as the ability to perceive “the truth” o — a situation in its irreducible particularity.80 You can encode the conclusion o — a phronetic judgment. You cannot encode the judgment itsel — , because the judgment includes the perceiving and deliberating that generated the conclusion, and precisely that perceiving and deliberating constitutes the capacity. A physician who has learned to recognize pneumonia through years o —

auscultation developed a perceptual capacity that cannot trans

er to someone who has only read descriptions o — what pneumonia sounds like. The practice is the knowledge. The Chicago School’s — ramework classi — ied judgment as techne subject to optimization when judgment in law’s Sca —

olding

unction is phronesis constituted by exercise. The compliance industry is what institutions build when they accept that classi — ication and act on it.

Rules That Breed Rules The category error, once embedded in institutional logic, generates its own sel — -rein — orcing dynamic. Each rule that displaces discretion does not merely eliminate a single exercise o — it. It eliminates the Chapter 4: Prudence as Transaction Cost 65

practice that would have developed the capacity

or all — uture discretionary decisions in that domain. The de — icit, once created, justi — ies its own extension. The logic runs as — ollows. Institutions replace judgment with rules to eliminate variance and establish compliance de — enses. The rules ensure that humans operating within the institution do not develop the capacity to handle situations the rules do not address. When those situations arise (and they always do, because the world generates more situations than rules can enumerate), the institution lacks the discernment. The institutional response is to write more rules. Each additional rule expands coverage at the cost o —

urther judgment development. Coverage expands. Capacity contracts. The institution writes more rules. The paradox is visible in the history o —

inancial regulation. The Securities and Exchange Commission’s initial regulations in the 1930s required disclosure and prohibited speci — ic — orms o —

raud. Compliance was a matter o — not lying and — iling the required documents. By 2008, the regulations governing a major — inancial institution occupied thousands o — pages o —

ederal statute and tens o — thousands o — pages o — agency rulemaking, supplemented by hundreds o — guidance documents, interpretive letters, no-action letters, and en — orcement actions that — unctioned as rules without going through the rulemaking process.81 The compliance sta —

o — a large bank had grown commensurately. The pro — essional discretion o — loan o —

icers, risk managers, and trading desks had been steadily replaced by models, algorithms, and documented compliance processes that generated the paper trail necessary to demonstrate that every decision had been made in accordance with applicable rules. 66 Judgment Proo —

In 2008, the models  --- ailed. The  --- ailure violated no rule. The models had been built, validated, stress-tested, and approved according to correct procedures. Every compliance check was satis --- ied. The risk management  --- rameworks were audited. The suspicious activity reports were  --- iled. The discernment that might have perceived that AAA-rated securities backed by subprime mortgages were not actually AAA-quality risks had been replaced by the model that said they were, and the compliance architecture that documented the model’s use.
The institutional response to the 2008 crisis was to write more rules. The Dodd-Frank Act added more than 400 new regulatory requirements. Compliance sta ---

grew by approximately 60 percent in the — ollowing decade.82 The judgment that the rules were replacing had already been substantially replaced be — ore the crisis. The institutional lesson drawn — rom the crisis was that the rules were insu —

icient: more coverage was needed, rather than that the rules were themselves producing the atrophy that had made the crisis possible. This is Haddaway’s Law at institutional scale. The attempt to eliminate the harm o — unreliable judgment produced the atrophy o —

judgment, which produced the catastrophic

ailure o — the model that had replaced it, which justi — ied more rules to govern the domain

rom which judgment had been eliminated.

Sporking Schools Downes Elementary School, Newark, Delaware. September 2009. The lunch tables were — ull o —

irst-graders. Zachary Christie, six years old, had been in school — or perhaps three weeks, long enough to have decided on some days to wear a suit and tie because he took Chapter 4: Prudence as Transaction Cost 67

school seriously. On this particular morning he was also excited about a recent acquisition: a camping utensil — rom his new Cub Scout kit, a compact combination o —

ork, spoon, and small — olding kni — e, the kind sold in every outdoor supply store and distributed to millions o — Scouts across the country every year.83 He pulled it out at lunch to eat with it. A lunchroom aide noticed the — olding component. The aide reported it to the principal. The principal consulted the Christina School District’s Code o — Conduct, which prohibited weapons on school property “regardless o — possessor’s intent.”84 A camping utensil with a — olding blade is an object with a blade. An object with a blade is a weapon. A weapon triggers mandatory suspension. The principal applied the policy correctly and suspended Zachary Christie — or — orty- — ive days, to be served at the district’s alternative placement (the — acility reserved — or students whose in — ractions were too serious — or a regular classroom setting). His mother received the call that a — ternoon. When the case came be — ore the school board, President George Evans o —

ered the rationale the policy required. Neither Evans, nor the principal, nor the aide who reported the incident believed the

irst-grader posed a genuine threat.85 Evans said so directly. His point was di —

erent: “There is no parent who wants to get a phone call where they hear that their child no longer has two good seeing eyes because there was a scu —

le and someone pulled out a kni — e.”86 The board had no authority to grant an exception. The policy’s text admitted none. Evans was not explaining a decision the board had made. He was explaining a decision the policy had made — or them, weeks be — ore Zachary Christie unpacked his Scout kit. The principal had no discretion to exercise: the institution was structured to make discretion impermissible rather than unnecessary. 68 Judgment Proo —

The institution’s relationship to harm is this: the relevant harm is not Zachary Christie, suspended  --- or a camping utensil, but a hypothetical  --- uture child injured by something that resembled a camping utensil in the hands o ---  someone with violent intent. The zero-tolerance policy eliminates the second harm by eliminating the judgment that could distinguish between them. The  --- irst harm (the real, actual harm to a real, actual child) is classi --- ied as acceptable collateral damage in the prevention apparatus. The rule prevented the rule-avoidance that could have produced the second harm. The rule also produced the  --- irst harm. The rule could not see this, because rules cannot see.
Thomas Aquinas held that law requires two essential properties: ratio (reason) and telos (purpose).87 A rule severed  --- rom its purpose produces not law but power wearing procedural clothing. The zero- tolerance policy’s purpose was student sa --- ety. Applied to Zachary Christie, the rule undermined student sa --- ety in the particular case while protecting the institution  --- rom liability in the general case. The rule devoured the purpose. The institution called it compliance.
Zero-tolerance policies spread across American schools in the 1990s through a speci --- ic mechanism: the Gun-Free Schools Act o ---

1994 conditioned

ederal — unding on the adoption o — mandatory expulsion policies — or students who brought weapons to school.88 The — ederal compliance requirement produced state implementing legislation. State legislation produced district policy. District policy produced the institutional architecture that removed — rom principals the authority (and over time the capacity) to distinguish a Cub Scout’s camping utensil — rom a weapon. The parents lobbying — or zero-tolerance policies a — ter campus violence were responding to genuine harm. The legislators dra — ting the — ederal requirement were trying to address that harm. The Chapter 4: Prudence as Transaction Cost 69

district administrators writing the policy were trying to protect their institutions — rom litigation. Each step was locally rational. The aggregate result was an institution that could no longer tell the di —

erence between Zachary Christie and a threat to public sa — ety. Not incompetence. Not malice. The systematic substitution o —

rules

or judgment, producing, over time, the atrophy o — the capacity to judge.

Moral Deskilling The pathology Zachary Christie’s case illustrates operates with particular precision wherever automation replaces the exercise o —

skill. Rules eliminate judgment. Judgment elimination produces atrophy. Atrophy produces increased reliance on rules. Aviation provides the most precisely documented example. In 2013, the Federal Aviation Administration released a study analyzing the correlation between cockpit automation and sa — ety incidents. The conclusion was blunt: overuse o — cockpit automation leads to pilot skill atrophy, mani — esting as degraded manual — lying per — ormance. Sixty percent o — the sa — ety incidents reviewed were attributable to manual handling and — light control errors—errors made by pilots who had spent their careers supervising automation they rarely needed to override.89 The mechanism operates in — our stages. Automation handles tasks that pilots once per — ormed manually, and sa — ety improves: incident rates — all because automation is more consistent than human pilots under routine conditions. Because pilots no longer per — orm manual tasks regularly, the skills atrophy. Psychomotor and cognitive abilities that develop through practice—spatial awareness, proprioceptive — eedback — rom the controls, pattern recognition that 70 Judgment Proo —

detects anomalies be

ore instruments register them—diminish through disuse. When pilots encounter situations requiring manual

light, they per — orm worse than they would have with regular practice. Incidents increase in those speci — ic situations. The institutional response is to extend automation — urther, reducing the situations requiring manual — lying rather than increasing manual practice. With — ewer opportunities to practice, skills deteriorate

urther. The loop tightens.90 The same structure, documented with causal precision, governs spatial memory and GPS navigation. A longitudinal study published in Nature Communications in 2020 — ound that greater li — etime GPS use was associated with worse spatial memory during sel — -guided navigation; the relationship was causal, not merely correlational.91 Subjects who increased their GPS use between measurement points showed corresponding declines in their ability to construct cognitive maps o —

amiliar environments. The dose-response relationship was clear: the more GPS was used, the worse the navigation without it. GPS users noticed — ewer environmental landmarks, encoded — ewer o — them in memory, and produced less accurate representations o — spaces they had traveled through repeatedly. The device replaced the spatial reasoning that would have developed through unassisted navigation. Without practice, capacity deteriorated. Without capacity, the device became more necessary. The loop ran. The pattern extends to judicial sentencing. The COMPAS recidivism algorithm, used by courts in multiple states to in — orm parole and sentencing decisions, assigns de — endants a numerical risk score based on demographic and criminal history data.92 Whether the algorithm is “ — air” generated one o — the more technically sophisticated legal-empirical debates o — the past decade. ProPublica Chapter 4: Prudence as Transaction Cost 71

ound that the algorithm incorrectly — lagged Black de — endants as high-risk at roughly twice the rate o — white de — endants; the algorithm’s de — enders correctly noted that — alse positive rates were equivalent across races when — airness was de — ined di —

erently. The technical disagreement was real. The mathematically incompatible de — initions o —

airness at stake cannot simultaneously be satis — ied when base rates di —

er across demographic groups. The “ — air” algorithm has encoded a choice about which injustice to accept. Neither side o — the — airness debate addressed prominently what happens to judges who regularly use COMPAS. A judge who consults a numerical risk score be — ore sentencing (even to “in — orm” rather than determine the sentence) per — orms a di —

erent cognitive task than a judge who reaches the same conclusion through deliberation. The score anchors. Research on anchoring e —

ects in judicial sentencing demonstrates that numerical inputs systematically shi — t sentencing outcomes toward the anchor even when judges explicitly try to reason independently — rom it.93 Over time, the judge who regularly de — ers to a risk score develops less o —

the sentencing judgment the score was introduced to supplement. The algorithm occupies the cognitive space that deliberation would have occupied. The space — or independent judgment contracts. The algorithm becomes more necessary precisely because it has been most used. Shannon Vallor names what is being lost across all these cases: the “moral muscle,” developed through the exercise o — judgment under conditions o — genuine uncertainty, that constitutes practical competence.94 The argument — ollows directly — rom Aristotle’s account o — virtue as hexis—a stable disposition — ormed through habituation. Physical strength develops through resistance and atrophies without it. Moral and practical judgment develops 72 Judgment Proo —

through the exercise o

judgment in di —

icult situations and atrophies when automation supplies the output in its place. The loan o —

icer who de — ers to a credit score, the judge who de — ers to a risk algorithm, the principal who de — ers to a zero-tolerance policy— each is spared the struggle o — deliberation. Each is, over time, less capable o — the deliberation they have been spared. Nicholas Carr, in The Glass Cage, documents the sensory and phenomenological dimension o — this atrophy.95 Automation changes the relationship between a human being and the domain being navigated. The pilot who — lies manually inhabits the aircra — t di —

erently than the pilot who monitors automation. The navigator who reads terrain inhabits space di —

erently than the navigator who

ollows turn-by-turn instructions. The intimacy o — genuine engagement—the dwelling in a domain that develops through the

riction o — operating within it—requires something to push against. The — rictionless inter — ace produces an observer rather than an actor, a monitor rather than a practitioner, someone whose contact with the domain is mediated rather than direct. Evan Selinger and Brett Frischmann extend this analysis to the design principle underlying most contemporary automation: the ideal o —

rictionlessness.96 Silicon Valley’s animating aspiration—the seamless inter — ace, the — rictionless transaction, the decision without doubt—treats — riction as the enemy o — value. Selinger and Frischmann argue the reverse: — riction is where agency lives. The “micro-struggles” o — deliberation, the discom — ort o — genuine choice, the cognitive labor o — contextual judgment are not ine —

iciencies to be engineered away. They are the gymnasium o — practical wisdom. Remove them, and you produce a more manageable human, not a more capable one. Chapter 4: Prudence as Transaction Cost 73

Judgment-Proo

Humans The Deskilling Loop’s endpoint is not a lazy person who has outsourced inconvenient thinking. It produces something structurally di —

erent: a person who has had no occasion to develop the capacity the compliance structure was built to replace. The distinction matters. The pilot who trained be — ore heavy automation and then lost manual — lying skills through disuse is di —

erent — rom the pilot trained entirely within a high-automation environment who never acquired those skills. Both will — ail under identical conditions. Only one experienced a loss. The other never had the capacity the situation demands. Until automation — ails, the pilot who has never — lown manually under pressure cannot be distinguished — rom the pilot who has

orgotten how. At that moment, the — irst pilot is revealed to have a structural gap where a capacity should be. The gap was produced by training within a system designed to make the development o — that capacity unnecessary. The compliance architecture in American schools per — ormed the same substitution at the same pro — essional in — lection point. Principals who entered the pro — ession a — ter zero-tolerance policies were installed learned to exercise their judgment in every domain except the hard disciplinary cases—the ambiguous objects, the contextual situations, the moments that require weighing a child’s actual intent against an abstract category. Those cases were removed

rom the domain o — pro — essional discretion be — ore the pro — essional could develop the relevant capacity. The policy removed them — rom the curriculum o — pro — essional development entirely. The principal has no occasion to exercise the judgment the policy replaces. When the policy produces an absurdity, the principal lacks the pro — essional vocabulary to recognize that — ollowing the policy was the error. 74 Judgment Proo —

Following the policy was the whole o

what they were trained to do. The policy is their judgment’s entire horizon. The disappearance o — the pro — essional is the complement o — the emergence o — the compliance o —

icer. As compliance architectures replaced the discretionary judgment o — pro — essionals, the locus o —

institutional knowledge migrated

rom the practitioner to the system. The physician who once exercised clinical discernment now exercises clinical documentation—recording the compliance o —

their decisions with applicable protocols, billing codes, and treatment guidelines. The lawyer who once exercised legal judgment now primarily exercises compliance management— reviewing risk exposure across a matrix o — regulatory requirements, documenting the client’s in — ormed consent to the risk that the lawyer has identi — ied and disclosed. The banker who once exercised credit judgment now exercises model documentation—recording the quantitative basis — or a lending decision and preserving the paper trail that will de — end the decision i — challenged. The pro — essionals have not disappeared — rom their o —

ices. They have been converted — rom agents who exercise practical wisdom into operators who document compliance. The knowledge that mattered — or the exercise o — discernment—the — eel o — a situation, the perception o — what a particular context required, the practical wisdom that could not be — ully articulated because it was constituted by the practice itsel — —is no longer the primary pro — essional output. The primary pro — essional output is the record that demonstrates adherence to applicable rules. This is the Judgment-Proo — Human: a person nested so thoroughly inside a compliance structure that the structure has pre- empted the development o — every capacity the structure was built to replace. The institution is protected — rom liability when the Chapter 4: Prudence as Transaction Cost 75

structure

ails. The individual is protected — rom the responsibility o —

judgment. Both

orms o — protection are real. Both are purchased at the same price: the deliberative capacity that could have prevented the — ailure in the — irst place. The individual pathology is tragic enough. The institutional consequence is more severe. The Judgment-Proo — Human occupying a pro — essional role cannot see the structure that produced them as a structure rather than as the nature o — pro — essional li — e. The principal who has never had to distinguish a camping utensil — rom a weapon does not experience the zero-tolerance policy as a limitation on judgment. The policy is the entirety o — their pro — essional horizon — or that class o — decision. When it produces Zachary Christie, the response is not “the policy prevented a judgment I should have made.” The response is “the policy made a decision I was not permitted to make.” The institution has eliminated the perspective — rom which its own — ailure would be visible.

An Elegant Mistake Chapter 3 traced the intellectual genealogy that produced the Hollow State: a governing order that acts to cultivate, educate, and

orm human beings but can only justi — y itsel — in the borrowed vocabulary o — harm prevention and e —

iciency. The Chicago School did not create that condition. It inherited it and gave it better instruments. The instruments were elegant. Posner’s — ramework brought analytical rigor to legal reasoning that had o — ten proceeded through unstated assumptions and conclusory moral assertions. Cost-bene — it analysis exposed rules that claimed to protect consumers while 76 Judgment Proo —

actually protecting incumbent businesses. The behavioral economics that grew — rom the law-and-economics tradition produced the most sophisticated account o — human decision-making that legal scholarship has ever o —

ered. The intellectual program was ambitious, disciplined, and largely internally consistent. Its best practitioners were clear-eyed about its limitations. Its in — luence on institutional design — ell to practitioners less attentive to those limits. The error was taxonomic. Aristotle observed that each domain o — knowledge has its appropriate method, and that intellectual error o — ten consists o —

applying the method appropriate to one domain to problems belonging to another.97 The mathematical methods o — techne—the optimization o — speci — iable outputs — rom quanti — iable inputs—were applied to the domain o — phronesis: the cultivated capacity to perceive what a situation requires and to act accordingly. The outputs o —

practical wisdom can sometimes be measured. The cultivation o

practical wisdom cannot be optimized, because optimizing it— substituting the output — or the exercise—destroys the very thing being cultivated. A gymnasium does not build strength by li — ting the weights — or you. The Sa — ety Machine is what this error produces when it runs at institutional scale. Each individual design choice was de — ensible. Reducing variance in judicial sentencing reduces the risk that similarly situated de — endants receive wildly di —

erent sentences—a genuine injustice the guidelines addressed. Mandating cockpit automation reduces the risk o — the kind o — manual — lying error that caused most pre-automation aviation — atalities—a genuine improvement. Implementing zero-tolerance policies reduces the risk that a principal’s idiosyncratic judgment produces inconsistent discipline exposing the district to litigation—a genuine institutional Chapter 4: Prudence as Transaction Cost 77

bene

it within the — ramework that classi — ied the litigation risk as the primary harm to be addressed. The aggregate result o — individually de — ensible choices is an institutional environment in which practical wisdom has no occasion to develop, no space to operate, and no vocabulary in which its loss can be named. The Hollow State cannot explain why the principal should be permitted to see the camping utensil as what it is. The only vocabulary available is harm prevention, and in that vocabulary, the camping utensil is a kni — e-shaped object whose status cannot be assessed without a rule. The question o — what kind o — discernment the principal should be developing, and what institutional conditions would develop it, cannot be posed in the vocabulary o — harm prevention. It requires the vocabulary o — the Sca —

olding—the vocabulary abandoned — our centuries be — ore the

irst compliance o —

icer was hired. The Chicago School solved the problem it set out to solve. It identi — ied transaction costs and developed power — ul tools to minimize them. It identi — ied judgment itsel — as the transaction cost most available — or elimination. The math was right. The problem was wrong. Part Two examines what that solution built: the speci — ic mechanical architecture o — the Sa — ety Machine, how it sustains and extends itsel — through bureaucratic logic that operates independently o — any individual’s intentions, and what it produces when it encounters situations that require precisely the capacity it has systematically dismantled. The Boeing 737 MAX is the most precisely documented illustration o — a machine that worked exactly as designed and killed 346 people because the design had eliminated the judgment that might have noticed the design was wrong. Chapter 5: Harm-Prevention Architecture

In 1946, Congress built a brake into the administrative state. It took three decades — or the machine to — ind a way around it.

A Fierce Compromise In 1946, Congress struck what administrative law scholars call a “ — ierce compromise.” The Administrative Procedure Act established the terms under which — ederal agencies would exercise delegated power: agencies seeking to make binding rules must — irst publish proposed rules, accept written comments — rom interested parties, respond to signi — icant objections in writing, and submit the resulting rule to judicial review — or reasonableness. The process was slow and expensive. The — riction was the point. Democratic law is not — ast law. The APA’s rulemaking procedures were the machine’s constitutional covenant. The assurance was that administrative power, however vast, would remain accountable to something beyond the agency’s own judgment.98 The covenant held — or roughly three decades. Then the courts tried to strengthen it, and the machine — ound a door. Beginning in the late 1970s, the D.C. Circuit Court o — Appeals began applying with increasing rigor what it called the “Hard Look” 80 Judgment Proo —

doctrine. The doctrine required agencies to demonstrate that they had exhaustively considered every relevant — actor, responded substantively to every signi — icant comment, and examined every viable alternative to the rule they were proposing. Arbitrary or capricious rulemaking would be vacated. Hard Look review was judicial oversight doing exactly what it should.99 Faced with the prospect o — multi-year rulemaking e —

orts (agencies had watched colleagues spend a decade building a regulation, only to see a court vacate it — or a minor analytical de — iciency in the record), rational administrators began asking a question the APA had not anticipated: what i — we do not — ormally rule at all? That question’s answer is the subject o — this chapter.

Administrative Dark Matter The Administrative Procedure Act draws a categorical line between two kinds o — agency action. “Legislative rules”—binding pronouncements that create new rights and obligations—must go through notice and comment. “Interpretive rules” and “general statements o — policy”—documents that merely explain existing duties—are exempt — rom these requirements. The line was always somewhat porous in theory; in practice, it became the primary operating mechanism o — the modern administrative state. What scholar Clyde Wayne Crews terms “Regulatory Dark Matter” moved into the space below the line: agency memoranda, bulletins, circulars, guidance documents, blog posts, Dear Colleague letters, and press releases that carry the practical weight o — law without its democratic pedigree.100 These documents technically bind no one. They are, in the agency’s own characterization, merely Chapter 5: Harm-Prevention Architecture 81

clari

ications. They o —

er help — ul explanations o — what the statute already requires. The regulated party remains — ree to ignore them. Free, that is, in the same way a person is — ree to ignore a creditor who holds a lien on everything they own. The mechanics worked as — ollows. In 2011, the Department o —

Education’s O

ice — or Civil Rights issued a nineteen-page letter addressed to all recipients o —

ederal education — unding.101 The letter concerned sexual violence on campus. The statutory authority was Title IX o — the Education Amendments o — 1972—thirty-seven words long—prohibiting sex discrimination in education. The letter argued that a university’s — ailure to adequately investigate and adjudicate sexual violence constituted sex discrimination in violation o — the statute. Speci — ically, the letter required universities to use the preponderance o — the evidence standard in disciplinary proceedings (the lowest civil standard o — proo — ) and prohibited the clear and convincing standard that many institutions had been using. No vote in Congress. No notice-and-comment period. No judicial review o — the letter’s legal theory. The document was technically non-binding. Its coercive — orce came — rom a single sentence toward the end. An institution that — ailed to comply risked losing all — ederal — unding. For a modern university, — ederal — unding underwrites research,

inancial aid, — acilities, and graduate programs. The threat o — its loss is existential. Consequently, the Dear Colleague letter was not a suggestion. It was law: more comprehensive and more immediate in e —

ect than most congressional statutes, issued by a regional administrator with no democratic accountability, in a — orm that the courts struggled to review because it was technically not a — inal agency action. 82 Judgment Proo —

 Universities across the country re --- ormed their disciplinary processes within months. Legal scholars debated whether the letter’s requirements were constitutionally sound and whether the procedural model it mandated adequately protected the due process rights o ---  accused students. The letter has since been rescinded and partially reinstated in modi --- ied  --- orm.102 The mechanism is not in serious dispute: a document that the agency said was not law

unctioned as law more swi — tly and comprehensively than most laws do. This mechanism is neither aberrant nor exclusive to the Department o — Education. The Federal Trade Commission, operating without a comprehensive — ederal data privacy statute, built what two Columbia Law School scholars have called “the new common law o — privacy” entirely through en — orcement actions and consent decrees.103 When the FTC settled data security cases against Wyndham Worldwide and LabMD, the settlement terms—the speci — ic technical requirements, the audit obligations, the duration o — oversight—became the de — acto industry standard. Privacy lawyers and chie — in — ormation security o —

icers analyzed the decrees the way common law lawyers analyze precedent, because they were precedent. Never subjected to adversarial testing, the FTC’s theory o — liability in these cases—that inadequate data security constituted an “un — air practice” under Section 5 o — the FTC Act—was almost never tested in court. The cases settled because de — endants could not a —

ord to lose, and the FTC’s legal theory was never obliged to survive judicial scrutiny.104 In LabMD v. FTC, the commission argued that a company had constructive notice o — its data security obligations not — rom any published regulation but — rom “a tapestry o — settlements, speeches, Chapter 5: Harm-Prevention Architecture 83

and guidance documents.”105 The law was not written. It was embedded in agency action.

Hidden Regime The Dear Colleague letter and the FTC consent decree share a structural — eature: they require compliance — rom private actors who are not technically bound by them. The compliance is achieved through private intermediaries who do the agency’s en — orcement work outside any administrative law — ramework. This is compliance isomorphism. It is the machine’s most elegant mechanism. When a cyber-insurance carrier requires a corporate policyholder to implement multi- — actor authentication as a condition o — coverage, the carrier is acting as a private market participant, exercising no — ormal government authority. But the standard it is en — orcing derives — rom the FTC’s settlement terms, which derive — rom the FTC’s interpretation o — Section 5, which has never been subjected to notice-and-comment rulemaking or comprehensive judicial review. The insurer en — orces the standard through premium di —

erentials and policy exclusions. A company that does not comply does not receive a citation; it pays more — or coverage, or cannot obtain it. Consequently, a comprehensive regulatory regime emerges, en — orced through market mechanisms, invisible to administrative law because no government actor is directly imposing the requirements.106 The “Hidden Regime,” as the research literature calls it, is not less e —

ective than — ormal regulation. In many respects it is more e —

ective. Market en — orcement is continuous and the consequences o — noncompliance are immediate rather than delayed by litigation. 84 Judgment Proo —

 Beyond insurance, the shadow regulatory state extends widely. Credit rating agencies en --- orce Basel-adjacent capital standards. University accrediting bodies en --- orce Department o ---  Education guidance on disability accommodation and Title IX adjudication. Accounting  --- irms en --- orce SEC interpretive guidance on revenue recognition. The entities that actually govern day-to-day institutional behavior are private intermediaries—not the agencies that appear in the Federal Register—whose decisions are reviewed, i ---  at all, by contract rather than administrative law.
 The regulated entity  --- aces a genuine navigational problem. Formal law—the statutes and regulations published in the United States Code and the Code o ---  Federal Regulations—constitutes one layer o ---  obligation. Binding agency rules constitute a second layer. Guidance documents constitute a third layer. Settlement-derived industry standards constitute a  --- ourth. Insurance and accreditation requirements constitute a  --- i --- th. At any given moment, the binding legal obligations o ---  a mid-sized  --- inancial institution, hospital, or university may be distributed across all  --- ive layers, partially inconsistent, and changing at di ---

erent rates. No single document describes them. The compliance o —

icer exists to maintain the map.107

Kludgeocracy Steven Teles introduced “kludgeocracy” in a 2013 essay that stands as one o — the more precise diagnoses o — the American regulatory condition.108 A kludge, in engineering, is a rough-and-ready solution to an immediate problem. It is a patch applied without addressing the underlying architecture. The American legislative process is structurally biased toward kludge. Every veto point in the Chapter 5: Harm-Prevention Architecture 85

constitutional system (the committee chairman, the Senate

ilibuster, the con — erence committee, the president’s veto pen)

unctions as a toll booth. Paying the toll requires o —

ering complexity: a carve-out — or this constituency, a waiver — or that state, an exemption — or the industry whose lobbyist secured the last amendment. The resulting statute is not designed. It is accumulated. It does not solve the underlying problem. It patches around every objection until passage becomes mathematically possible. Running to 906 pages, the A —

ordable Care Act exempli — ies the pattern. The Dodd-Frank Wall Street Re — orm and Consumer Protection Act ran to 849 pages. These documents are long because every page represents a negotiation, a compromise, a carve-out that purchased a vote—not because the problems they address required that length, though the problems are complex. When the agencies responsible — or implementing these statutes write the rules that give them e —

ect, Dodd-Frank alone required hundreds o — implementing rules. The Code o — Federal Regulations as o — 2023 contained over 185,000 pages o — binding text.109 The Mercatus Center’s RegData project attempted to quanti — y this complexity using methods borrowed — rom in — ormation theory.110 The research team applied Shannon entropy (a measure o —

in

ormational unpredictability and cognitive load) to state regulatory codes and — ound that many o — them are more cognitively di —

icult to process than the plays o — Shakespeare. The regulatory code o — Illinois, Minnesota, and Cali — ornia scored above 9.5 on the Shannon entropy scale; Shakespeare’s works typically score between 9.0 and 9.5. The law that governs daily commercial and personal conduct in these states is, by in — ormation-theoretic measurement, harder to read than King Lear.111 Shannon entropy measures the unpredictability o — each successive word in a text (the cognitive 86 Judgment Proo —

e

ort required to anticipate what comes next), and a regulatory code that scores higher than Shakespeare on this metric is not merely long but linguistically resistant to comprehension. This is not a criticism o — dra — tsmanship. The complexity is the content. A regulatory code that tried to be simpler would be a regulatory code that had — ailed to address all the edge cases, exceptions, and industry-speci — ic provisions that the political process required. The complexity is what was purchased, at considerable expense, during the legislative and rulemaking processes. It is the mature expression o — accumulated democratic compromise. This barrier to entry operates in two dimensions. The — irst is economic: compliance costs — all disproportionately on small — irms. The labor cost o — regulatory compliance per employee is substantially higher — or a ten-person company than — or a ten- thousand-person company because the — ixed costs o — compliance (maintaining the legal expertise, the documentation systems, the audit readiness) do not scale linearly with — irm size.112 The sophisticated incumbent builds the compliance apparatus once and amortizes it across a large revenue base. The new entrant builds it

rom scratch against a smaller one, or cannot build it at all. This is regulatory debt as a barrier to competition. The accumulated complexity protects those who have already paid the price o —

mastering it. The second dimension is cognitive and involves priesthood creation by the kludgeocracy. The compliance o —

icer, the specialized regulatory attorney, the credentialed auditor exist because the law has become unintelligible to non-initiates. This phenomenon is a structural — eature o — any system complex enough to require specialization. It represents a — ailure o — design, not o —

Chapter 5: Harm-Prevention Architecture 87

individual capability. The priest’s authority derives

rom the mystery, and there is nothing conspiratorial about this. Complexity generates its own advocates. The attorneys who have built their practices on the intricacies o — Dodd-Frank are not lobbying — or simpli — ication. Their human capital is the complexity. The accrediting bodies, the compliance consulting — irms, the regulatory a —

airs departments o — major hospitals constitute what is appropriately called the Kludge Industry. It is an economic sector whose product is — riction management, and whose continued existence depends on the — riction remaining unresolved.113

The Number OSHA Chose In 1980, the Supreme Court o — the United States imposed a constraint on the machine that, had it survived, might have

undamentally altered its subsequent trajectory. The case arose — rom an OSHA benzene standard. Benzene is a known human carcinogen. OSHA, invoking the Occupational Sa — ety and Health Act’s mandate to protect workers — rom “signi — icant risks o — material health impairment,” sought to reduce permissible airborne benzene exposure to the lowest technologically

easible level. One part per million was the target. The agency’s position was essentially precautionary: since some level o — benzene exposure causes some risk o — leukemia, and since there is no identi — ied threshold below which the risk becomes zero, the appropriate regulatory posture is to reduce exposure as — ar as technology permits. The plurality opinion, written by Justice Stevens, rejected this reasoning and articulated what became the Signi — icant Risk doctrine.114 Be — ore OSHA could regulate any substance, the Court 88 Judgment Proo —

held, the agency was required to make a threshold

inding that exposure to the substance at existing levels posed a signi — icant risk o —

material health impairment. The signi

icant risk — inding was not a numerical threshold (Justice Stevens explicitly declined to quanti — y it), but it was a substantive requirement. The agency had to do more than establish that some risk exists at some level. It had to establish that the risk was meaning — ul enough to justi — y regulatory intervention. To illustrate the principle, the Benzene plurality o —

ered a — igure: a one-in-one-thousand li — etime risk o — developing a serious condition would generally quali — y as signi — icant, whereas a one-in- one-billion risk would not. Regulators could not invoke the mere existence o — a risk to justi — y cost-regardless reduction. They had to quanti — y the risk, establish that it exceeded a threshold o —

materiality, and demonstrate that the proposed standard would meaning — ully reduce it.115 This principle served as the machine’s one internal governor, allowing expansion only under constraints. It could expand, but it had to show its work. It had to show that the harm it was addressing was real, measurable, and substantial enough to justi — y the cost o —

addressing it. The principle acknowledged what the Benzene dissent did not want to acknowledge: that not every risk is worth regulating, that regulatory resources are — inite, and that a rule requiring a cost-regardless response to any speculative harm was a rule without a limiting principle. The Signi — icant Risk doctrine survived. What dissolved around it was the evidentiary standard — or establishing signi — icance. Chapter 5: Harm-Prevention Architecture 89

Vorsorgeprinzip The Precautionary Principle entered American regulatory practice gradually rather than through any single decision or statute, shi — ting how agencies calculated the costs and bene — its o — regulatory intervention. The principle originated in German environmental law (the Vorsorgeprinzip, or — oresight principle) and was incorporated into international environmental instruments including the 1992 Rio Declaration.116 In its strong — orm, the principle holds that where an activity raises threats o — harm to human health or the environment, precautionary measures shall be taken even i — the causal relationships are not — ully established scienti — ically. The burden o —

proo

shi — ts: the proponent o — the activity must demonstrate sa — ety, rather than the regulator demonstrating harm. American organic statutes, written mostly in the 1970s, do not

ormally adopt the Precautionary Principle. They retain the older risk-management — ramework, requiring agencies to establish signi — icant risk be — ore regulating. But the principle dri — ted into practice through mechanisms that did not require statutory revision. The — irst mechanism, operating since the 1970s within EPA radiation and chemical risk assessment, was the Linear No- Threshold model, or LNT. The LNT model assumes that any exposure to a carcinogen, however small, carries some risk o — harm, and that risk scales linearly with dose. There is no threshold below which exposure becomes sa — e. I — the LNT assumption is accepted, then the Benzene signi — icant risk doctrine can be satis — ied through modeling rather than observation: construct a dose-response curve using LNT assumptions, and any level o — exposure will generate a calculable risk estimate that can be characterized as signi — icant. The 90 Judgment Proo —

Benzene constraint requires a signi

icant risk — inding. The LNT model generates a signi — icant risk — inding — or any exposure. The constraint is — ormally satis — ied while its substance is eliminated.117 The second mechanism was the expansion o — “unquanti — iable bene — its.” The 2023 update to O —

ice o — Management and Budget Circular A-4 (the — ederal government’s governing document — or regulatory cost-bene — it analysis) explicitly authorized “distributional weighting.” This means assigning greater value to bene — its accruing to underserved communities than to equivalent costs borne by others.118 This adjustment allows agencies to justi — y regulatory interventions whose costs exceed their quanti — iable bene — its by attributing su —

icient weight to bene — its that, by de — inition, cannot be quanti — ied and there — ore cannot be — alsi — ied. The mechanism is not irrational. It re — lects a genuine and de — ensible judgment that cost-bene — it analysis systematically undervalues harms to people with lower incomes. Yet it also removes a constraint: a cost-bene — it requirement allowing costs to be outweighed by non- — alsi — iable distributional bene — its is one that can always be satis — ied. The third mechanism was concept creep, documented by psychologist Nick Haslam. Examining the evolution o — clinical and legal concepts o — harm over several decades, Haslam identi — ied what he termed “concept creep”: the expansion o — psychological and social science concepts (“trauma,” “violence,” “harm,” “sa — ety”) — rom narrower, more precise de — initions toward broader, more inclusive ones.119 A concept that began anchored to a speci — ic empirical phenomenon gradually extended to cover related but distinct phenomena, then to cover analogous phenomena in adjacent domains, then to become a — ramework applied to experiences that bore only metaphorical resemblance to the original re — erent. Chapter 5: Harm-Prevention Architecture 91

In regulatory domains, “harm” (the jurisdictional trigger  --- or nearly every health, sa --- ety, and civil rights regulation) quietly expanded its coverage. Physical injury was always harm. Physical injury plus psychological sequelae was harm. Psychological injury without physical contact was harm. Dignitary harm (the experience o ---  being treated in a manner inconsistent with one’s dignity) became harm. Psychological unsa --- ety (the subjective experience o ---  an environment as threatening, regardless o ---  objective threat) became harm. By 2020, OSHA had begun issuing guidance on “psychosocial hazards” (workplace  --- actors such as stress, incivility, and the absence o ---  “psychological sa --- ety”) as occupational health concerns within its regulatory jurisdiction.120
Each expansion was individually de --- ensible and justi --- ied on its merits. Psychological injury is real injury. Dignitary harm is real harm. Workplaces that systematically degrade employees produce measurable health consequences. But the expansion had a structural e ---

ect that exceeded the sum o — its individual steps. It progressively eliminated the conceptual boundary between the machine’s jurisdiction and the totality o — human experience. I — psychological sa — ety is a regulatory obligation, and i — the de — inition o —

psychological sa

ety is determined by the subjective experience o —

the individuals the regulation protects, then the machine’s jurisdiction is coextensive with every interpersonal interaction that occurs within an institution subject to its authority. Absent — rom the concept itsel — is any limiting principle.

Haddaway’s Administration Each individual component o — the machine’s expansion had de — ensible origins. The Dear Colleague letters were written by 92 Judgment Proo —

people concerned about campus sexual violence. The FTC’s data security en — orcement was pursued by lawyers who believed, correctly, that inadequate corporate data security imposes real costs on real people. The LNT model is used by toxicologists who believe, with some scienti — ic support, that it represents the most cautious available assumption in the — ace o — genuine uncertainty. The concept creep o — harm was driven by researchers and advocates who were observing real su —

ering that older — rameworks had inadequately recognized. The machine grew because it must. Not because anyone commanded it to grow, but because the structural — eatures o — the system reward expansion and cannot generate sel — -limitation. From inside the agency, the logic emerges clearly. An agency

acing a problem has two tools: — ormal rulemaking and in — ormal guidance. Formal rulemaking takes years and may be vacated by a court — or an analytical de — iciency in a record that took years to build. In — ormal guidance can be issued in weeks and achieves immediate compliance through the coercive background o — the agency’s en — orcement authority. The rational administrator, evaluated on the number and speed o — policy outcomes, uses the in — ormal tool. The democratic constraint was real. The constraint on the constraint was equally real. The in — ormal tool expanded to — ill the space the

ormal tool vacated. Consider the logic o — expansion. An agency whose regulatory domain is well-de — ined — aces budget constraints when it seeks new authority. It must demonstrate to Congress and the O —

ice o —

Management and Budget that the new authority is necessary and the costs are justi — ied. An agency whose regulatory domain is de — ined by a concept that can expand (harm, sa — ety, un — air practice) — aces no comparable constraint. Each new application o — the expandable Chapter 5: Harm-Prevention Architecture 93

concept generates its own justi

ication. The agency is not expanding its authority. It is clari — ying what its existing authority already covers. The budget request is not — or new jurisdiction. It is — or resources to discharge existing obligations. Consider the logic o —

ailure. When a regulated activity produces a harm — ul outcome that the regulation was supposed to prevent, two responses are institutionally available. The — irst is to acknowledge that the regulation — ailed, examine why, and consider whether alternative approaches might per — orm better. The second is to identi — y the gap in the regulation’s coverage that allowed the harm to occur and propose additional rules to close the gap. The — irst response requires acknowledging institutional — ailure, which is institutionally costly. The second response converts institutional

ailure into institutional justi — ication. The machine cannot — ail; it can only be under — unded and underauthorized. Built on the Foundation — unction o — law and organized around the elimination o — harm, the Sa — ety Machine (the administrative apparatus operating through the mechanisms described in this chapter) is the logical output o — a system that has every incentive to expand and no mechanism — or sel — -limitation. The Benzene signi — icant risk doctrine was the closest the system came to building such a mechanism into its own operating logic. Its e —

ective neutralization by the tools described above is there — ore not incidental. A system with no internal limiting principle will, over time, dissolve any limiting principle that is introduced into it. It does not happen through deliberate sabotage but through the accumulated weight o — individually rational responses to individually reasonable institutional incentives. At the institutional scale, this is what the Paradox o — Expansion, described in Chapter 4, looks like. Each rule eliminated some human 94 Judgment Proo —

discretion. Each elimination produced a gap that required more rules. Each layer o — rules produced more complexity. The complexity produced more demand — or specialized compliance in — rastructure. The compliance in — rastructure produced more institutional actors whose interests were served by the complexity’s maintenance and growth. The machine is doing exactly what a system without a limiting principle does. This is Haddaway’s Law made administrative. The institutional imperative to prevent hurt has — ound its permanent operating system. Part Two asks a prior question. Be — ore examining the machine in speci — ic domains (Boeing’s certi — ication apparatus, the — inancial compliance regime), it asks whether the machine’s governing ambition is coherent: whether the knowledge the Sa — ety Machine requires to do what it claims to do can, even in principle, be obtained. The answer depends on two epistemic constraints the preceding chapters have only implied. Rather than sa — ety, the machine produces the documentation o —

sa

ety. These are di —

erent products, and the di —

erence matters. The compliance o —

icer who — ills out the incident report, the administrator who circulates the policy that no one reads, and the board that adopts the risk — ramework calibrated to last year’s data each serve this — unction. The documentation is necessary. Without it, the institution is exposed to liability, to regulatory sanction, to the kind o — public — ailure that ends careers. The documentation is valuable on its own terms. But documentation o — sa — ety and sa — ety are related by correlation, not identity. The correlation is considerably weaker than most institutional actors would acknowledge. Chapter 5: Harm-Prevention Architecture 95

 What the Turkey knows, on the morning be --- ore Thanksgiving, is that the documentation is per --- ect. The record is clean. The models are current. The compliance committee has met. The policy manual was revised six months ago. Uni --- ormly  --- avorable, every metric the machine uses to measure its own per --- ormance signals success.
 The machine is sa --- est on the day be --- ore it  --- ails.

Chapter 6: Wisdom o — Not Knowing

Preceding chapters asked whether the Sa

ety Machine works. This chapter asks whether it could ever work — whether the ambition is coherent.

Nine Days On December 8, 1903, Samuel Pierpont Langley watched his Aerodrome plunge into the Potomac River — or the second time. He was the Secretary o — the Smithsonian Institution, a pro — essor o —

astronomy, the

ormer director o — the Allegheny Observatory, the recipient o — $50,000 in War Department appropriations (more than a million dollars in current value), and the most credentialed authority on the problem o — heavier-than-air — light in the United States. His calculations were meticulous. His laboratory was well- equipped. His institutional backing was secure. He had already achieved a success — ul unmanned — light in 1896 and believed that a manned version o — the same design would — ollow directly. The Aerodrome entered the Potomac at an angle that made the — ailure unmistakable. Langley’s biographers record that he never attempted another — light.121 Nine days later, Orville and Wilbur Wright — lew at Kitty Hawk. 98 Judgment Proo —

The Wright brothers had no advanced degrees, no government

unding, no laboratory, and no institutional sponsor. Their pro — essional background was bicycles. They had corresponded with Langley’s colleague, Octave Chanute, but their primary method was systematic iteration: build, test, — ail, adjust, repeat. They were willing to try con — igurations that the credentialed experts believed would not work, because the credentialed experts were working

rom theory and the Wright brothers were working — rom — riction. Their knowledge was acquired through repeated physical con — rontation with the actual behavior o — actual aircra — t in actual air (knowledge that could not be derived — rom Langley’s calculations and could not be transmitted to Langley through any document Langley would have had reason to credit).122 Here is the question this juxtaposition raises, and it is not a hypothetical: i — there had been a Federal Aviation Administration in 1903, what rules would it have written? You already know the answer. It would have written rules based on the best available knowledge (which, in 1903, was Langley’s knowledge). It would have consulted the leading aeronautical scientists. It would have required aspiring aviators to demonstrate that their designs met per — ormance standards established by credentialed experts. It would have prohibited con — igurations that the scienti — ic community deemed structurally unsound. It would have issued guidance speci — ying that aircra — t — or manned — light must meet the criteria established by the Langley and Chanute research programs (the criteria that the Wright brothers’ design violated in multiple respects). And we would have lost the airplane. Modern aviation is extraordinarily sa — e, and much o — that sa — ety is attributable to regulatory standards that have driven out Chapter 6: Wisdom o — Not Knowing 99

dangerous practices and established engineering disciplines that have collectively saved tens o — thousands o — lives over a century.123 The observation here is di —

erent and more — undamental: regulatory systems built on the best available knowledge systematically

oreclose the discoveries that cannot be predicted by the best available knowledge, because those discoveries are precisely the ones that contradict what the best available knowledge says is possible. The structural problem is what happens when law meets genuine uncertainty: not ordinary uncertainty (where you know the categories o — outcome and must estimate which will occur), but the deeper uncertainty that Frank Knight identi — ied. This is the uncertainty in which the relevant categories do not yet exist, in which no probability distribution is available because the situation is novel.124 The Sa — ety Machine’s institutional architecture was documented in the preceding chapter. The question this chapter asks is whether its ambitions are coherent (whether, even in principle, regulation calibrated to prevent known harms can claim to produce good outcomes in a world where the most consequential goods are not yet known). The ancient tradition this book has been recovering understood why not and built its jurisprudence on that constraint.

Distinction That Mattered Frank Knight published Risk, Uncertainty, and Pro — it in 1921 (the same year commercial radio began broadcasting in the United States, a technology that Knight’s — ramework, applied by regulators, could easily have suppressed be — ore it existed). Knight distinguishes two conditions that are routinely con — used.125 100 Judgment Proo —

Risk is the condition in which the  --- uture is unknown but the space o ---  possible  --- utures is known and its probabilities are estimable. The actuary calculating automobile insurance rates  --- aces risk. Individual accidents are unpredictable; aggregate accident rates are stable enough, across a large port --- olio, to price reliably. The casino operator  --- aces risk: no individual bet outcome is certain, but the house’s long-run margin is calculable  --- rom the rules o ---  the games and the laws o ---  probability. In the domain o ---  risk, mathematical tools are appropriate and o --- ten power --- ul. Probability, expectation, variance (these are the right instruments) because the underlying structure o ---  outcomes is stable enough to support statistical in --- erence.
Uncertainty is the condition in which this structure is absent. Knight used a speci --- ic technical sense: genuine uncertainty exists when outcomes involve “unique” situations (situations so novel that no  --- requency distribution over past occurrences o ---

ers reliable guidance about — uture probabilities). The entrepreneur deciding whether to build a — actory — or a product that does not yet exist — aces uncertainty. The physician prescribing a treatment whose long- term interactions with a particular patient’s speci — ic genetic pro — ile are unstudied — aces uncertainty. The regulator designing oversight

or a technology she does not yet understand — aces uncertainty. In each case, the question “what is the probability o — harm?” cannot be answered rigorously because the probability space has not been determined by experience (it is in the process o — being constituted by the decisions being made).126 Knight’s distinction had direct implications — or the theory o —

pro

it. In a market o — pure risk, competition eliminates excess returns: calculable advantages are replicable, and replication drives prices toward equilibrium. Sustained entrepreneurial pro — it Chapter 6: Wisdom o — Not Knowing 101

there

ore requires something that cannot be calculated and copied: the judgment to act under genuine uncertainty in ways that turn out to be correct. Pro — it is the reward — or success — ul decision-making under conditions where no algorithm could have predicted success.127 Knight understood something that economists have been slow to extend to law: the instruments appropriate to the domain o — risk

ail systematically in the domain o — uncertainty. Applying probability tools to situations o — genuine uncertainty does not produce imprecise answers. It produces answers that are structurally misleading (answers that have the — orm o — probability estimates but are not grounded in the — requency distributions that make such estimates valid). A risk model applied to a novel situation is not a rough approximation. It is a category error wearing the costume o —

rigor. Much o — what the administrative state governs sits closer to Knight’s uncertainty than to his risk. New technologies, new industries, new business models, new chemicals, new pharmaceuticals, new — inancial instruments (each involves combinations o —

actors — or which historical — requency data is sparse, the range o — relevant interactions is poorly understood, and the long-term consequences cannot be derived — rom available evidence with any de — ensible con — idence). The regulatory response to this epistemic situation has been to treat uncertainty as risk (to demand probability estimates, to conduct cost-bene — it analyses that assign expected values to outcomes that are not amenable to probabilistic treatment, and to apply precautionary standards calibrated to preventing the harms that current knowledge identi — ies as possible). The result is not sophisticated risk management. It is the systematic suppression o — possibilities that current knowledge 102 Judgment Proo —

cannot assess (which is to say, the suppression o

the discoveries that would have extended what current knowledge can assess). Langley’s regulatory successors would have been optimizing — or the known category o — outcomes and would have eliminated the unanticipated category in which the Wright brothers were working.

Negative Theology Eight centuries be — ore Knight, Maimonides had identi — ied the same problem in a di —

erent domain. Writing his Moreh Nevukhim (the Guide — or the Perplexed) in Cairo in the 1190s, Maimonides was not addressing aviation regulation or pharmaceutical approval. He was addressing the most di —

icult epistemological problem in medieval theology: what can human beings reliably know about God?128 His answer was radical in its — orm and has direct structural relevance to the argument o — this chapter. We can know what God is not more reliably than what God is. We can say that God is not corporeal, not ignorant, not limited in power (and these negations are de — ensible because they rest on what we know about the conditions under which corporeality, ignorance, and limitation arise, conditions that our theological commitments require us to exclude — rom the divine). Positive characterizations o — the divine essence (claims about what God is) exceed human epistemic capacity, because our concepts derive — rom creaturely experience and cannot be extended to characterize the uncreated without systematic distortion. This is the doctrine o — negative theology, via negativa. In Maimonides’s — ormulation it is not a counsel o — despair but a precise mapping o — the boundary between what we can and cannot reliably know.129 Chapter 6: Wisdom o — Not Knowing 103

The structural parallel to regulatory epistemology is not accidental. Negative knowledge (knowledge o ---  what not to do, what to prohibit, what constitutes clear harm) is more accessible than positive knowledge o ---  what will produce good outcomes in situations that have not yet occurred. We can identi --- y  --- raud with some con --- idence because  --- raud involves deliberate deception about existing  --- acts ( --- acts we can assess). We can identi --- y certain toxicological hazards with some con --- idence because laboratory evidence o ---  mechanism is available and the causal pathway  --- rom exposure to harm is established. We can prohibit these things on the basis o ---  knowledge we actually possess.
We cannot speci --- y in advance with con --- idence what the bene --- icial innovations o ---  the next decade will look like, which experiments should be tried, which risk-tolerant commitments will turn out to have been wise, which apparently dangerous departures

rom current practice will prove to be the discoveries that advance human wel — are. This positive knowledge is unavailable to regulators

or the same reason that positive theology exceeded medieval human capacity: the relevant domain o — inquiry has not yet been constituted by experience, and the concepts available to us derive

rom a world that is categorically di —

erent — rom the one we are trying to characterize. Law must be built, according to Maimonides, on what human beings can reliably know, and must respect the limits o — that knowledge rather than pretending to transcend them. The legal system he designed was built around the logic o — tikkun ha-gu — (the establishment o — the conditions under which harm is prevented and order maintained) precisely because tikkun ha-gu — rests on negative knowledge (the identi — ication o — clear harms) rather than on positive knowledge o — what human — lourishing requires in its — ull 104 Judgment Proo —

complexity. The sca

olding — unction o — law (the cultivation o —

wisdom toward positive goods) he understood as dependent on practices that law can encourage but not speci — y, because the positive content o — wisdom cannot be — ully articulated in advance.130 The regulatory state has inverted this structure. It has taken the positive ambition (the speci — ication o — what bene — icial outcomes look like) and attempted to institutionalize it through the precautionary principle: the rule that action should be prohibited until its sa — ety and bene — it have been demonstrated. The precautionary principle is negative theology’s inverse, and like negative theology inverted, it is sel — -de — eating.

Thalidomide No account o — pharmaceutical regulation can proceed without acknowledging thalidomide. In the late 1950s and early 1960s, thalidomide was widely prescribed in Europe as a sedative and anti-nausea treatment — or pregnant women. It was e —

ective at what it did, and its short-term sa — ety pro — ile was reassuring. What manu — acturers and prescribers did not know (could not have known — rom the available evidence) was that it was a potent teratogen: a substance that disrupts — etal development in ways that, in retrospect, the pharmacological literature could not have predicted — rom the compound’s molecular structure and its observed interactions in adults. Approximately 10,000 children were born with severe limb mal — ormations be — ore the connection was recognized and the drug withdrawn.131 The United States largely avoided this catastrophe not through sophisticated regulatory analysis but through the institutional

ortitude o — a single FDA medical o —

icer, Frances Kelsey, who Chapter 6: Wisdom o — Not Knowing 105

declined to approve thalidomide’s American distribution because she — ound the sponsor’s evidence o — sa — ety insu —

icient (speci — ically, her concern about a potential link to peripheral neuritis that the evidence did not rule out).132 Kelsey’s caution was not a probability estimate. It was a judgment that the evidence was inadequate, a negative knowledge claim: we do not know enough to approve this. She was vindicated in a way that could not have been predicted. The vindication settled into institutional memory as the story the system tells about itsel — . The story is true. It is also partial. Kelsey’s caution was wise because the drug was dangerous. The institutional system has no mechanism — or distinguishing that caution — rom the caution applied by the next o —

icial (applied to a drug that works, by an equally well-intentioned reviewer, equally unaware that the invisible graveyard is — illing behind her). The system remembers thalidomide. It does not count its delayed approvals. The asymmetry is not incidental. It is the mechanism. The thalidomide catastrophe established a vivid and lasting lesson in the political and public consciousness: the approval o — an inadequately tested drug can produce catastrophic and irreversible harm. The lesson is true. It was encoded into the 1962 Ke — auver- Harris Amendments to the Food, Drug, and Cosmetic Act, which

or the — irst time required manu — acturers to demonstrate not merely the sa — ety but the e —

icacy o — new drugs be — ore approval (and gave the FDA broad discretion to de — ine what demonstration was su —

icient).133 Thalidomide proved one proposition and has been taken to establish a broader one. The drug proved that an inadequately tested compound can cause catastrophic harm. A lesson was encoded in law. The broader in — erence, that cautious pre-market approval requirements consistently produce better health outcomes than 106 Judgment Proo —

aster approval processes, does not — ollow — rom that proo — . Delayed approvals impose costs as real as the harms they prevent, — alling on the people who needed the withheld drug during the years it was absent — rom pharmacies. The drugs that are delayed are not the drugs that are approved; they are drugs that might have been approved and were not. Their victims are not visible in the way that thalidomide’s victims were visible. They die — rom diseases that existing approved treatments — ailed to control, and their deaths are recorded as disease — atalities rather than as regulatory consequences.

Invisible Graveyard The economists who have studied FDA approval times and their consequences have given the phenomenon a name: the invisible graveyard. The most extensively documented deaths in the invisible graveyard are — rom heart attacks during the years when beta- adrenergic blocking agents (beta-blockers) were available in Europe but not yet approved in the United States. Beta-blockers reduce post-in — arction mortality substantially; their e —

icacy was established in European clinical trials by the mid-1970s. FDA approval o —

propranolol

or post-in — arction use did not — ollow until 1978. Academic analyses o — the approval delay estimated that the lag cost between 10,000 and 30,000 American lives that might have been saved had the drug been available earlier.134 The estimates are contested; all estimates o — counter — actual mortality are methodologically uncertain. But “contested” and “zero” are not the same. The invisible graveyard has occupants whose number is disputed, not occupants who do not exist. Chapter 6: Wisdom o — Not Knowing 107

 Misoprostol, a prostaglandin analogue that reduces the risk o ---

gastric ulceration in patients taking nonsteroidal anti-in

lammatory drugs, was approved in several European countries in the early 1980s. FDA approval in the United States did not come until 1988. Patients taking NSAIDs in the interim had no access to the prophylaxis that would have prevented a portion o — the serious gastrointestinal complications (including deaths) that NSAID therapy produces in a predictable proportion o — long-term users.135 Misoprostol is a drug that reduces a known and quanti — iable risk; its delay did not cost lives hypothetically but statistically, in the sense that the expected value o — gastrointestinal morbidity averted by earlier approval was calculable — rom the NSAID prescribing rates and the known incidence o — serious complications. Interleukin-2, approved in Europe — or metastatic renal cell carcinoma in the early 1990s, was not approved in the United States until 1992, a — ter a lengthy and contentious review process. The disease is aggressive; — ive-year survival rates without e —

ective treatment are low. Patients who could access interleukin-2 therapy through European clinical trials had access to a treatment that produced durable complete responses in a meaning — ul minority. American patients without the resources to participate in overseas trials did not.136 The structural imbalance is built into the regulatory incentive system. When an FDA o —

icial approves a drug that subsequently causes harm, that o —

icial — aces the wrath o — the press, Congress, and plainti —

attorneys. The approval is documented, the harm is traced to the approval, and the decision-maker is identi — iable and accountable. But the FDA o —

icial who declines to approve a drug that subsequently proves bene — icial has prevented a visible harm and imposed an invisible cost. No plainti —

sues — or not having had access 108 Judgment Proo —

to a drug that was not approved. No congressional hearing scrutinizes the o —

icial who was too slow to approve a li — e-saving treatment. No journalist writes the story o — the drug that could have been. This asymmetry was identi — ied by Sam Peltzman in his landmark 1973 analysis o — the 1962 Ke — auver-Harris Amendments.137 Peltzman compared drug introduction rates be — ore and a — ter the 1962 amendments and — ound that the amendments had substantially reduced new drug introductions and had not produced commensurate improvements in the quality o — approved drugs. His conclusion was that the amendments, on net, had delayed bene — icial treatments by more than they had prevented harm — ul ones. The analysis has been contested, re — ined, and partially superseded by later work on drug sa — ety, but the underlying structural observation has survived: a regulatory system that makes visible harms pain — ul and invisible costs costless will systematically err in the direction o —

excessive caution. The invisible graveyard has real occupants (the predictable consequence o — applying the precautionary principle in a domain o —

genuine uncertainty where the costs o

caution are borne by identi — iable people and distributed over time in ways that make attribution politically impossible).

Precaution’s Price The precautionary principle, in its standard — ormulations, holds that when there is uncertainty about whether a course o — action will cause harm, the burden o — proo —

alls on those who wish to act, not on those who wish to prevent action.138 Where serious or irreversible harm is possible, lack o — scienti — ic certainty is not a Chapter 6: Wisdom o — Not Knowing 109

su

icient reason — or postponing preventive measures. Act when uncertain; do not wait — or proo — . Cass Sunstein has made the de — initive case that this principle is internally incoherent (not merely impractical but logically sel — - de — eating).139 The argument is precise and has not been success — ully answered. For any proposed action about which there is uncertainty, there are potential harms associated with acting and potential harms associated with not acting. The precautionary principle addresses only the — irst set. It treats action as requiring justi — ication and inaction as the sa — e de — ault. But inaction is also an action, in any situation where something is happening in the absence o — the contemplated intervention, and the harms associated with inaction are also uncertain. Consider pharmaceutical approval. A drug whose sa — ety pro — ile is uncertain carries potential harm i — approved and potential bene — it i — approved. The precautionary principle, applied to approval, counsels delay: do not approve until uncertainty is reduced. But delay also carries potential harm (the harm to patients who might bene — it and cannot access the drug while it awaits approval) and potential bene — it (the harm prevented to patients who might be hurt). The precautionary principle is silent about the harm — rom delay. Applied consistently, it would counsel delay o — the decision to delay since the decision to delay is also an action with uncertain consequences. The principle dissolves into a regress. The precautionary principle, applied to regulatory decision- making, does not suspend action pending greater certainty. It directs attention to a speci — ic subset o — potential harms (those associated with approving, licensing, or permitting) and treats the mirror- image potential harms as background noise. This is a value judgment masquerading as a neutral principle. It systematically 110 Judgment Proo —

avors the interests o — people who might be harmed by action over the interests o — people who might be harmed by inaction. Thalidomide’s victims were the — irst group. The invisible graveyard’s occupants are the second. There is no epistemological basis — or this asymmetry. From the standpoint o — genuine uncertainty, the harms — rom acting and the harms — rom not acting are equally real as possibilities and equally di —

icult to quanti — y. The precautionary principle’s di —

erential treatment o — them re — lects not superior epistemic access to the domain o — risk but a prior political commitment (the commitment to treating visible, traceable harms as more important than invisible, di —

use ones).

Concept Creep The invisible graveyard has expanded beyond pharmaceuticals as the precautionary principle has migrated into regulatory domains where its application is less evidently de — ensible. Nick Haslam introduced the concept o — “concept creep” to describe the progressive expansion o — psychological harm concepts.140 The same dynamics operate in regulatory contexts. Once a category o — harm achieves regulatory salience, the institutional incentives — avor expansion rather than contraction. Agencies derive their budgets, sta —

ing, prestige, and career prospects — rom the scope o — harms they address. The agency that identi — ies a new regulatory concern receives a new mandate; the agency that completes its mandate dissolves. The expansion o — the precautionary principle — rom its origin in chemical and environmental regulation to occupational licensing, securities regulation, — inancial services, and communications has Chapter 6: Wisdom o — Not Knowing 111

replicated the invisible graveyard e

ect across multiple domains. Occupational licensing boards established to prevent identi — iable harms — rom unquali — ied practitioners have expanded to license practitioners in — ields where the harm — rom unlicensed practice is speculative and the harm — rom preventing entry is concrete: higher prices, reduced access, suppressed economic mobility — or entrants the licensing requirements exclude.141 The precautionary logic produces an invisible graveyard o — services not rendered, economic opportunities not realized, and social mobility not achieved. Consider one concrete case. As o — 2015, thirty-six states required cosmetologists to complete an average o — 1,284 hours o — training be — ore licensure (roughly eight months o —

ull-time instruction, more than the training required to become an emergency medical technician in most jurisdictions). A 2015 White House report, prepared under the Obama administration and drawing on research by Morris Kleiner and others, — ound that occupational licensing requirements reduced employment in licensed occupations by an estimated 2.85 million jobs nationally, with the costs — alling disproportionately on lower-income workers, immigrants, and people with criminal records who could not meet the entry requirements.142 The licensing boards justi — ied the requirements as consumer protection. Kleiner’s care — ul assessment — inds negligible evidence that consumers o — unlicensed cosmetology services — ace measurable health risks. The graveyard is populated by the aspiring practitioners who never entered the occupation, the consumers who paid higher prices, and the communities that went without services. None o — these harms appears in the licensing board’s annual report. The board measures violations prevented. It does not measure livelihoods — oreclosed. 112 Judgment Proo —

The analogy to the pharmaceutical graveyard is not per --- ect (the stakes are di ---

erent, and the degree o — uncertainty varies). But the structural dynamic is the same. Visible harm (the possibility that an unlicensed practitioner will cause identi — iable injury) generates political salience. By contrast, invisible harm (the services not provided, the entrants blocked, the consumers who paid more or did without) is di —

use, distributed, and traceable to no speci — ic regulatory decision. The board that prevents entry — aces no accountability — or the invisible harm. The board that — ails to prevent a licensing violation — aces accountability that is immediate and concrete.

Be

ore the Harm There is a way o — stating the epistemological problem at the core o —

this chapter that makes its legal-theoretical implications precise. Pre-market regulation (the requirement to demonstrate sa — ety, e —

icacy, or suitability be — ore action is permitted) is epistemically ex ante regulation. It requires an assessment o — what will happen be — ore it happens. Under conditions o — genuine Knightian uncertainty, this assessment cannot be grounded in the — requency data that would make it reliable. It is necessarily an assessment under genuine uncertainty (a judgment about a situation whose characteristics are not yet known). Post-market regulation (the imposition o — liability — or harm a — ter harm has been caused, or the monitoring and response to observed outcomes) is epistemically ex post. It requires an assessment o — what has happened a — ter it has happened. The epistemic situation is categorically better: the relevant — acts have been observed rather than predicted, and the assessment can draw Chapter 6: Wisdom o — Not Knowing 113

on actual outcomes rather than modeled ones. Post-market regulation can be wrong (the harm may be di —

icult to attribute, the liability rules may be poorly designed) but it is not wrong in the speci — ic way that ex ante regulation under genuine uncertainty is wrong. The legal-theoretical point is not that ex ante regulation should be abolished. Some hazards are catastrophic and irreversible in ways that justi — y accepting very large costs in — oregone activity to prevent them: nuclear weapons development, certain classes o — biological agents, pharmaceutical compounds with established catastrophic teratogenic pro — iles. For these, the asymmetry between harm and precaution is de — ensible on grounds that are independent o — the epistemic argument. The point is that ex ante regulation should not be the de — ault — or all novel activities in the name o — precaution, because the epistemic conditions that would justi — y it (a reliable estimate o — the probability and severity o — potential harms) are precisely the conditions that genuine uncertainty — orecloses. Where uncertainty is genuine, the costs o — ex ante prohibition are more reliably estimated than the bene — its: the — oregone activities are known in outline, the prevented harms are not. Ex post regulation, supplemented by targeted ex ante requirements — or catastrophic risks, is the epistemically appropriate de — ault under genuine uncertainty.143 The FDA’s evolution toward Accelerated Approval, Fast Track designation, and the Breakthrough Therapy pathway represents an institutional acknowledgment o — this logic, however incomplete.144 Each pathway involves trading some degree o — ex ante certainty — or earlier access, accepting that the remaining uncertainty will be resolved through post-market observation. The pathways are imper — ect and their implementation is contested. But they represent 114 Judgment Proo —

a movement toward the epistemically appropriate structure: calibrated ex ante requirements, with continued monitoring and accountability a — ter approval. They preserve the possibility o —

correction rather than demanding complete knowledge be

ore any action is permitted.

Humble Regulator The argument o — this chapter should not be read as a counsel o —

regulatory passivity. Langley’s

ailure was not caused by excessive caution; it was caused by overcon — idence in theory that contradicted accumulating experimental evidence. The problem with Haddaway’s Law is not that it tries to prevent harm (harm should be prevented where it can be identi — ied and prevented) but that it treats prevention as the only criterion and treats uncertainty as a reason to prevent rather than as a reason — or epistemic humility about what should be prevented. Well-designed law can exhibit three structural — eatures under genuine uncertainty. The — irst is reversibility. Where possible, regulatory interventions should be designed to preserve the capacity — or correction. Ex ante prohibitions that are di —

icult to li — t are epistemically worse than ex post requirements that can be adjusted in light o — evidence. Regulatory sandbox programs allow limited, supervised experimentation be — ore permanent authorization decisions are made. They are institutionally appropriate responses to genuine uncertainty because they generate the evidence that reduces uncertainty without requiring the complete uncertainty- resolution that ex ante precaution demands.145 One implementation appears in the UK Financial Conduct Authority’s regulatory Chapter 6: Wisdom o — Not Knowing 115

sandbox, launched in 2015. Whether its design adequately protects against serious harm while permitting experimentation is a legitimate empirical question; the principle o — preserving reversibility while generating evidence is sound. Outcome monitoring with credible response constitutes the second. I — ex ante assessment o — novel activities is epistemically limited, the value o — the regulatory system depends on the quality o — the — eedback loop — rom observed outcomes to regulatory response. This requires that the regulatory system be designed to observe outcomes that matter (not merely compliance with process requirements, which generates the illusion o — knowledge without its substance) and to respond to adverse observations with speci — icity and proportionality. A drug approval system that monitors post-market adverse events and has the institutional capacity to act on them quickly is epistemically superior to one that demands complete pre- market certainty, not merely because it approves drugs — aster but because it generates and uses better in — ormation.146 The third is liability alignment. Post-market liability, designed to impose costs on actors whose activities cause identi — iable harm and to internalize those costs into the ex ante decisions o — those actors, is an epistemically sound instrument under genuine uncertainty because it does not require the regulatory system to know in advance what the harms will be. It requires only that the system be able to attribute observed harms to identi — iable actors and impose costs accordingly. The design o — liability rules under genuine uncertainty is a sophisticated undertaking (questions o — causation, apportionment, and the de — inition o — compensable harm are genuinely di —

icult) but the epistemological structure is — avorable compared to ex ante regulation calibrated to harms that have not yet occurred.147 116 Judgment Proo —

The Loop That Learns The argument o — this chapter opens onto a — urther problem that the next chapter must address. The — uture is genuinely uncertain in Knight’s technical sense. The precautionary principle, applied as a general de — ault under genuine uncertainty, is internally incoherent and systematically produces invisible costs. Ex ante prohibition is the epistemically wrong de — ault under genuine uncertainty. And law can be designed to preserve reversibility, generate better in — ormation through

eedback, and align incentives through ex post liability. The argument has also assumed, throughout, something that will not survive closer examination: that a su —

iciently well-designed regulatory system could know enough to govern well. It has treated the problem as one o — calibration (that with better — eedback mechanisms, better evidence collection, and better liability design, regulatory systems could possess the in — ormation their — unctions require). Chapter 7 rejects this assumption — rom the ground up. The deeper epistemic constraint is not about the — uture at all. Signi — icant portions o — the knowledge required to govern well are inaccessible to any central authority by nature because that knowledge is dispersed, tacit, and irreducibly local (held across millions o —

situated, particular, and partially inarticulate minds, existing only in the practices o — people working within the situations regulation is supposed to govern). This knowledge resists aggregation into a central authority’s possession because the — orm in which it exists does not survive the aggregation process, and more resources cannot change the — orm. The wisdom o — not knowing runs deeper than the argument about time. Nobody knows what will happen next. As Chapter 7 will Chapter 6: Wisdom o — Not Knowing 117

establish, nobody (in the relevant epistemic sense) knows

ully what is happening now. Chapter 7: Nobody Knows Everything

Chapter 6 established that the

uture cannot be known in advance. The present cannot be — ully known — rom any central authority either. Knowledge required to govern well is dispersed across minds that no regulatory process can reach.

Spontaneous Order In 1945, Friedrich Hayek published a nine-page article in the American Economic Review that is routinely described as the de — initive case against socialist central planning.148 Accurate as a summary, this description is repeated with con — idence by people who have primarily encountered the paper as a citation. That group is large; the paper is widely assigned and less widely read. What the citation-level summary misses is what matters most — or the argument o — this book. Titled “The Use o — Knowledge in Society,” the paper’s target is not primarily socialism. Its target is a particular theory o —

knowledge: the assumption that the in

ormation required to govern complex social arrangements could in principle be collected, organized, and processed by a central authority. Hayek believed this assumption was distorting not merely economic policy but the 120 Judgment Proo —

entire intellectual project o

modern social science. His argument was that centralized planning was impossible in principle (because the knowledge required does not exist in a — orm that centralization can reach). He believed it would also be ine —

icient, but impossibility was his claim. Hayek opens with this question: “What is the problem we wish to solve when we try to construct a rational economic order?” He thereby sets the terms.149 His answer was that the question had been posed incorrectly — or a century. The planning debate assumed that the in — ormation required — or rational coordination existed somewhere in dispersed — orm, and that the task o — institutional design was to aggregate it into a central repository — rom which rational decisions could — low. Hayek argued that this assumption was — alse. The relevant knowledge “never exists in concentrated or integrated — orm, but solely as the dispersed bits o — incomplete and

requently contradictory knowledge which all the separate individuals possess.”150 Coordination’s — undamental challenge is not aggregating in — ormation that exists but using in — ormation that, by its nature, cannot be — ully aggregated. This is a claim about the structure o — knowledge, not merely about the practical di —

iculties o — data collection. I — the knowledge required to coordinate a modern economy is inherently dispersed, the same is true o — the knowledge required to govern a modern society. No regulatory agency, however well-sta —

ed and well-

unded, can possess the in — ormation it would need to speci — y in advance what every regulated actor should do in every situation. Embedded in the minds, bodies, and social relationships o — the people being regulated, this knowledge cannot, in signi — icant portions, be communicated to an outside observer at all. Chapter 7: Nobody Knows Everything 121

Chapter 6 established the  --- irst dimension o ---  the epistemological problem: the  --- uture is uncertain, and institutions that assume otherwise will systematically  --- oreclose the discoveries that could only have been made by trying. The present is also, in large part, unknowable  --- rom the center. Regulators cannot know, in any complete sense, what is already happening. The knowledge required

or that knowing is distributed across millions o — situated, particular, and partially inarticulate minds.

Prices Hayek’s argument — or markets is, at its — oundation, an argument about the processing o — dispersed in — ormation. Conventionally, de — enders o — markets emphasize their e —

iciency in allocating resources toward their highest-valued uses. Hayek was making a more — undamental claim: the price system is valuable not because it is e —

icient but because it is epistemically possible in a way that central planning is not. Consider what happens when a co —

ee crop in Ethiopia — ails. Drought reduces the harvest. Farmers who sell co —

ee receive less

or the same labor. Merchants who buy co —

ee pay more. Traders who ship co —

ee — ace higher costs. Ca — é owners in New York see their wholesale prices rise. They raise their retail prices. Customers order — ewer lattes. Some substitute tea. An entrepreneur detects the price signal and begins investigating alternative sourcing. A speculator buys co —

ee — utures, betting the shortage will persist. A researcher applies — or a grant to develop drought-resistant co —

ee plants. None o — these actors need to know that there was a drought in Ethiopia. None o — them need to know anything about Ethiopian 122 Judgment Proo —

agriculture, the global co

ee market, consumer pre — erences in New York, or the research pipeline — or agricultural genetics. What they need to know, each o — them, is only what is immediately relevant to their own situation: the price o — the thing they buy or sell, and how that price compares to what they knew be — ore. In compressed — orm, the price carries all the in — ormation each actor needs to respond appropriately to a change in conditions on the other side o — the world. This is what Hayek meant by the price system as a “mechanism

or communicating in — ormation.”151 Rather than approximating some underlying truth a sophisticated planner could calculate independently, the price is the in — ormation, in the only — orm in which it can be simultaneously available to millions o — actors who know nothing o — each other’s circumstances. No central authority could replicate what the price system accomplishes. The in — ormation the price encodes exists only as a disposition to act, a response to local circumstances expressed in market behavior and nowhere else. No computing power reaches it. The planning authority that tries to replace the price system with centrally determined allocations operates in a state o —

systematic ignorance that it cannot, by the nature o

its position, remedy. The in — ormation it lacks is not sitting in a database somewhere, waiting to be retrieved. It is embedded in the situations, relationships, and tacit dispositions o — the people it is trying to plan

or.

Knowledge Problem The knowledge problem mani — ests in multiple regulatory contexts: the regulation o — pro — essional practice, the design o — administrative Chapter 7: Nobody Knows Everything 123

procedures, the setting o

environmental standards, the governance o —

inancial institutions, and the whole range o — activities that constitute the modern administrative state.152 Consider what a regulatory agency must know in order to write a good rule. It must know the range o — situations in which the rule will be applied (not the average situation, but the — ull distribution o —

actual situations, which will di

er in ways no dra — ter can — ully anticipate). It must know how regulated actors will respond to the rule (not merely whether they will comply, but how compliance will interact with the other constraints and incentives they — ace). It must know what the rule will prevent (not merely the harms that are visible now, but the bene — icial adaptations that the rule will make unavailable). It must know, at some level, what a wise actor would do in each o — the situations the rule governs. None o — this knowledge is possessed by the dra — ting agency. Some o — it does not exist in any uni — ied — orm; it is distributed across the actors whose behavior the rule will a —

ect. Some o — it is tacit, accessible only to those with direct experience o — the relevant situations. Some o — it does not yet exist because it will only be generated by attempts to work through the situations the rule addresses. The rulemaking process (notice, comment, response, review) is an attempt to aggregate some o — this knowledge — rom the regulated community. It is better than nothing, and it is substantially short o — what the task demands: speci — ying, in binding text, what practical wisdom looks like in the — ull range o — situations the rule will govern. Rules remain — undamentally constrained in scope. At best, they are calibrated to the situations the dra — ters anticipated (which is a subset). At worst, they are calibrated to the situations that generated politically salient complaints (a — urther, and potentially quite 124 Judgment Proo —

unrepresentative, subset). A rule designed to govern a distribution o — situations is calibrated away — rom the tails o — that distribution, the situations where it will matter most. Dra — ted by lawyers with expertise in — inancial regulation, the Dodd-Frank Act o — 2010 runs to 849 pages and required hundreds o — implementing rules.153 The A —

ordable Care Act, which runs to 906 pages, was the product o — years o — legislative e —

ort and extensive expert consultation.154 Both statutes are limited in the ways they are limited because no dra — ting process could — ully incorporate the knowledge o — what is actually happening in the situations they regulate. The knowledge problem is inherent to the regulatory task itsel — rather than a — ailure o — execution. It cannot be overcome through better dra — ting.

What We Know but Cannot Say Hayek’s argument depends on a claim about the nature o — knowledge that he stated clearly but did not develop — ully. He distinguished between “the knowledge o — the circumstances o — which we must make use” and the “scienti — ic knowledge” that can be systematically organized and transmitted.155 Academic economics and expert planning agencies — unction on the assumption that understanding can be codi — ied. The — ormer category (knowledge o — particular circumstances, o — local conditions, o — the speci — ic situation at hand) is what dispersed actors possess and central authorities cannot acquire. Two decades a — ter Hayek’s paper, Michael Polanyi gave this distinction a name and phenomenological — orce.156 The tacit dimension o — knowledge—knowledge that cannot be — ully articulated—is not a residual category or supplement to stated Chapter 7: Nobody Knows Everything 125

knowledge but the

oundation itsel — . “We can know more than we can tell.”157 Polanyi’s paradigm case is the physician who recognizes disease through years o — clinical observation. Ask the experienced diagnostician how she recognizes pneumonia and she lists symptoms: diminished breath sounds, dullness on percussion, crepitation in the lung — ields. But the diagnostician does more than apply a symptom list. Through years o — listening to healthy and sick lungs—the lungs o — smokers and nonsmokers, the — it and sedentary, the early-caught and advanced cases—she has developed a perceptual capacity that cannot be transmitted by description. She recognizes something that she cannot — ully explain, in ways that someone who has only read the symptom list cannot match.158 Skills are acquired through practice. The knowledge that practice generates is embodied in the practitioner (in her perceptual systems, her motor patterns, her judgment) in ways that cannot be

ully extracted and transmitted propositionally. The recipe is not the cooking. The description o — how to ride a bicycle does not teach you to ride one. The symptom list does not develop the diagnostic eye. Hubert Drey — us spent three decades investigating this phenomenon in arti — icial intelligence.159 His argument— extravagant when — irst advanced in the 1970s, increasingly compelling since—was that expert per — ormance in complex domains cannot be reduced to rule- — ollowing. The expert does not apply rules to situations. The expert perceives the situation in a way that makes the appropriate response evident. This perceptual capacity develops through stages: — rom the novice’s explicit rule- application to the competent per — ormer’s pattern recognition to the expert’s immediate situational grasp. At no stage can the expert’s 126 Judgment Proo —

per

ormance be — ully speci — ied as rules that a non-expert could

ollow.160 Law is articulated text, rules are propositions, and whatever law can speci — y is necessarily limited to what can be stated. But the knowledge required to govern well in complex situations is not — ully stateable. It is tacit. It exists in the situated, embodied, relational knowledge o — the pro — essionals, communities, and individuals who are actually con — ronting those situations. The tacit dimension cannot be rendered as rule. Any rule attempting to — ully speci — y wise behavior in a particular domain will, in the very act o — speci — ication, replace the judgment it is speci — ying (and necessarily — ail to capture the tacit dimension that made that judgment wise).

High Modernism In 1998, James Scott examined what he called “high modernist” institutional projects.161 These were large-scale attempts to reorganize complex social and natural arrangements according to rational plans designed by central authorities. His examples include scienti — ic — orestry in nineteenth-century Prussia, Soviet collectivization o — agriculture, urban planning in Brasília and Chandigarh, and compulsory villagization in Tanzania. Each project was conceived by planners with genuine commitment to improving conditions. Each produced outcomes ranging — rom disappointing to catastrophic. Scott’s diagnosis explains why these projects — ailed: they substituted legible, abstract, — ormal knowledge — or what Scott called mētis—practical, local, contextual knowledge that cannot be reduced to explicit propositions or trans — erred to a planning authority without — undamental distortion. Chapter 7: Nobody Knows Everything 127

Nineteenth-century German  --- oresters developed what they believed was a rational approach to timber management. The  --- orest was surveyed, mapped, and reduced to a monoculture o ---  the most commercially valuable trees, planted in neat rows that could be inventoried, harvested, and replanted on a predictable schedule. For a generation, the plan appeared to work. Timber yields were predictable. Management was e ---

icient. The — orest was, — rom the perspective o — the planning authority, legible. Then the — orest began to die. Waldsterben, the German — oresters called it— — orest death.162 The planners had eliminated more than biodiversity. The original — orest’s ecology per — ormed essential

unctions that the planners did not understand because those

unctions had never needed articulation. They were embedded in the — orest itsel — , in the accumulated result o — evolutionary processes no planner had designed. The monoculture was e —

icient by the metrics the planners could measure. It was — ragile against disturbances those metrics could not see. This analogy to regulatory systems is deliberate. Scott drew it explicitly: “The simpli — ied, legible, centralized, high-modernist order, which had worked, when it worked at all, only when backed by coercive power, was always only a partial view.”163 Regulatory codes per — orm the same operation. They impose legible, abstract, general rules on situations whose relevant characteristics are particular, local, and tacit. Simple, homogeneous situations make the abstraction close enough to reality to guide action. Complex, heterogeneous, dynamically changing situations reveal the divergence. Only practitioners embedded in those situations can detect it. Mētis is not merely uncollected knowledge. It is knowledge that can only be exercised—knowledge that exists in the practice o —

128 Judgment Proo

situational judgment and that disappears when that practice is replaced by rule- — ollowing. Rules do not merely eliminate judgment in the moment. Their elimination o — practice eliminates the capacity

or judgment altogether. Scott’s — oresters did not merely — ail to collect knowledge. By planting monocultures, they destroyed the ecosystem that embodied it.

When Rules Run Out Wittgenstein asked what it means to — ollow a rule. This is a question legal theorists have yet to — ully engage.164 According to a naive picture, rules are instructions that determine their own application. I — you know the rule, you know what to do in any situation the rule covers. The rule “drive on the right” tells you what to do on any road in any car in any condition. There is no judgment required beyond understanding the rule. This is the picture that drives the aspiration o — regulatory completeness (the belie — that with enough rules, enough speci — icity, enough explicit guidance, the need — or judgment can be eliminated). Wittgenstein showed that this picture is incoherent. Rules cannot interpret themselves. Any rule requires a background o —

shared practices, common understandings, and contextual knowledge to apply correctly. The rule “drive on the right” does not tell you what to do when the road is blocked, when you encounter a one-way street, when you are on a shared path with pedestrians, or when you are driving in a country where the rule is reversed. More

undamentally, it does not tell you how to recognize a situation as a “driving” situation, what counts as a “road,” or what to do when

ollowing the rule would produce an outcome the rule was never designed to produce. Chapter 7: Nobody Knows Everything 129

 Every rule presupposes a vast background o ---  tacit understanding that the rule cannot supply. Adding more rules does not solve this problem. The new rules also require tacit understanding to apply. There is no level o ---  speci --- ication at which judgment disappears. Judgment is not supplementary to rule- --- ollowing. It is constitutive o ---  it.165
 This directly applies to the compliance industrial complex documented in Chapter 4. The aspiration behind compliance regimes is the aspiration o ---  regulatory completeness: replace the need  --- or judgment with rules precise enough to determine their own application. As Wittgenstein’s analysis predicts, this aspiration cannot be satis --- ied. The more rules a compliance regime contains, the more judgment is required to apply them. A sophisticated

inancial services — irm managing the interaction o — Dodd-Frank requirements, Basel III capital standards, state banking regulations, insurance carrier requirements, and SEC guidance documents does not — ace less judgment than a smaller — irm working under — ewer rules. It — aces more (because the interactions among the rules create interpretive problems that no single rule can resolve). The compliance attorney is equipped to interpret the rules’ interactions. The compliance attorney’s — ee is not contingent on the quality o — the underlying conduct. She bills the same rate to document the institution that managed its risks responsibly and the institution that is paying her to construct a record that will survive scrutiny o —

conduct it would be indelicate to describe as responsible. The priest does not evaluate the sinner. The priest validates the ritual. The — ee is the same. Compliance displaces the situated discernment o — the practitioner closest to the situation. It displaces the loan o —

icer who knows the community, the physician who knows the patient, the 130 Judgment Proo —

teacher who knows the child. It requires instead the abstract expertise o — the legal specialist who knows the rules. This is backwards — rom wisdom: particular knowledge displaced by general knowledge, the practitioner who knows the situation replaced by the specialist who knows the law about the situation.

What Ostrom Found The knowledge problem mani — ests most concretely in the destruction o — relational knowledge, which develops within sustained, particular relationships between practitioners and those they serve. Consider what a community banker knows. She knows the small business owner who has banked with the institution — or twenty years—his character, work ethic, decision history, market circumstances, and the reasons his business per — ormed poorly in 2009 and how he recovered. She knows his balance sheet understates his creditworthiness because he has run his business conservatively. She knows, in the particular, embodied, relational way that years o — situated knowledge produce, whether his loan application represents a reasonable risk. The banker’s knowledge resists quanti — ication. She cannot reduce it to a credit score, a debt-to-income ratio, or any o — the quantitative inputs that an algorithmic model will use. Her knowledge is tacit—knowledge o — a particular person in a particular situation, existing only in the relationship that produced it. The Dodd-Frank Act increased documentation and veri — ication requirements — or mortgage lending and limited lender discretion.166 These requirements responded to documented abuses: lenders making loans they knew would — ail, concealing this — rom investors. Chapter 7: Nobody Knows Everything 131

Correctly diagnosed was a

ailure o — pro — essional integrity in certain large institutions. But its implementation destroyed something valuable in a di —

erent category o — institution: the community bank whose competitive advantage was precisely the relational knowledge that the new regime made irrelevant. Between 2010 and 2020, the number o — community banks in the United States declined by more than thirty percent.167 The causes were multiple, but regulatory compliance burden was consistently identi — ied as a primary — actor. A community bank with — i — ty employees — aces compliance costs that are, on a per-employee basis, many times higher than those o — a large institution, because the — ixed costs o — maintaining compliance in — rastructure do not scale proportionally with the size o — the institution.168 The rule imposed its greatest burden on institutions whose competitive advantage was pro — essional judgment, even though it was designed to govern banks that had abandoned it. In medicine, this dynamic operates with equal — orce. The physician who knows her patient—who has seen this person across multiple visits, understands the context o — her symptoms, has developed the clinical relationship that enables communication— possesses exactly the tacit, relational, situational knowledge that good medical judgment requires. But modern medical administration’s documentation requirements are not designed to capture this knowledge. Instead, they are designed to document compliance with insurance requirements and regulatory mandates, and to produce de — ensible records in litigation. They consume physician time in inverse proportion to their relevance to the knowledge that actually determines medical outcomes.169 A 2019 study — ound physicians spend, on average, 4.5 hours per day on electronic health record tasks, nearly as much as direct 132 Judgment Proo —

patient care.170 These hours represent displaced cognitive resources: the attention, observation, and relational presence that good diagnosis requires. The physician composing documentation while the patient speaks loses the attentive, contextual exchange that phronēsis demands. She per — orms technē when the situation requires phronēsis.

In Determinatio Hayek’s dispersal argument, Polanyi’s tacit dimension, Scott’s mētis, and Wittgenstein’s rule- — ollowing analysis converge on a single structural claim about the limits o — regulatory knowledge. The knowledge required to govern well in complex situations di —

ers — undamentally — rom a single aggregate body o — in — ormation merely distributed across inconvenient locations. Signi — icant portions cannot, in principle, be — ully centralized because they are tacit (exercised rather than stated), situational (meaning — ul only in particular relationships and circumstances), and per — ormative (generated by the practice o — judgment, destroyed when that practice is replaced by rule- — ollowing). Regulatory systems that attempt to eliminate local, situated judgment are not merely ine —

icient. They are epistemically overreaching in a way that systematically produces the opposite o —

their intended e

ect. A rule designed to ensure — air lending treatment cannot incorporate the banker’s knowledge o — the particular borrower. A standard designed to ensure adequate care cannot incorporate the physician’s knowledge o — the particular patient. An algorithm designed to ensure consistent sentencing cannot incorporate the judge’s knowledge o — the particular de — endant. Chapter 7: Nobody Knows Everything 133

The rule, standard, and algorithm are correct in a general sense. Calibrated to a statistical representation o ---  situations that may not re --- lect any actual situation, they manage the average. And the average is a  --- iction: a mathematical construction that corresponds to no actual person, no actual loan application, no actual medical presentation, no actual sentencing context. The wisdom the rule is designed to ensure is the wisdom o ---  attending to particulars, which is precisely what the rule, as a generalization, cannot do.
Aquinas understood this. Law must establish general principles while leaving space  --- or determinatio by those acting in particular circumstances.171 His claim was not that determination o ---  particulars is more e ---

iciently per — ormed locally. His claim was that it cannot be per — ormed otherwise. The particular is not — ully captured by the general. No — ormulation o — general principle, however care — ul, can close the gap between principle and particular case. That gap is where judgment lives, and it is ineliminable.

The Price o

Legibility The regulatory state rests on an implicit premise: the gap between principle and particular can be closed. With enough rulemaking, guidance, oversight, and compliance in — rastructure, the need — or situated judgment can be progressively eliminated. This premise is

alse, and its — alseness has consequences. The — irst consequence is the displacement o — practical wisdom. When rules require actors to behave in ways that their situated knowledge would lead them to reject, the rules do not transmit the regulator’s superior knowledge. They transmit the regulator’s ignorance o — the particular situation at the expense o — the practitioner’s knowledge. The result is not better outcomes but 134 Judgment Proo —

outcomes calibrated to the planner’s model rather than to the actual situation. Equally consequential is the destruction o — the epistemic ecosystem that generates the knowledge the regulatory system claims to draw on. Regulatory dra — ters consult experts— credentialed specialists, academic researchers, senior practitioners whose knowledge has been abstracted into teachable — orm. Excluded

rom the regulatory process, the tacit knowledge o — the community banker, the situational knowledge o — the experienced physician, and the mētis o — the skilled practitioner never reach rule-makers. When the resulting rules displace the practices that generated the tacit knowledge, they destroy the epistemic — oundation they rest on. Third is the illusion o — governance. Compliance systems produce documentation that looks like evidence o — governance. A

inancial institution — iling — our million Suspicious Activity Reports annually, maintaining a compliance sta —

larger than its trading sta —

, submitting to regular examination by multiple agencies, has all the appearances o — a well-governed institution. Whether those compliance activities correspond to actual knowledge about actual transactions is a di —

erent question. It is one the compliance apparatus is speci — ically designed not to ask, because asking it would require exactly the situated, relational, tacit judgment the apparatus was designed to replace. The community banker who knew her customers would have

lagged the shell company and approved the grandmother. The compliance algorithm does the reverse. It is — unctioning exactly as designed. In the design itsel — lies the problem. Its designers could not know what the banker knows, because what the banker knows cannot be stated, can only be practiced, and has been progressively eliminated by the regulatory apparatus that replaced it. Chapter 7: Nobody Knows Everything 135

Where Jurisdiction Belongs Chapter 6 established that the — uture is uncertain. Equally, the present cannot be known — rom the center because the relevant knowledge is dispersed across situated minds in a — orm that centralization cannot reach. Together they describe the epistemic conditions under which the Sa — ety Machine operates. The knowledge problem is a structural

eature o — governing complex human activities — rom a position that cannot possess the knowledge governing well requires. Better regulation, more rigorous certi — ication, and more thorough documentation cannot overcome it. Hayek’s insight, extended through Polanyi and Scott into legal theory, is not an argument — or abolishing law or regulation. Hayek understood that markets require a legal — ramework. Scott — ound that some state planning succeeds. Polanyi treated tacit knowledge as a subject o — examination. These thinkers converge on a principle: law must be designed — or practitioners who possess knowledge that law cannot — ully state. Law’s role in complex domains is not to speci — y wise behavior but to create the conditions under which practitioners who possess situated, tacit, relational knowledge can exercise it. The classical tradition’s concept o — determinatio—the speci — ication o — particulars by those acting in particular circumstances—was an architectural principle. General principles can be stated by law. Particular applications require the judgment o —

actors who know the particular situation. The boundary between the two is not a matter o — regulatory ambition. It is a structural

eature o — the knowledge problem. Modern law has largely re — used this boundary. The consequence is regulatory expansion that progressively displaces the situated, 136 Judgment Proo —

relational, tacit knowledge on which good outcomes depend. The

ailure then justi

—

ies more rules to govern the situations the existing

rules have made ungovernable. This is the Deskilling Loop at the

level o

—

the knowledge system itsel

—

the elimination o

situated judgment produces worse outcomes, which justi — y more rules, which eliminate more situated judgment, which produce worse outcomes still. The next chapter puts these constraints to work on an actual case. On two mornings (October 29, 2018, and March 10, 2019) the Boeing 737 MAX encountered conditions its sa — ety architecture had not modeled and its pilots had not been trained to handle. The machine responded exactly as designed. Three hundred and — orty- six people did not survive the response. Chapter 8: Boeing

Part One traced the philosophical genealogy o

the Sa — ety Machine. Chapters 6 and 7 established its epistemic limits: the — uture is uncertain, the present is partly inaccessible — rom the center, and the administrative structure has no internal mechanism — or closing either gap. Between October 29, 2018, and March 10, 2019, both constraints operated simultaneously inside a single institutional system. The Boeing 737 MAX certi — ication is what the theoretical argument looks like when the stakes are 346 lives.

Lion Air Flight JT610 On October 28, 2018, a Boeing 737 MAX 8 registered as PK-LQP departed Denpasar, Bali, on Lion Air — light JT043, bound — or Jakarta. Thirteen minutes a — ter takeo —

, the aircra — t’s le — t angle-o — - attack sensor began transmitting a — alse reading. The sensor measures the angle between the oncoming air and the aircra — t’s nose. It reported that the nose was pitched steeply upward, the precursor to an aerodynamic stall, when in — act the aircra — t was climbing normally at a reasonable attitude. The — light management computer received this — alse signal and activated the Maneuvering Characteristics Augmentation System. 138 Judgment Proo —

MCAS commanded the horizontal stabilizer, the movable sur

ace at the tail that controls pitch, to rotate nose-down. The control column in the cockpit pushed — orward against the pilots. The aircra — t’s nose began to drop. The crew responded with the runaway stabilizer memory item, a procedure pilots are required to know without re — erence to a checklist. It involves identi — ying uncommanded stabilizer movement, disconnecting the autopilot i — engaged, counteracting the movement with control column — orce, and throwing two switches on the center pedestal, the stabilizer trim cutout switches, which kill power to the electric trim motor. The crew executed this procedure. The stabilizer stopped moving. The crew hand- — lew the aircra — t to Jakarta and landed without — urther incident. The aircra — t was released — rom maintenance the — ollowing morning with a replacement angle-o — -attack sensor. Maintenance records would later indicate that the replacement sensor had not been calibrated correctly, though the — ull signi — icance o — this was not apparent until a — ter the accident investigation. On October 29, 2018, PK-LQP departed Jakarta as Lion Air

light JT610, bound — or Pangkal Pinang. The crew that morning had not been on the previous day’s — light. The crew had no direct knowledge o — what the prior crew had encountered. Thirteen minutes a — ter takeo —

, the same — aulty sensor transmitted the same

alse signal. MCAS activated. The stabilizer drove nose-down. The control column pushed — orward. The crew o — JT610 — ought the aircra — t — or the eleven remaining minutes o — the — light. At 6:31 local time, the aircra — t struck the Java Sea at high speed. All 189 people aboard were killed.172 The question the accident investigation would eventually answer is not why PK-LQP crashed on October 29 but why it did Chapter 8: Boeing 139

not crash on October 28. The answer is that the crew o

JT043 had a third pilot occupying the jump seat, an o —

-duty pilot riding to Jakarta as a passenger. He had recently reviewed the runaway stabilizer procedure and prompted the crew when the anomaly began. His presence on that — light, and his absence the — ollowing morning, accounts — or the di —

erence in outcome. The sa — ety architecture o — the Boeing 737 MAX produced a situation in which 189 lives depended on the seating assignment o —

a passenger. The certi

ication process, the so — tware design, the system sa — ety analysis, and the operator noti — ication protocols— each element o — the system—had contributed to this outcome. For thirteen days a — ter the crash, the global 737 MAX — leet continued scheduled operations. The Indonesian air accident investigation was underway, but its — indings had not yet been made public. The aircra — t continued to be delivered to airlines, accumulated more — light hours, and carried more passengers. Both Boeing and the FAA treated the Lion Air crash as a localized incident: an aircra — t that had experienced a sensor mal — unction and inadequate maintenance rather than a systemic design vulnerability. Neither Boeing nor the FAA issued a grounding order. The aircra — t type continued to be viewed as — undamentally sound, the — ailure as operator error or maintenance — ailure rather than as a warning about the system’s design. On November 6, 2018, eight days a — ter the crash, Boeing issued an Operations Manual Bulletin to 737 MAX operators addressing uncommanded nose-down stabilizer trim. The bulletin did not name MCAS. The bulletin reiterated the runaway stabilizer memory item, the procedure that had enabled the crew o — JT043 to recover when the system — irst mal — unctioned. Between the moment the aircra — t struck the Java Sea and the moment Boeing noti — ied 140 Judgment Proo —

operators, no

ormal mechanism in the regulatory system had asked whether this crash represented a singular — ailure or a window into a design vulnerability that could recur. No airworthiness directive grounded the — leet. The system had received its — irst warning and responded with instruction: — ollow the procedure you already know.

MCAS The 737 MAX entered development in 2011 in response to a competitive threat that Boeing had not anticipated. Airbus had committed to re-engining its A320 — amily with CFM LEAP high- bypass turbo — ans, o —

ering airlines — uel e —

iciency improvements o —

roughly

i — teen percent over previous generation aircra — t. The A320neo would be certi — iable under existing pilot type ratings, meaning airlines could transition their pilots without simulator retraining costs. It entered service in January 2016 and accumulated substantial order backlogs quickly.173 Boeing — aced a choice: develop a new narrowbody aircra — t, which would require the better part o — a decade and investments in the tens o — billions o — dollars, or re-engine the existing 737 to match the A320neo’s economics. The 737 had been in continuous production since 1968 and was the most commercially success — ul aircra — t in history. Boeing chose to re-engine it. The choice created an engineering constraint. The 737’s landing gear is shorter than the A320’s, a legacy o — the original design’s speci — ication — or ground-level engine servicing. The new LEAP-1B engines are substantially larger in diameter than the CFM56 engines on the previous 737 generation. To achieve adequate ground clearance, Boeing’s engineers moved the engines — orward and Chapter 8: Boeing 141

upward on the wing,

urther — rom the — uselage centerline and higher relative to the wing’s leading edge than on previous 737 variants.174 This repositioning altered the aircra — t’s aerodynamic behavior. At high angles o — attack, when the nose is pitched steeply upward and the aircra — t is — lying slowly relative to its stall speed, the engine nacelles generate additional li — t. This li — t acts — orward o — the aircra — t’s center o — gravity, creating a pitch-up moment: the nose tends to rise

urther as angle o — attack increases, rather than returning to a lower attitude as the pilot would expect. The e —

ect is most pronounced at low speed with — laps retracted, the con — iguration in which a pilot reducing speed during a — lap-up maneuver would experience handling characteristics di —

erent — rom previous 737 variants.175 Boeing’s certi — ication path depended on maintaining the MAX’s status as a variant o — the existing 737 type certi — icate rather than a new aircra — t type. A new type certi — icate would have required airlines to train their MAX pilots on a new type rating, incurring simulator costs and transition time. The commercial value o — the MAX to Boeing’s airline customers rested substantially on the representation that a pilot current on previous 737 variants could

ly the MAX without a new type rating, with di —

erences training accomplishable on a tablet computer rather than in a simulator.176 The aerodynamic handling di —

erence created by the engine repositioning was incompatible with this commercial requirement. I — pilots noticed that the MAX handled di —

erently than previous 737s at high angles o — attack, they might push back on the no- simulator-training representation, and regulators might agree. MCAS was the solution. The Maneuvering Characteristics Augmentation System would monitor the aircra — t’s angle o — attack through its sensor inputs and, i — the angle o — attack exceeded a threshold with — laps retracted, automatically command the 142 Judgment Proo —

horizontal stabilizer to pitch the nose down. MCAS would activate without pilot input and without appearing on any pilot display. It would mask the handling di —

erence. From the pilot’s perspective, the MAX would — eel like previous 737 variants.177 Flight management so — tware that augments handling characteristics is standard. What made MCAS distinctive was the layering o — subsequent decisions around it.

Boeing Certi

ies Boeing The Federal Aviation Administration certi — ies commercial aircra — t through delegation. Beginning in the 1990s and accelerating through the 2000s, the FAA developed the Organization Designation Authorization program. Under the ODA, Boeing employees designated as authorized representatives per — orm certi — ication work on the FAA’s behal — —reviewing engineering analyses, witnessing tests, and making compliance determinations, subject to FAA oversight.178 The rationale is straight — orward. The FAA cannot employ engineers with enough current expertise in every technical specialty to independently review a modern aircra — t certi — ication. Boeing employs thousands o — engineers with deep specialization in its aircra — t systems; the FAA employs hundreds. Using Boeing’s engineers — or detailed technical review is more e —

icient than hiring additional FAA sta —

, and Boeing’s engineers know more about Boeing aircra — t than the FAA’s generalists can know independently. The Senate Committee on Commerce, Science, and Transportation’s 2020 investigation — ound that the FAA had delegated up to eighty-seven percent o — the MAX’s certi — ication work to Boeing.179 Boeing employees per — orming ODA — unctions Chapter 8: Boeing 143

reported pressure

rom management to limit their time on speci — ic review items and to avoid raising issues that might delay the certi — ication schedule.180 Within this architecture, Boeing’s engineers made a series o —

decisions about how to characterize MCAS to the FAA. Each decision re — lected de — ensible judgment individually. Collectively, they produced a sa — ety analysis that described a di —

erent aircra — t than the one being certi — ied. The — irst decision was classi — ication. Boeing characterized MCAS as a modi — ication to the existing 737 speed trim system, a system that adjusts the stabilizer trim in response to changes in speed, rather than as a new — light control — unction. This characterization placed MCAS below the threshold — or the most rigorous categories o — FAA review. It allowed MCAS to proceed through the certi — ication process without the level o — scrutiny a novel — light control system would have required.181 The second decision was authority. In the original MCAS design, the system could move the horizontal stabilizer a maximum o — 0.6 degrees per activation. During development, Boeing engineers expanded MCAS authority to allow larger nose-down inputs. The system ultimately could move the stabilizer signi — icantly more than in the original speci — ication, with repeated activations possible.182 The System Sa — ety Analysis—the document classi — ying the severity o — potential system — ailures and analyzing the adequacy o — sa — eguards—was not updated to re — lect this expansion. The gap was determinate. The System Sa — ety Analysis evaluated runaway MCAS activation based on the original, limited-authority design. A runaway activation o — the original MCAS would produce a small, potentially correctable pitch disturbance. The expanded MCAS could produce an uncontrollable pitch-down exceeding the 144 Judgment Proo —

pilot’s physical ability to counter. The stabilizer could move signi — icantly more per activation. The system could re-activate a — ter the pilot countered its — irst input. The analysis evaluated the — irst scenario. The aircra — t contained the second.183 The third decision was sensor redundancy. The — inal MCAS design relied on a single angle-o — -attack sensor. Modern commercial aircra — t have two or more AOA sensors. Systems using AOA inputs typically compare them — or consistency be — ore acting. MCAS did not. A — ailed or miscalibrated AOA sensor transmitting — alse high- angle-o — -attack data would produce uncommanded nose-down stabilizer movement with no internal check. This is the scenario that killed 346 people.184 The — ourth decision was disclosure. MCAS was not described by name or in detail in the 737 MAX Flight Crew Operations Manual. Boeing maintained that MCAS was a background system operating outside the normal — light envelope, and that pilots did not need to know about it in detail to — ly sa — ely. The runaway stabilizer memory item—already in the manual—would trigger on MCAS activation. Pilots experiencing the mal — unction were expected to recognize it as a runaway stabilizer event and respond with the existing procedure.185 The — law the Ethiopian Airlines accident exposed was this: the existing procedure assumed that once the electric trim motor was cut out, the stabilizer would stop moving and pilots could manually trim using the trim wheels. MCAS, at the high airspeed the Ethiopian crew reached by the time they per — ormed the cutout, had moved the stabilizer to a position at which the aerodynamic loads on the jackscrew made manual trimming physically impossible. The procedure was designed — or a di —

erent scenario than MCAS created. Chapter 8: Boeing 145

Not Fully In

ormed The internal communications that the House Committee on Transportation and In — rastructure investigation recovered and made public in 2019 and 2020 document the state o — knowledge within Boeing about MCAS during the period preceding the Lion Air crash. In January 2016, a Boeing test pilot evaluated the 737 MAX with Japan Civil Aviation Bureau representatives. In a subsequent internal message, he wrote that he had understated MCAS’s authority. He was not — ully in — ormed about the expanded design. “I basically lied to the regulators (unknowingly),” he wrote. “I have been — lying with MCAS engaging and I’ve been — lying a sim that doesn’t have it, and when we were at [JCAB], I didn’t know enough about the pitch augmentation law.”186 The message was sent in 2016, two years be — ore the Lion Air crash. In September 2018, a month be — ore the Lion Air crash, a Boeing employee wrote in an internal message: “This airplane is designed by clowns who are in turn supervised by monkeys.”187 The context re — lects — rustration with the development process in response to a question about simulator training e —

ectiveness. The message was sent in the same month that the — irst operational crash would occur, by someone involved in the program. It does not re — lect technical knowledge o — the MCAS — ailure mode. In a separate message, a Boeing test pilot wrote about the 737 MAX simulator training that was being prepared — or airline customers: “Would you put your — amily on a MAX simulator trained aircra — t? I wouldn’t.”188 The message was sent in 2018. These messages do not establish that Boeing engineers knew MCAS would cause the speci — ic — ailure modes that killed 346 people. They establish that people positioned to know the aircra — t’s systems 146 Judgment Proo —

and training expressed serious concerns about its sa

ety margins immediately be — ore and during the — irst — lights. The institutional processes that should have sur — aced these concerns, evaluated them, and either resolved or escalated them did not do so e —

ectively. The aircra — t’s design and training requirements did not change.

Uncommanded Nose-Down Trim On November 6, 2018, eight days a — ter the crash, Boeing issued an Operations Manual Bulletin describing uncommanded nose-down stabilizer trim and reiterating the runaway stabilizer memory item.189 The bulletin did not name MCAS or identi — y the system that would produce it, or explain why a single — ailed AOA sensor would trigger repeated activations. The FAA issued an Emergency Airworthiness Directive three days later that re — erenced the Boeing bulletin and added a requirement that operators update their quick re — erence handbooks. The directive did not ground the — leet.190 The 737 MAX continued scheduled operations. At the time o —

the Ethiopian Airlines crash, more than 370 aircra

t were in revenue service with thirty-six operators worldwide. The accident investigation reports — ound that the operators who received the bulletin and whose pilots trained on the updated runaway stabilizer procedure had not been told that the scenario MCAS created di —

ered materially — rom the runaway stabilizer scenarios the procedure was designed — or. MCAS could activate repeatedly. The stabilizer could move signi — icantly a — ter the electric cutout. The procedure had not been designed — or these conditions.191 Chapter 8: Boeing 147

Ethiopian Airlines Flight 302 Ethiopian Airlines Flight 302 pushed back — rom gate D5 at Addis Ababa Bole International Airport at 8:38 AM on March 10, 2019. The aircra — t was a 737 MAX 8, registration ET-AVJ, delivered — our months earlier. Captain Yared Getachew, twenty-nine years old with approximately eight thousand total — light hours, and First O —

icer Ahmednur Mohammed, twenty- — ive years old with approximately two hundred hours, occupied the — light deck.192 Flight 302 was cleared — or departure on runway 07R. The crew advanced the throttles to the takeo —

power setting and the aircra — t accelerated normally. At 8:38:44, ET-AVJ li — ted o —

and began climbing. Four seconds a — ter li — to —

, the le — t angle-o — -attack sensor began transmitting data that diverged — rom the right sensor’s reading. The le — t sensor’s reading was 74.5 degrees higher than the right sensor’s reading. This disparity indicates a sensor — ault rather than an actual

light condition. An angle-o — -attack o — 74.5 degrees above the actual value represents a physical impossibility in normal — light.193 At 8:38:44, the stick shaker on the captain’s side activated. The stick shaker is a mechanical device that vibrates the control column to warn o — an imminent stall. It was responding to the le — t sensor’s

alse reading. The right seat’s stick shaker did not activate; the right sensor was reading correctly. The captain called — or the — irst o —

icer to engage the autopilot. The autopilot disconnected almost immediately, re — using to engage because the sensor disagreement exceeded its logic thresholds. At 8:40:22, MCAS activated. The system received the — alse high- AOA signal — rom the le — t sensor. MCAS used only that single input; no disagreement check constrained it. The system commanded the stabilizer to move nose-down. The stabilizer moved — rom 2.3 148 Judgment Proo —

degrees to 1.0 degree o

nose-up trim. The nose dropped. The captain applied back pressure to the control column to hold the aircra — t’s attitude. Fi — teen seconds later, MCAS activated again. The crew were applying maximum back column — orce. The aircra — t was pitching down. The airspeed was increasing rapidly. The aircra — t was accelerating rather than climbing, as the nose- down attitude and near-maximum thrust were combining to trade altitude — or speed. At 8:40:41, the crew per — ormed the stabilizer trim cutout. They moved both stabilizer trim cutout switches on the center pedestal to the cutout position, killing power to the electric stabilizer trim motor. MCAS could no longer command stabilizer movement. The stabilizer was — rozen at its current position. The current position was 2.1 degrees nose-down. With the stabilizer trimmed nose-down and the aircra — t accelerating through high airspeed, the crew were carrying signi — icant back column — orce to maintain a climbing attitude. They attempted to manually trim the stabilizer using the trim wheels on the center pedestal. The trim wheels were turning, but the aerodynamic loads on the jackscrew, the mechanism that translates the wheel’s rotation into stabilizer movement, were too great — or manual override. The stabilizer did not move. At 8:43:11, the crew restored power to the electric trim motor by returning the stabilizer trim cutout switches to their normal position. The documentation available — rom the cockpit voice recorder and — light data recorder does not resolve whether this decision re — lected a speci — ic plan or a response to the physical impossibility o — manual trimming. Both pilots applied nose-up electric trim inputs in the seconds a — ter restoring power. MCAS Chapter 8: Boeing 149

reactivated and commanded nose-down stabilizer movement that exceeded the crew’s trim inputs. At 8:43:57, the — light data recorder recorded its last data point. ET-AVJ had reached a speed o — approximately 500 knots indicated airspeed at an altitude o — approximately 8,000 — eet, descending at a rate consistent with an aerodynamically uncontrolled dive. At 8:44 AM, the aircra — t struck a — ield near the town o — Bisho — tu, approximately 62 kilometers southeast o — Addis Ababa.194 The impact excavated a crater ten meters deep. All 157 passengers and crew were killed.

346 Dead The combined death toll — rom Lion Air 610 and Ethiopian Airlines 302 was 346 people — rom thirty- — ive countries. ET302’s mani — est included aid workers, academics heading to a UN Environment Assembly meeting in Nairobi, — amilies, a Canadian author, a Kenyan bishop, and sta —

o — the UN Food and Agriculture Organization. Lion Air 610 carried Indonesian business travelers, civil servants, and holidaymakers returning — rom Bali. The causes became clear within weeks o — the Ethiopian crash. MCAS, relying on a single angle-o — -attack sensor, repeatedly commanded nose-down movement in response to — alse readings. Both aircra — t entered unrecoverable pitch-down conditions. Both crews could not identi — y the system that caused the crash — rom the aircra — t documentation. Both had training consistent with Boeing’s claim that MAX pilots required only tablet-based di —

erences training, not simulator time. Neither was prepared — or the — ailure mode MCAS created. 150 Judgment Proo —

 The FAA grounded the 737 MAX  --- leet on March 13, 2019, three days a --- ter the Ethiopian crash. Aviation authorities in China, Ethiopia, the European Union, and Canada had grounded it  --- irst.195 The aircra --- t did not return to commercial service until November 2020,  --- ollowing extensive redesign o ---  MCAS, new certi --- ication requirements, and mandatory simulator training. Simulator training was the training Boeing had represented was unnecessary.
 Boeing entered a de --- erred prosecution agreement with the U.S. Department o ---  Justice in January 2021, admitting that two employees had misled the FAA about MCAS. The agreement required $2.5 billion in total obligations: $243.6 million in criminal penalties, $1.77 billion to airline customers, and $500 million to crash victim bene --- iciaries.196 In 2024, the Department o ---  Justice moved to require Boeing to plead guilty to conspiracy to de --- raud the United States,  --- inding that Boeing had not complied with the agreement’s remediation requirements.197 The violation: Boeing

ailed to implement a genuine corporate compliance program. It produced documentation o — a compliance program without the program itsel — . The machine, corrected, had produced the same output.

Oops Chapters 6 and 7 identi — ied two limits on what regulatory systems can know. Boeing and the FAA, between the aircra — t’s — irst — light and its grounding, encountered both simultaneously. The — irst is Knightian uncertainty about the — uture. The System Sa — ety Analysis had evaluated the MCAS — ailure mode that killed 346 people and then misclassi — ied it. The analysis modeled a runaway MCAS mal — unction based on the system’s original, limited authority Chapter 8: Boeing 151

and classi

ied it as non-catastrophic. It did not model the expanded authority that engineers had built into production. The analysis considered risk and classi — ied it wrong—a risk model applied to a system the model had never actually evaluated. The sa — ety determination had the — orm o — rigor without its substance. The Benzene doctrine required agencies to establish that a risk was signi — icant be — ore regulating. Boeing’s System Sa — ety Analysis established which risks were signi — icant — or FAA purposes. The analysis was wrong about MCAS authority. Everything downstream rested on a — oundation that did not correspond to the aircra — t being certi — ied: the certi — ication, the training requirements, the pilot manual, the absence o — redundancy requirements. The second limit is the Hayekian dispersal o — present knowledge. The engineers who expanded MCAS authority knew the system’s design. The engineers who per — ormed the System Sa — ety Analysis knew the analytical — ramework — or sa — ety classi — ication. The FAA personnel overseeing ODA had neither the specialization in MCAS nor the capacity to independently veri — y the analysis. The ODA delegation—eighty-seven percent o —

certi

ication work delegated to Boeing—was not a corruption o — the sa — ety system. It was the sa — ety system, designed on the accurate premise that manu — acturers’ engineers know more about their systems than the FAA’s generalists. Boeing’s engineers did know more about MCAS than the FAA’s reviewers. What the delegation could not accommodate was people who knew the most about the system’s design being embedded in an organization that made — ull disclosure o — sa — ety-relevant changes institutionally costly. The people responsible — or veri — ying the analysis could not independently do so. 152 Judgment Proo —

The pilot who wrote in 2016 that he had misled a  --- oreign regulator about MCAS did not do so  --- rom dishonesty. He did not

ully know what MCAS was. The tacit knowledge o — what MCAS actually did in the expanded, production con — iguration was dispersed across the engineers who made the authority expansion, the engineers who updated the so — tware, and the engineers who reviewed the change. No single person held it in integrated — orm. It did not reach the pilots who — lew the aircra — t, the pilots who evaluated it, or the FAA personnel who reviewed the certi — ication package. The ODA structure had no mechanism to aggregate and veri — y it. The relational knowledge held by the crew o — JT043—who had encountered MCAS mal — unction and survived—did not reach the crew o — JT610. Maintenance records were reviewed and the sensor was replaced. That the prior crew had needed a third pilot in the jump seat to execute the procedure in time was not a — inding any

ormal system recorded.

Jackscrewed The 737 MAX certi — ication illustrates the Sa — ety Machine at its most complete. Every — eature the preceding chapters describe appears in this one story. The machine produced thorough documentation. The certi — ication record was comprehensive. The System Sa — ety Analysis was — ormally complete. The ODA review — ollowed established procedures. Boeing’s engineers submitted what the process required. The FAA’s authorized representatives reviewed according to protocol. The aircra — t received its type certi — icate through a rigorous process by the machine’s own standards. Chapter 8: Boeing 153

 The documentation was wrong about the aircra --- t. The System Sa --- ety Analysis evaluated a less power --- ul version o ---  MCAS. The pilot manual described symptoms without identi --- ying cause. The training standard required no simulator time in scenarios the aircra --- t’s own engineers knew could occur. The aircra --- t that received a clean certi --- ication was not the aircra --- t described in the documents.
 MCAS, in production con --- iguration, was the documentation’s

iction made operational. The organization told itsel — through its sa — ety analysis what it had built. It then built something di —

erent through iterative engineering decisions that each seemed routine, without updating the story it had told itsel — . This is institutional sel — - deception rendered in so — tware: not a conspiracy but a dri — t, each step de — ensible in isolation, the aggregate lethal. The aircra — t — lew 346 people on the basis o — what the paperwork said it was. The Senate investigation, the House investigation, and the accident reports identi — y speci — ic decisions by speci — ic people that contributed to speci — ic — ailures. What made those decisions dangerous was not their individual character but the architecture that made their consequences invisible until 346 people were dead. The ODA delegation was rational. The FAA cannot employ enough aerospace engineers to independently review a modern aircra — t certi — ication. Delegation to manu — acturer engineers is the only practical way to manage the scale. But the delegation created an arrangement in which the people responsible — or identi — ying sa — ety- relevant design changes were also subject to schedule and commercial pressures that made disclosure costly. The system had no mechanism — or resolving this con — lict. It had a mechanism — or documenting that the con — lict had been managed. 154 Judgment Proo —

The MCAS authority expansion was a technical decision made during development, when design changes are routine and  --- ormal updating o ---  every dependent analysis is not standard. Engineers logged the expansion in engineering change orders and did not communicate it to the System Sa --- ety Analysis team in a way that triggered re-evaluation o ---  hazard classi --- ication. The gap between the design analyzed and the design built was not concealed. It was an arti --- act o ---  how complex systems develop: iteratively, across teams, with  --- ormal documentation that lags engineering reality during active development. A  --- ormal sa --- ety review gate be --- ore certi --- ication would have closed the gap. The gate that existed allowed the MAX to proceed without re-evaluating a hazard classi --- ication based on an earlier design.
The training standard was commercially rational. Simulator training  --- or the MAX would have required airlines to pay  --- or simulator time and absorb crew transition costs. The aircra --- t would be less competitive. Boeing’s representation that the MAX required no new type rating was a business decision embedded in a technical claim: that handling characteristics were close enough to previous 737s that experienced 737 pilots could  --- ly it sa --- ely without simulator orientation. MCAS existed speci --- ically to make that claim de --- ensible. When MCAS mal --- unctioned, it produced a situation that experienced 737 pilots, with no simulator training on MCAS, could not manage with the procedures available to them.
The machine described in Chapter 5 has no internal limiting principle. Its expansion is the rational response o ---  each institutional actor to the incentives they  --- ace. Boeing’s engineers solved engineering problems within commercial constraints. The FAA’s ODA program accommodated the knowledge asymmetry that makes comprehensive independent review impossible. The training

Chapter 8: Boeing 155

standard was the minimum consistent with the commercial promise Boeing had made to its customers. Each decision was locally rational. The system they composed was lethal. The machine produced what the preceding chapters predict: documentation o — sa — ety without its substance. The 737 MAX certi — ication dossier established to the machine’s satis — action that the aircra — t was airworthy. The aircra — t killed 346 people be — ore that satis — action was revised. Nineteen minutes a — ter takeo —

, the knowledge that mattered was in the cockpit o — ET-AVJ: the captain’s trained response, the

irst o —

icer’s trained response, the procedures in the memory items, the position o — the stabilizer trim cutout switches. The aerodynamic loads on the jackscrew were approximately 4,500 pounds. Two people pulling the manual trim wheels with their — ull strength could generate approximately 200 pounds o — torque. The gap between those numbers is the endpoint o — a system that had removed, step by step, every check that might have caught the decisions leading to that moment. This is Haddaway’s Law carried to altitude. The institutional imperative to prevent hurt produced a certi — ication architecture that satis — ied itsel — at every stage that the aircra — t was airworthy. Documentation was thorough, processes were — ollowed, delegations were made according to procedure. The aircra — t killed 346 people in the gap between what the machine had certi — ied and what the aircra — t did. Part Three will ask what institutions would look like i — they were designed to acknowledge this gap rather than paper over it. The answer requires examining what the traditions this book has been recovering actually built, not as theological curiosities, but as speci — ications — or institutions that understood, long be — ore Boeing, 156 Judgment Proo —

that the machine cannot know everything, that knowledge disperses, and that the gap between what the documentation says and what the aircra — t does is precisely where people die. Chapter 9: The Sa — ety Machine

Boeing was the acute

ailure: two crashes, 346 dead, a grounding. The — inancial compliance apparatus is the chronic one. It distributes its costs across millions o — transactions daily in ways that generate no catastrophe and there — ore no investigation. The system spends $274 billion annually, — iles 4.6 million reports into an unprocessable database, and per — orms precisely the — unction it was designed to per — orm. The problem is what that — unction is.

Chronic Conditions U.S. and Canadian — inancial institutions spend $61 billion annually monitoring transactions — or — inancial crime. Globally the — igure is $274 billion. The monitoring generates 4.6 million Suspicious Activity Reports — iled annually with the Financial Crimes En — orcement Network. Law en — orcement agencies query the database when investigating speci — ic actors. Academic analysis o —

e

ectiveness (what — raction o — those — ilings contributes to prosecution) places the number well below one percent. The gap between expenditure and outcome is the system’s designed output. 158 Judgment Proo —

 The 737 MAX crashes concentrated their costs: 346 dead in two mornings, two aircra --- t, two investigations, a grounding order, a de --- erred prosecution agreement. The  --- inancial compliance system distributes its costs across millions o ---  transactions daily in ways that produce no individual catastrophe attributable to any speci --- ic

ailure. The grandmother subjected to a ninety-minute compliance interview does not die. The shell company routing three million dollars through a correspondent bank to a — avorable jurisdiction does not appear in an accident report. The — ailures are real and the costs are substantial, but they sur — ace as a di —

use tax on legitimate economic activity and a di —

use immunity — or sophisticated illegitimate activity, not as an event that triggers a Senate investigation. The mechanism is the same. Documentation is produced that corresponds imper — ectly to the underlying reality it purports to represent. The system generating the documentation has no internal mechanism — or closing that gap. This chapter examines why.198

Bank Secrecy The Bank Secrecy Act, enacted in 1970, and its amendments established the modern — inancial monitoring — ramework. Financial institutions must identi — y customers, monitor transactions — or suspicious patterns, and — ile reports with the Financial Crimes En — orcement Network when detecting activity that might indicate money laundering, terrorist — inancing, or other — inancial crimes.199 The architecture is rational. I — law en — orcement cannot monitor every transaction, requiring — inancial institutions to do so and Chapter 9: The Sa — ety Machine 159

report suspicious

indings creates a distributed network extending the state’s reach into the — inancial system. The design assumes two things: — inancial institutions can distinguish suspicious — rom legitimate transactions with enough accuracy to make reporting use — ul, and law en — orcement will review and act upon reports in proportion to their evidentiary value. Both assumptions have collapsed.200 The — irst collapses when a compliance o —

icer reviews transaction patterns. Armed with general training in indicators, the o —

icer — aces a transaction containing amount, counterparty, timing, and account history. But this transaction record lacks the community banker’s knowledge o — a customer’s twenty-year relationship, the character o — that business, the reason patterns have changed, or the contextual knowledge a situated human being would need to distinguish legitimate — rom suspicious. The second — ails: FinCEN received 4.6 million Suspicious Activity Reports in — iscal year 2023.201 The volume re — lects expanded reporting scope and more reporting institutions. Law en — orcement review capacity lags — ar behind — iling volume. Academic analyses estimate that SAR — ilings contributing to success — ul prosecution represent somewhere below one percent, possibly well below.202 The reports are — iled, stored, and theoretically available. The bottleneck is not the reporting requirement but the ratio o —

iled reports to investigative capacity, which the volume has made unmanageable. The machine requires not the identi — ication o —

inancial crime but the production o — documentation indicating that — inancial crime monitoring has occurred. These are di —

erent activities, per — ormed by di —

erent processes, and optimized by di —

erent incentives. 160 Judgment Proo —

Lemon Problem In 1970, George Akerlo — published “The Market — or ‘Lemons’: Quality Uncertainty and the Market Mechanism.”203 The paper, which would earn its author a Nobel Prize, analyzed a puzzle standard economic theory could not explain: why do used-car markets behave so badly? In — ormation asymmetry. Sellers know more about their cars than buyers. A buyer cannot readily distinguish a reliable vehicle

rom one poorly maintained or mechanically — lawed. Rational buyers o —

er a price re — lecting the average quality available: adequate

or poor-quality cars (“lemons”) but inadequate — or high-quality cars. High-quality sellers withdraw. The market — ills with lemons, driving average quality and price down, driving out more sellers, until the market collapses or settles populated almost entirely by lemons. Any market in which one party has systematically better in — ormation about quality than the other is susceptible to adverse selection. The party with in — erior in — ormation cannot distinguish good — rom bad and prices accordingly. The good drives out the bad at the o —

ered price. The market — ills with the bad. The Akerlo — inversion applies to the — inancial compliance apparatus as — ollows: The monitoring system — lags transactions — or indicators o —

inancial crime. These indicators are proxies: observable characteristics correlating imper — ectly with the underlying phenomenon. Large cash transactions, structuring to avoid reporting thresholds, geographic anomalies, volume inconsistent with account history, and counterparties in high-risk jurisdictions—these are the signals. They are observable, Chapter 9: The Sa — ety Machine 161

automatable, checkable against lists, comparable against benchmarks. Criminal enterprises have the same access to the indicator list. Criminal enterprises operating through the — inancial system employ compliance counsel.204 The attorney advising the criminal enterprise engages in the same pro — ession as one advising the legitimate institution. The indicators are the same. The guidance documents are the same. The clients di —

er. The — ee is the same. Criminal enterprises structure transactions to produce scores below monitoring thresholds. They use shell companies that appear legitimate. They establish account histories that create the baseline against which deviations are measured. They keep activity within normal variation so no deviation triggers a report. They produce documentation o — legitimate — inancial activity. Financial sophistication correlates with resources, legal counsel, and institutional access—characteristics o — both large-scale criminal operations and large legitimate actors. The monitoring system, calibrated to detect indicators that unsophisticated actors exhibit, is better positioned to generate reports on the unsophisticated. The actors whose activity produces anomalous signals are not, in the main, sophisticated criminals. Consider an elderly person wiring money to a — oreign country — or the — irst time in a — orty-year relationship—they produce anomalous data. Immigrants sending remittances to — amily in a high-risk jurisdiction produce patterns matching monitoring indicators. Small businesses receiving several large cash payments in cash-intensive industries produce structuring-adjacent patterns. These are legitimate transactions that read to the compliance algorithm as suspicious. The compliance apparatus cannot distinguish between them. This is not a design — law. Rather, the machine produces reports 162 Judgment Proo —

about transactions matching indicators. Both illegitimate and legitimate activity match the indicators in proportions the designers cannot — ully speci — y. What is observable is whether the indicator was present. The machine monitors — or indicators. It reports on indicators. It cannot do more without the situated knowledge the monitoring regime has systematically displaced.

Flagging Grandma Consider two transactions at the same — inancial institution’s compliance system on the same morning. The — irst is a $500 wire — rom the personal account o — a woman in her eighties to an organization in the Caribbean not in her compliance — ile. She has banked here — or — our decades. Her account activity has been stable: Social Security deposits, small grocery and pharmacy charges, periodic trans — ers to a nearby account. But the wire represents a signi — icant deviation — rom history. The recipient is in a high-risk jurisdiction. This is her — irst international wire. When the algorithm — lags the transaction, a customer service representative calls and asks the purpose. She says it is a donation to a hurricane relie — organization she heard about on the news. The representative routes to the compliance department. A compliance o —

icer reviews the account, notes the deviation, and schedules an in-branch meeting. The woman comes in with a news printout and identi — ication, waiting ninety minutes — or an interview. She answers questions about the source o — her retirement savings, the basis — or her charitable intent, and her relationship with the recipient. The institution — iles the wire and, depending on threshold criteria, may or may not — ile a Suspicious Activity Report. Chapter 9: The Sa — ety Machine 163

 The second is a $3 million wire  --- rom a Delaware LLC with nominee directors at a registered agent in Wilmington. Eight months earlier, the LLC was established and made several trans --- ers to the same institution, establishing a baseline pattern. The wire routes to a correspondent bank in Luxembourg, then to an entity in a jurisdiction the bene --- icial owner selected  --- or  --- avorable reporting requirements. The transaction is within normal variation  --- or the pattern. The bene --- icial owner’s compliance attorney reviewed the structure be --- ore execution.
 The algorithm does not  --- lag it. It clears in three seconds.205
 This is the asymmetry the monitoring system produces. The system detects deviations  --- rom pattern and advantages actors who establish the right patterns. The woman deviates  --- rom her pattern through a legitimate transaction. The LLC does not deviate because its pattern was established correctly. The system cannot distinguish between them. The interview  --- alls on the person least equipped to handle it.
 The interview’s  --- unction is to gather in --- ormation the algorithm cannot observe: the customer’s explanation  --- or the anomaly. For legitimate anomalous transactions, the interview is an imposition. For illegitimate transactions that are algorithmically unremarkable, no interview is triggered.

The Machine’s Price Tag The — inancial crime compliance industry generated $274 billion in global expenditure in 2022, according to LexisNexis Risk Solutions.206 U.S. and Canadian institutions accounted — or $61 billion. These — igures represent direct costs (personnel, technology, training, reporting in — rastructure) and exclude indirect costs: 164 Judgment Proo —

transactions not completed due to compliance

riction, customers denied banking access because — lag rates make servicing uneconomical, time costs borne by customers subjected to compliance procedures. This $274 billion expenditure purchases 4.6 million Suspicious Activity Reports — iled with FinCEN in — iscal year 2023, roughly ten percent above the prior baseline o — 4.2 million.207 Once — iled, the reports sit in a database. Law en — orcement agencies request speci — ic reports when investigating speci — ic actors already identi — ied. The reports provide supporting documentation — or investigations already underway. A database accumulating 4.6 million — ilings annually over decades is not a tool — or identi — ying unknown criminal activity but

or documenting known activity identi — ied through other means. The database establishes that the institution — lagged relevant transactions, protecting it — rom regulatory liability — or — ailure to report. Peter Reuter and Edwin Truman, in the most rigorous independent analysis o — anti-money-laundering e —

ectiveness, concluded that evidence the global AML — ramework deters or disrupts signi — icant money laundering is thin relative to resources consumed.208 The — ramework generates documented compliance activity at enormous scale. The production o — that documentation is independently valuable to institutions producing it and regulators demonstrating reporting requirements are met. The relationship between documented compliance activity and reduction o —

inancial crime is not established by — iling volume. This is the machine’s output in the — inancial domain: an industry o — unprecedented scale producing monitoring documentation at a rate no human review can process, generating costs — alling most Chapter 9: The Sa — ety Machine 165

heavily on actors least equipped to absorb them, demonstrating regulatory compliance with monitoring requirements.

Suspicious Activity Reports The critique o — the — inancial compliance system meets an immediate objection: i — it is not working, why has it not been re — ormed? The institutional logic o — Chapter 5 answers this question directly. The institution that reduces SAR — iling rates by exercising more judgment — aces two risks. First, unreported transactions may later be identi — ied as money laundering, generating regulatory sanction

or — ailure to — ile. Second, regulator scrutiny—SAR — iling volume is an indicator o — monitoring robustness, so a declining rate looks like declining monitoring. A SAR — iled — or a legitimate transaction costs the institution little: administrative processing and a potential customer call. A SAR not — iled — or a criminal transaction imposes potentially catastrophic costs: regulatory en — orcement, reputational damage, civil liability. The rational response is to — ile at the high end o — the plausible range. This is the precautionary principle operating in the compliance domain, carrying the same incoherence Chapter 6 identi — ied in the pharmaceutical context. The institution that — iles a SAR — or a legitimate transaction bears essentially no cost — or the — alse positive. The institution that — ails to — ile — or a transaction that turns out to be criminal bears large costs. The error — unction is one-sided. Large penalty — or under-reporting, minimal penalty — or over-reporting. Systematic over-reporting is the predictable output. The regulator, — acing tens o — millions o —

iled reports and — inite resources, adapts. For the regulator, the reports — unction as 166 Judgment Proo —

documentation o

institutional monitoring rather than investigative leads. Such documentation has regulatory value independent o — investigative value. The reporting requirement generates compliance documentation. Compliance documentation demonstrates regulatory compliance. Regulatory compliance is the machine’s product. This is Haddaway’s Law in the compliance domain. The institutional imperative to prevent hurt has organized itsel — into a $274 billion industry producing monitoring documentation no review capacity can process: the grandmother interviewed, the shell company cleared, and the machine satis — ied.

Geneivat Da’at Maimonides identi — ied a moral — ailure that the compliance apparatus systematizes. Geneivat da’at (the the — t o — the mind) is the prohibition against creating a — alse impression in another’s mind— not through explicit lying but through structuring an in — ormation environment that leads to mistaken belie — .209 It extends the prohibition on deception: it is not su —

icient to avoid — alse statements. It is prohibited to arrange circumstances so the other person draws a — alse conclusion, even i — nothing stated is literally untrue. The compliance system commits institutional geneivat da’at by presenting its documentation volume as evidence o — the underlying

unction it represents. When an institution — iles 4.6 million Suspicious Activity Reports, it creates the impression it is monitoring — inancial transactions at a rate consistent with 4.6 million — lagged events. It has actually produced 4.6 million reports about transactions that triggered indicator algorithms—a di —

erent Chapter 9: The Sa — ety Machine 167

activity, per

ormed by a di —

erent process, with a di —

erent relationship to — inancial crime prevention. The impression is not deliberately constructed. No compliance o —

icer chose to deceive the regulator about the relationship between SAR volume and actual monitoring quality. Rather, it is the natural output o — an oversight architecture that measures what can be measured— — iling volume, training completion rates, examination

indings, the percentage o — transactions reviewed—and treats the measured as equivalent to the real. When the institution meets the measured standard, it appears compliant. The measured standard creates the impression o — meeting the underlying objective. The underlying objective is not what the measured standard measures. In aviation, the gap closed in eleven minutes. In — inancial services, the gap is chronic, distributed, and non- — atal in any individual transaction. The cumulative cost— — inancial crimes not prevented, legitimate customers deterred by compliance — riction, resources that could address actual investigation—is substantial but di —

use, attributable to no speci — ic — iling or decision. The machine cannot — ail. It can only be under — unded.

The Space Between Rules The monitoring regime cannot know what it needs to know. Looking ahead, the — uture is uncertain, not merely risky, and regulatory instruments designed to manage risk apply imper — ectly to genuine novelty. The present is also partly unknowable — rom the center. Knowledge required to govern complex situations is distributed across situated, tacit, relational — orms that resist extraction. Both constraints are permanent. Better analysts and improved data collection cannot overcome them. 168 Judgment Proo —

 The Sa --- ety Machine cannot produce what it needs to produce. Even i ---  we aggregate the knowledge it requires, the behavioral outcomes it seeks—judgment exercised well under uncertainty by people who have internalized institutional purposes—cannot be produced by speci --- ication. Compliance produces documentation o ---

judgment’s outputs. It does not produce the disposition

rom which those outputs come. The machine reports what it can report. Consider the — inancial compliance system’s 4.6 million annual — ilings, its $274 billion expenditure, its adverse selection — lagging the grandmother and clearing the shell company—these are not aberrations. They are the rational output o — the incentive structure built into the reporting requirement. The system optimizes — or the measurable. The measurable is not the same as the real. The gap between what the documentation says and what the institution actually produces is what geneivat da’at names. The machine’s — ailures are its predictable outputs. They are what the machine is, not what happens when it mal — unctions. Better rules and more rigorous en — orcement cannot correct them. A system without limiting principle absorbs any principle introduced into it, as the Benzene doctrine’s neutralization demonstrated. The question is not whether the Sa — ety Machine can be re — ormed but whether institutions can be built di —

erently — rom their — oundations: designed — or beings with the epistemic constraints these chapters describe, oriented toward cultivating judgment rather than documenting it, built to preserve the practices where wisdom develops rather than to produce records asserting its existence. The traditions this book has been recovering built something less like the Sa — ety Machine and more like what the Sa — ety Machine has been trying, and — ailing, to become. Understanding what they Chapter 9: The Sa — ety Machine 169

built and why it held requires going back

urther than the Administrative Procedure Act, — urther than Benzene, — urther even than the Nicomachean Ethics. It requires asking what a legal institution designed — or genuine human limitation actually looks like and what it takes to build one that works. Chapter 10: The Gymnasium

The answer already exists. A tribunal o

armers meets on Thursday mornings at the door o — the Valencia Cathedral, and has done so — or over a thousand years. A twel — th-century rabbi wrote objections into the margins o — the Mishneh Torah. An economist discovered the same structure operating in a Turkish — ishing village. What these institutions share is a — orm that preserves disagreement, and with it, the conditions — or practical wisdom.

Dissent In approximately 1180 CE, Moses Maimonides completed the Mishneh Torah, the most ambitious work o — Jewish legal scholarship in centuries. He had spent a decade writing it. His organizing principle was deliberate: clarity over argument, ruling over deliberation, and the law stated without rehearsal o — the debates that had established it. Prior legal codes had preserved the dispute alongside the conclusion and the rejected opinion alongside the accepted one. Maimonides chose otherwise. The Mishneh Torah would give you the law. Rabbi Abraham ben David o — Posquières (the Ravad) received the text in Provence and disagreed with this principle be — ore he 172 Judgment Proo —

disagreed with any ruling. He wrote his objections into the text.210 The glosses appear between passages and in the margins, brie —

annotations positioned precisely where the ruling they challenge appears. Some correct an error o —

act. Some dispute a conclusion. Some are sharp. In one gloss on Maimonides’ ruling that a person who attributes a physical body to God is a heretic, the Ravad writes: “Why does he call such a person a heretic? Greater and better men than he have been o — this opinion, relying on Biblical texts and even more so on aggadic literature, which cause the mind to go astray.” The Ravad is not wrong. He is restoring the dignity o — people Maimonides’ ruling condemns by noting that their error, i — it is one, was shared by scholars Maimonides has no standing to dismiss. The gloss is part o — the argument. It is addressed to every reader o — the ruling, at the moment o — reading it, in a — orm that cannot be skipped. Once written, the Ravad’s glosses could not be separated — rom the text they annotated. Every manuscript and printing o — the Mishneh Torah carried both the ruling and the challenge on the same page. A student o — Jewish law who opened the code to understand what it said was required by the physical — orm o — the text to encounter what someone argued was wrong with it. The gloss is part o — the argument. The Gymnasium preserves this principle: embedding the challenge in the authoritative text, inseparable — rom it.

Naked The Greek gumnazō (to exercise or to train) takes its root — rom gumnos: naked, unprotected, exposed. The gymnasium was not primarily an athletic venue. It was the institution where training occurred in conditions o — genuine exposure, where the work was Chapter 10: The Gymnasium 173

done in a

orm that made — ailure visible, consequential, and correctable. The gymnasium was where one learned by being wrong in — ront o — people who would remember it. In the sense this chapter uses, the Gymnasium is an institution designed — or practice under conditions o — genuine accountability: to the subject matter, to the community o — practitioners, to the record o — what was argued and what was — ound to be wrong. The Ravad’s gloss is a gymnastic act. It inserts the objection into the authoritative text in the only — orm that cannot be later dissolved by editorial revision or selective citation. Maimonides cannot respond across eight centuries and have the response — iled. The objection stands with the ruling, requiring each new reader to hold both. The compliance apparatus the preceding chapters described is the gymnasium’s inverse: designed so the o —

icer cannot — ail — or having — iled. The compliance o —

icer who — iles a Suspicious Activity Report has per — ormed an institutional act that cannot — ail in any way the institution will later be asked to account — or. The — iling is the per — ormance, and the per — ormance succeeds by existing. The System Sa — ety Analysis that classi — ied MCAS as non-catastrophic was reviewed against its own analytical — ramework, not against the aircra — t it purported to describe. The documentation o — sa — ety could not — ail on documentation grounds. It — ailed on di —

erent grounds, which the documentation process was not designed to check. The Gymnasium checks the documentation against the reality, in conditions where the checker is accountable — or the check.

Tribunal On Thursday mornings, at the door o — the Valencia Cathedral, eight elected — armers convene the Tribunal de les Aigües (the Water 174 Judgment Proo —

Tribunal o

Valencia).211 The tribunal has met there on Thursdays

or over a thousand years. The eight syndics, one — rom each o — the eight huertas that draw — rom the Turia River’s main canals, hear disputes about water allocation: unauthorized diversions, — ailures to maintain one’s section o — the ditch, damage to shared in — rastructure. They deliberate. They rule. The proceedings are oral; no written record o — individual cases is kept. The decision issues the same morning. The huerta system the tribunal governs (the irrigated agricultural plain surrounding Valencia) operates in a semi-arid Mediterranean climate where water is scarce, seasonal, and collectively managed. The canals that deliver it have been maintained by the — arming communities that depend on them since at least the tenth century. Some elements o — the system predate Arab rule in Spain and were preserved through successive changes o —

sovereignty. The tribunal manages a resource that, in the standard economic analysis o — commons governance, should have been exhausted long ago. Garrett Hardin’s 1968 essay “The Tragedy o — the Commons” argued that common-pool resources governed by shared users without private property rights or state regulation would be exploited to ruin: each user, acting individually, would take more than the commons could sustain, and the commons would collapse under the aggregate weight o — individually rational decisions. The Valencia tribunal had been preventing this — or a millennium be — ore Hardin published. The theory was wrong. The tribunal was not impossible but real, meeting every Thursday, so the theory required revision.212 Elinor Ostrom spent her career supplying that revision. She studied the Valencia huerta. She studied Swiss alpine meadows that Chapter 10: The Gymnasium 175

have governed timber and grazing rights among

arming communities — or eight hundred years. She studied Japanese mountain commons (iriaichi) where villages have managed shared

orests and pastures through governance arrangements dating to the Tokugawa period. She studied groundwater basins in Cali — ornia,

ishing grounds in Maine, irrigation systems in Bali where water temples have coordinated rice cultivation across thousands o —

terraced paddies

or centuries. In each case the economic theory predicted — ailure. In each case the institution had been managing the commons — or generations. What Ostrom — ound, across the — ull range o — these cases and published in her 1990 work Governing the Commons, was that the institutions that work share a — orm. Not the same rules: the rules o —

the Valencia tribunal

it the hydrology o — the Turia River and the patterns o — demand in a Mediterranean agricultural system; they would not trans — er intact to a Japanese mountain commons or a Maine — ishing ground. But the same design — eatures, arrived at independently, across cultures and centuries and legal traditions with nothing in common except the problem they were solving.213

Local Knowledge Boundaries are de — ined. Those who hold rights to the resource are known, as are those who do not. Ambiguity erodes the basis — or obligation and en — orcement. Rules — it the resource. The regulations governing the Valencia huerta are speci — ic to the Turia’s hydrology, the soil, and the cropping patterns o — Mediterranean agriculture. The knowledge required to write them is local. 176 Judgment Proo —

Those governed by the rules modi --- y them. The syndics are elected  --- armers accountable to their communities, with the power to adjust rules when they produce outcomes the community rejects.
Monitoring is per --- ormed by those subject to the rules. The

armers who depend on the canal monitor it. They bear the cost o —

monitoring

ailure: the diverted water is their water, the damaged ditch is their ditch. Sanctions are graduated. A — irst in — raction brings a small — ine; repeat violations escalate. This allows correction be — ore exclusion, makes en — orcement credible, and shows that severity matters rather than applying a — lat rate that — unctions as a tax. Resolution is accessible and — ast. The oral proceeding at the cathedral door costs nothing and produces a decision the same morning. It eliminates the procedural overhead that would make dispute resolution a last resort. Where the governance system covers a large area, it is organized in layers. The huerta syndic handles disputes within the ditch. Problems at the level o — the canal are handled at the canal level. Problems involving the river are handled at a scale that encompasses the river. Each layer addresses the problems its knowledge reaches, accountable to the layer below it and coordinating with the layers above. These — eatures are empirical — indings, not theoretical prescriptions. Ostrom identi — ied the pattern and explained why it recurs: communities discover this — orm because it matches what the problem requires.214 The knowledge needed to govern is distributed across the people in the situation. The — orm that works uses the knowledge where it exists. The Sa — ety Machine cannot accommodate this insight. The machine rests on the premise that knowledge can be extracted — rom Chapter 10: The Gymnasium 177

the situation, codi

ied, and applied — rom the center. The commons governance arrangements that work rest on the opposite premise: the knowledge stays where it is, and the institution goes to it.

Alanya’s Co

eehouse Each September, in the — ishing town o — Alanya on Turkey’s Mediterranean coast, the — ishers draw lots. The lottery assigns each

isher to a numbered site — or the season. Since the early 1970s, they have gathered in the co —

eehouse to do this, a — ter a period o — con — lict over the productive locations — orced them to invent a method to allocate access — airly. The coastline is mapped into named — ishing spots: locations worked — or generations, each distinctive. Some sites run rich in late autumn; some are productive only in particular conditions; some consistently outper — orm others across the season. The — ishers know their coast the way — armers know their — ields. The knowledge exists in practice and cannot be readily codi — ied. The lottery distributes this advantage. Beginning in mid- September, each — isher occupies his assigned location and then rotates daily: east to west — rom September through January, then west to east — rom January through May. By season’s end, each — isher has worked every site once. No — isher accumulates the advantage o —

consistently superior locations. No

isher bears the cost o —

consistently in

erior ones year a — ter year. A — ter the drawing, the list is posted on the co —

eehouse wall. Any

isher can veri — y where any other — isher should be on any morning. There is no ambiguity about who belongs where. A copy goes to the local gendarme. 178 Judgment Proo —

That copy records the state’s relationship to the system. The state does not set the schedule, conduct the lottery, or resolve disputes. The copy documents a deliberate choice: the state present as witness, not manager. It acknowledges that the knowledge needed to govern the resource is in the room where the lottery occurs.
Disputes occur. A  --- isher  --- inds someone at his assigned site who should not be there. The matter is brought to the co ---

eehouse. The posted list resolves it. The assignment is unambiguous; the violation is speci — ic. The community adjudicates and reaches resolution quickly because the record is local and present. Ostrom studied Alanya in the 1980s as one case among many. What she — ound was not exotic but recurring: the same architecture

rom Valencia, Swiss alpine meadows, Japanese mountain commons, and Balinese irrigation temples. Di —

erent rules — itted to di —

erent resources, but the same structure arrived at independently. Knowledge where it exists. Governance accountable to those it governs. The state present but not in charge. The opposite arrangement governed the Grand Banks cod

ishery. At the national level, government scientists in Ottawa set catch quotas. Fishers working those grounds across generations knew stocks were declining, visible in — alling catch rates and changed — ish behavior. The decision-making process could not receive this knowledge. The scientists’ models showed sustainable extraction levels. The — ishers’ experience showed something else. In 1992, Canada imposed a moratorium a — ter the population — ell below two percent o — its historical abundance. Thirty thousand people lost their livelihoods. The — ishery has not recovered. Remove the co —

eehouse and keep the gendarme, and Alanya becomes the Grand Banks.215 Chapter 10: The Gymnasium 179

Friction The Sa — ety Machine produces — riction. The Bank Secrecy Act’s reporting requirements impose costs on every transaction. The ODA review required Boeing engineers to work through certi — ication protocol. The grandmother in a ninety-minute compliance interview experienced — riction. The crews o — JT610 and ET302 experienced the wrong kind. The Gymnasium produces a di —

erent — riction. The grandmother’s ninety-minute interview improved nothing: not her judgment about giving, not the compliance o —

icer’s judgment about suspicious transactions, not FinCEN’s capacity to investigate crime. It produced a record that monitoring had occurred: a document satis — ying institutional requirements without advancing institutional purpose. This is sludge— — riction that costs without improving, delays without discerning, imposes without teaching.216 Constitutive — riction di —

ers. The Ravad’s gloss improved the Mishneh Torah by identi — ying where the ruling required modi — ication, where a conclusion overreached, where authority should be more tentative. The gloss is not an obstacle but part o — the process by which the law reaches a — orm that can survive challenge. Without it, only Maimonides’ ruling stands: a better start than nothing, a worse end than both together. The Tribunal de les Aigües runs on the same principle. The hearing is constitutively costly: it requires time, presence, and public accounting. The cost is the content. The — armer who appears and loses knows more a — terward than a mailed — ine could convey. The neighbors who witnessed the proceeding know the monitoring works, the sanction is calibrated to the violation, and the institution is present in actual canal li — e. 180 Judgment Proo —

The schools o ---  Hillel and Shammai disputed every signi --- icant question o ---  Jewish law. A divine voice declared: “Both are the words o ---  the living God.”217 The Talmud preserves both positions. Shammai is overruled on most questions and remembered on all o ---

them. Any student wanting to know the law must encounter the rejected argument in the same text, in the same breath. The rejected opinion is preserved because the conditions that would make it correct may recur. The Sa — ety Machine discards the Shammai position. Failed comment letters are summarized in the preamble. Dissents — rom System Sa — ety Analyses do not appear in the certi — ication record. The process documents consensus because consensus is what it produces. The Gymnasium preserves the objection because you need it when consensus — ails.

Havruta The Valencia tribunal, the rabbinic academy, Ostrom’s commons, and the common law’s adversarial proceeding share speci — ic — eatures that distinguish them — rom the Sa — ety Machine—speci — ic enough to be designed into or against. The — irst — eature is recorded disagreement. The Gymnasium preserves the challenge alongside the ruling. The Ravad’s gloss, minority opinions, dissents, written objections: — orms embodying this requirement across contexts. The Sa — ety Machine produces consensus documents in which disagreement has been absorbed and

ormally resolved. The Gymnasium keeps disagreement active, requiring readers to reckon with it. The preserved disagreement is not courtesy but epistemic practice that enables revision when consensus — ails. Chapter 10: The Gymnasium 181

The second is accountability in the situation. The syndic who monitors the huerta is a  --- armer who depends on it. The monitoring knowledge exists in the situation, and the monitor is present. The knowledge o ---  what a suspicious transaction looks like (what makes a wire  --- rom an elderly woman anomalous a --- ter  --- orty years o ---

banking relationships) is also in the situation: in the prior relationship, in the context the algorithm cannot see. The Gymnasium puts the monitor where the knowledge is. The Sa — ety Machine places it at a remove with only a checklist. The third is graduated response. The graduated sanction requires the en — orcer to distinguish between a — irst in — raction, a pattern, and — undamental de — ection—a distinction requiring contextual knowledge. A — lat — ine is a tax. A graduated regime requires judgment. The Bank Secrecy Act does not distinguish between a grandmother wiring — ive hundred dollars to hurricane relie — and a shell company routing three million through correspondent banking. The algorithm classi — ies by deviation — rom pattern. The Gymnasium classi — ies by what they are. The — ourth is cost to the monitor. Ostrom — ound that success — ul commons are monitored by those bearing the cost o —

ailure. The

armer-monitor who — ails to report a diversion while neighbors lose water has — ailed them and will answer — or it. The external compliance o —

icer who misses a — raudulent transaction has, in institutional accounting, already succeeded: the activity was per — ormed, the algorithm ran, the threshold was not triggered. The cost does not return to the monitor. Without that accountability, monitors optimize — or institutional compliance rather than underlying purpose. The — i — th is polycentrism. The tribunal asks Valencian — armers to govern their ditch, not water policy o — the Iberian Peninsula. 182 Judgment Proo —

Ditch-level governance handles ditch-level problems. Canal-level problems are handled at the canal level. River problems at the river scale. Governance is nested: each level handling what its knowledge reaches, accountable below. The Sa — ety Machine runs backward: problems at the transaction level generate national guidance, which generates transaction-level compliance requirements, monitored by people without transaction-level knowledge.

What the Gymnasium Builds The Ravad’s method becomes the institutional requirement: no ruling without its recorded challenge, no authority without accountability to those it governs, no monitor without monitoring knowledge, and no sanction without judgment. Institutions have existed continuously — or centuries in conditions more demanding than modern regulatory systems — ace. The tribunal’s thousand-year record is not coincidence but evidence that this — orm endures because it is built — rom what governance requires rather than what governance documentation can represent. The Gymnasium is not a single design but a — amily o — designs sharing the requirements above. The bet midrash is a gymnasium: adversarial, recorded, preserving minority positions alongside majority rulings. The common law’s adversarial proceeding is a gymnasium when parties have evidence access, the judge is accountable to external standards, and losing arguments are preserved and retrievable. The sa — ety review board that can question certi — ication be — ore closing the record is a gymnasium. The ODA program is not, because its accountability structure eliminated the

riction that would have — orced someone to notice the gap between analyzed system and produced one. Chapter 10: The Gymnasium 183

Institutions can be built as gymnasiums. They have been. Chapter 11 takes up how this practice produces what it is supposed to: how judgment is cultivated rather than documented, what the practice o ---  being-wrong-in- --- ront-o --- -others actually develops, why Alpine commons governance across centuries produced  --- armers who knew rules without being able to state them, why that knowledge was more reliable than codi --- ied rules.
Aristotle had an answer. The rabbinic tradition had a di ---

erent one. They are more compatible than they appear, and their agreement implies more speci — ic institutional design than either source alone provides. Chapter 11: Aristotle’s Algorithm

Be

ore Good A medical student seeing a sick patient — or the — irst time o — ten does not recognize it. The vital signs may be only marginally o —

, or not yet o —

. The chie — complaint is vague. The attending physician walks into the same room, scans the same chart, speaks — or thirty seconds, and begins moving: ordering things, changing the plan be — ore any numbers have changed. The student asks a — terward how he knew. He has di —

iculty saying. Something in the patient’s color. Something in the breathing. Signals with no name, no place in any clinical algorithm. He says: you learn to see it. She does, eventually, a — ter years o — seeing patients under conditions where her attendings tell her when she missed something and what she should have noticed—not through explanation, which always halts. The knowledge does not live in explanation- — orm. That process develops hexis, Aristotle’s term. Hexis is typically translated as “habit,” but habit captures only behavior. Habit is a repeated pattern. Hexis is the condition o —

character

rom which the pattern — lows: a stable disposition, a way o — perceiving and responding that no longer requires e —

ort because 186 Judgment Proo —

it has become who the person is. The attending does not run through a mental checklist but perceives. This perception is the product o — a developmental process that cannot be shortened: not because it is mysterious, but because practice with correction over time is the only thing that produces it. The Sa — ety Machine cannot replicate this process; not through insu —

icient e —

ort or rigor. The conditions under which hexis develops are incompatible, in a speci — ic technical sense, with the conditions the machine requires.

What Aristotle Required Aristotle is precise about what distinguishes virtuous action — rom per — ormance. Three conditions must be met.218 The agent must act with knowledge—not o — the rule, but o — what she is doing and why it matters. She must choose to do it — or its own sake, not because monitoring demands it. And she must act — rom a stable, settled disposition: not as a one-time per — ormance, not in response to pressure, but as an expression o — who she is. The third condition is what institutional design cannot satis — y by decree. The — irst two can coexist with compliance: a person can know what she is doing and choose it even when regulation also requires it. The third condition cannot be produced by requirement but only by practice under genuine accountability, sustained over time with correction. A compliance requirement can coexist with an existing hexis. It cannot create one. Compliance can create a per — ormance o — the third condition. The certi — icate documents training completion, assessment passage, acknowledgment signature. This documentation has the — orm o —

evidence that the disposition exists—not evidence o

the disposition Chapter 11: Aristotle’s Algorithm 187

but a record o

action that, i — per — ormed — rom a stable disposition, would look identical to action per — ormed to satis — y a requirement. The gap between the documented condition and the real one is the same gap in Boeing’s System Sa — ety Analysis and in Suspicious Activity Reports: appearing at the level o — character rather than institutional output, but with identical source. The machine measures what is measurable, and what is measurable is the action, not the disposition — rom which it — lows.

Compliance People John Locke identi — ied a paradox applying to any attempt to produce an internal state through external requirement. His argument concerned compelled religious observance: requiring subjects to attend church, take sacraments, and per — orm religious — orms they might not hold. Locke’s objection was not only that this was unjust but that it could not achieve its stated goal. The goal o — compelling practice was, presumably, to bring people to genuine belie — . Genuine belie — is precisely what compulsion cannot produce. You can require external acts, not the internal state — rom which they

low. The compelled acts, produced without the accompanying disposition, are not the thing you were trying to produce but a

acsimile, externally identical and constitutively empty.219 Substitute compliance training — or religious observance and the point holds. The goal o — training is not module completion but the judgment the module was designed to produce: recognizing when a regulation’s purpose is being served, when it is not, and what to do in situations the regulation did not anticipate. You can compel completion—the video, assessment, acknowledgment, the record. What cannot be compelled is the judgment development that was 188 Judgment Proo —

supposed to

ollow. That requires exercising practical discernment in actual situations with actual consequences, not observing representations and selecting prede — ined answers. The compliance module has become the primary mechanism across industries — or documenting that judgment exists. It is not designed to produce judgment but documentation. The con — usion between these activities is the machine’s operational premise. The same people sometimes per — orm both using the same materials. The con — usion is not venal but a natural error — rom the same logic that produced the System Sa — ety Analysis: the measurable stands in — or the real, and the substitution remains invisible until the real is needed and — ound absent.

Enron On July 1, 2000, Enron Corporation distributed to shareholders a sixty- — our-page Code o — Ethics. Kenneth Lay, chairman and chie —

executive, signed a pre

atory letter: “As o —

icers and employees o —

Enron Corp., we are responsible

or conducting the business a —

airs o — the Company in accordance with all applicable laws and in a moral and honest manner.” The Code enumerated — our core values: respect, integrity, communication, and excellence, each elaborated across several pages. Under integrity: “We work with customers and prospects openly, honestly and sincerely. When we say we will do something, we will do it; when we say we cannot or will not do something, then we won’t do it.” Approximately two years later, Enron — iled — or bankruptcy in December 2001; then the largest corporate bankruptcy in American history. Subsequent investigations revealed systematic accounting Chapter 11: Aristotle’s Algorithm 189

raud, concealment o — billions in debt through special purpose entities, manipulation o — Cali — ornia’s electricity markets, and destruction o — audit documents. In 2002, two copies o — the Code o —

Ethics were auctioned on eBay, selling

or a combined twenty- — our thousand dollars.220 The Code is not evidence o — hypocrisy i — hypocrisy means knowingly saying one thing while doing another. Most people at Enron appear to have been committed to the values it named, or at least not indi —

erent to them. The Code documents something more instructive: a document articulating the outputs o — virtuous conduct is not, even in sincere hands, a mechanism — or producing it. It described what the company would look like i — its people had the relevant dispositions. The dispositions were not there. The document could not put them there. The gap between description and reality remained invisible until — atal because the compliance process had no mechanism — or distinguishing between documentation o — the disposition and the disposition itsel — .

Surgery Be — ore examining the theory that explains the Code’s — ailure, consider an institution that has imper — ectly but recognizably preserved the conditions — or genuine pro — essional judgment. The medical residency, — or all its documented problems, remains structured around Aristotle’s three conditions in ways corporate compliance training does not. A — irst-year surgical resident does not watch videos but assists in surgery: holding retractors, managing suction, closing incisions under supervision—all in conditions where her actions have consequences — or a patient she is responsible — or. The knowledge she 190 Judgment Proo —

develops is inseparable

rom the exercise. She learns to read the operative — ield by being present in it, acting within it, and having someone who can already read it tell her when she has missed something. Graduated exposure is essential. In the — irst year, the resident per — orms limited portions under close supervision. As her judgment develops—as she shows she can anticipate complications, recognize unexpected anatomy, and adjust technique to unwritten situations—she is given wider latitude. By the — inal year, she per — orms procedures with the attending available but not scrubbed in, exercising independent judgment where error has real, immediate consequences. The progression is calibrated to developing capacity, not to completing curriculum.221 What makes this model di —

erent — rom compliance training is structure, not content. The resident exercises judgment under genuine uncertainty: patient response to anesthesia, variant anatomy, mid-procedure complications. She is corrected by someone possessing the judgment being developed who can recognize its absence. The correction is sustained over years, not compressed into a module. The institution never treats a completed assessment as evidence that the disposition has been acquired. The attending who supervised the resident — or three years knows what that resident can and cannot do—a speci — icity no certi — ication can replicate. The model is expensive, slow, and resistant to standardization. This is why compliance has not adopted it. Compliance produces documentation o — competence rather than competence itsel — . Residency produces physicians who can read a deteriorating patient be — ore vital signs con — irm it. Compliance produces pro — essionals who can document training completion. These are not equivalent. Chapter 11: Aristotle’s Algorithm 191

The institution treating them as equivalent has con

used the arti — act with the capacity it measures.

A

ter Virtue Alasdair MacIntyre drew a distinction in A — ter Virtue that clari — ies what the Enron Code attempted and why it could not succeed.222 MacIntyre did not write about compliance regimes, but his

ramework, developed to diagnose the — ragmentation o — moral reasoning in modernity, applies with precision to them. What

ollows is my application o — his categories. A practice, in MacIntyre’s sense, is a complex, socially established cooperative activity through which internal goods are realized. Internal goods can only be obtained by participating according to the practice’s own standards o — excellence. They cannot be purchased, mandated, or produced by per — orming external — orms while bypassing substance. When achieved, they bene — it the community o — practitioners, not only the individual. Medicine’s internal goods are: clinical judgment, the capacity to perceive what is wrong with a patient be — ore vital signs con — irm it, and the competence to bring disparate — indings into a coherent diagnosis. You acquire them only by practicing medicine under conditions that develop them, under observation and correction o — someone who already has them. External goods di —

er: compensation, credentials, status, advancement are achievable by per — orming external — orms without internal goods. They are not intrinsically connected to substance but contingently associated with medicine because medicine happens to be the context where they are obtained. When achieved, they belong to the individual as possessions, not the community. 192 Judgment Proo —

Every practice has both. The institution redirecting practitioners systematically toward external goods—by replacing genuine practice with documentation—produces people who accumulate external goods without developing internal ones. MacIntyre calls this corruption: not deliberate degradation but slow displacement in which the core is replaced by a simulacrum that per --- orms  --- orms while losing substance.
The compliance module redirects toward external goods. Completing it produces a record protecting the institution  --- rom liability and the individual  --- rom de --- iciency; these are the external goods o ---  compliance. The internal goods (the judgment to identi --- y actual risks, the discernment to distinguish a rule’s letter  --- rom its purpose, and the capacity to act well in unanticipated situations) are produced by exercising judgment in actual situations with actual consequences, under observation o ---  someone capable o ---  recognizing whether the exercise was good or poor. The module documents the external goods, leaving internal goods to be acquired or not through whatever conditions the practitioner encounters outside it.
Kenneth Lay signed the Code but had not participated in the practice it described. No compliance requirement could have made him participate. The Code documented the internal goods o ---  honest dealing. Internal goods require the practice. The practice requires conditions. Documentation does not create conditions.

Mind The

t Maimonides’s account o — the relationship between law and wisdom converges on a principle the compliance literature has been deriving

or three decades:223 Law can create the conditions — or wisdom’s development but cannot command wisdom’s presence. Chapter 11: Aristotle’s Algorithm 193

 Maimonides distinguished between laws governing the body politic (prohibitions o ---

raud, violence, and the — t that constitute tikkun ha-gu — ) and cultivation o — the soul (tikkun ha-ne — esh). The — irst is law’s domain: commanding and prohibiting behaviors speci — ied in advance, monitored and en — orced through coercive sanction. The second requires something di —

erent. The per — ection o — the soul cannot be produced by command. It requires voluntary engagement with di —

icult questions: genuine deliberation, genuine e —

ort, the genuine possibility o —

ailing. Coercion destroys this possibility and the conditions that would have produced wisdom.224 In Maimonides’s account, this is not passivity but counsel about right instruments. Law can create conditions: social structures, institutional — rameworks, graduated challenges, communities o —

practice. Within these conditions, wisdom develops. Law cannot substitute — or conditions by commanding outputs. The legal system commanding wisdom produces, at best, documentation o — wisdom’s compliance, destroying the conditions that would have produced wisdom. The parallel to modern compliance is exact. The Sarbanes-Oxley requirement is a legal command to produce a document describing the outputs o — ethical judgment. The document is inspectable, auditable, veri — iable. The judgment that would have produced those outputs is not. Enron had the document. Its board exercised judgment badly and disastrously, in ways the document explicitly prohibited when it voted to authorize those transactions. The document was tikkun ha-gu — deployed in the domain o — tikkun ha- ne — esh: a command instrument applied to a domain that command cannot reach. Maimonides had a speci — ic vocabulary — or this institutional error: Geneivat da’at—the — t o — the mind; creating a — alse impression 194 Judgment Proo —

not through lying but through structuring in

ormation environments that mislead. The compliance system presenting its documentation as evidence o — ethical judgment commits institutional geneivat da’at. It creates a — alse impression — or regulators, shareholders, and the public that the institution is cultivating the wisdom whose outputs the documentation records. The documentation is not — raudulent; the impression it creates is. This is the deepest compliance theater: not — ailure o — honest reporting but systematic con — usion o — the arti — act with what it measures.

Atrophy While managing electronic records, billing codes, prior authorizations, and quality metrics, physicians correspondingly lose time — or medicine, yet remain not documentably de — icient. She has complied with everything required. The clinical judgment that comes — rom years with patients under supervision o — someone who can say “that is not what you should have noticed; look again” is what the system does not require and has no mechanism — or producing.225 The attorney who produces documents by template, reviews standard provisions by checklist, and advises clients to accept standard terms without exercising independent judgment about whether they serve the client’s situation has not — ailed the bar but has been shaped by an environment rewarding external-goods production more reliably than independent judgment development. The environment did not lie but simply did not produce what it implied.226 The compliance o —

icer who knows which transactions require SARs, which accounts require enhanced due diligence, and which Chapter 11: Aristotle’s Algorithm 195

reports are due when, but lacking any mechanism to develop judgment to distinguish suspicious transactions — rom legitimate ones that trigger the algorithm,is doing the job as designed. The job does not require the judgment she lacks.227

Humans Aren’t Algorithms Aristotle’s account o — hexis is, in a precise sense, a procedure: conditions under which it develops and conditions under which it does not. The conditions are not optional as regulations are— optional — or someone willing to accept the — ine. They are conditions in the way warmth and moisture are conditions — or germination: the thing does not occur without them, regardless o — anyone’s intentions. The — irst condition: the practice must be exercised in situations with real consequences — or something the practitioner values—not observed, not simulated in low-stakes assessment, not described in case studies ending with multiple-choice. The surgeon-in-training operating on patients under supervision exercises judgment in conditions that develop it. The compliance o —

icer viewing a training video does not. The di —

erence is not content but presence or absence o — genuine exercise. Judgment must be called upon to work, not identi — ied — rom prede — ined menus. The second condition: the exercise must be subject to correction by someone capable o — recognizing good practice — rom bad—the condition the module most conspicuously eliminates. The multiple- choice assessment has a correct answer selected by the designer. Judgment in actual practice does not have a correct answer checkable against a key but a better and a worse, recognizable to someone who has exercised the judgment extensively and seen 196 Judgment Proo —

enough o

its — ailures to know what errors look like. Correction requires presence and competence. Neither can be replaced by completion records. The third condition: the practice must be sustained long enough

or the disposition to become second nature—the condition credentialing most thoroughly misrepresents. Credentialing marks a threshold where external goods are con — erred, and the threshold systematically overstates the degree to which internal goods have been acquired. The resident who completed residency has more clinical judgment than a beginning resident but not the judgment o —

a physician with twenty years o

practice. The credential implies the latter while documenting the — ormer.228 The institution reading the credential as su —

icient — or independent practice, then providing no

urther development conditions, has con — used the documentation o —

development with development itsel

. This is ordinary knowledge about competence development, not exotic. Any practicing physician, experienced attorney, or skilled tradesperson could articulate it — rom their own — ormation. The Sa — ety Machine did not eliminate this knowledge — rom the world but — rom the institutional processes that produce competent practitioners. The conditions — or genuine development (time, supervision, risk o — error with consequences, sustained correction) are expensive, slow, and produce no documentation that the process is occurring. The machine produces documentation; the conditions

or hexis produce judgment. These are not the same activity. When the machine is given responsibility — or producing judgment, it produces documentation o — judgment instead, because that is what it knows how to do. Chapter 11: Aristotle’s Algorithm 197

Practice Makes People The Gymnasium creates the conditions — or Aristotle’s algorithm to operate. The Ravad’s gloss is a product o — those conditions: a li — etime o — Talmudic practice in an institution requiring independent judgment about di —

icult texts in — ront o — interlocutors capable o —

recognizing whether the judgment was sound, with the record preserved — or evaluation by all who read a — terward. The practice developed the capacity. The capacity produced the gloss. The gloss is the internal good o — the practice—the thing no module could have produced because it is the speci — ic product o — that speci — ic person’s judgment, shaped by that tradition’s conditions, exercised on that problem. The syndic o — the Tribunal de les Aigües who hears a water dispute on Thursday morning and issues a ruling the community accepts as binding exercises a capacity developed through years participating in the tribunal, observing disputes heard and ruled on, making arguments under observation o — more experienced syndics, having those arguments corrected, and gradually acquiring the judgment the institution requires. The tribunal does not certi — y this process but creates the conditions — or it. The conditions produce judgment. The judgment maintains the huerta. The title names something that does not exist. Aristotle did not write an algorithm. Judgment is not an algorithm. The irony is precise: the thing that actually produces the behavior the machine is trying to mandate is the practical wisdom to act well in novel situations, under genuine uncertainty, without a checklist. It is produced by the process least amenable to the machine’s methods. It cannot be scaled, veri — ied through documentation, or monitored through metrics. It is produced by practice. Practice requires 198 Judgment Proo —

conditions. Conditions require institutions designed to create them. Those institutions look nothing like the Sa — ety Machine. They look like what Part Three has been describing: the Gymnasium. The next chapter examines the speci — ic institutional hardware: the design — eatures that preserve conditions — or judgment across generations rather than creating them — or one cohort and allowing them to atrophy.229 Chapter 12: The Hardware

Practical wisdom develops in individual practitioners. Institutions have to preserve the conditions — or it across generations. A valve stuck open at Three Mile Island at — our in the morning in 1979. Eight hundred years earlier, a physician in Cairo was already working on the institutional problem the valve would reveal.

Nuclear Sa

ety Valve At — our in the morning on March 28, 1979, a valve stuck open at Three Mile Island. The valve was supposed to close automatically when pressure dropped. It didn’t. The control panel indicator light read closed. The light was wrong. For the next two hours, the operators made reasonable decisions based on — alse in — ormation. Coolant was pouring out o — the reactor through the stuck valve. Alarms rang. Warning lights activated. The operators read the pressurizer level (rising, indicating too much pressure) and shut o —

the emergency cooling water. They were preventing one — ailure while a di —

erent — ailure un — olded. The temperature spiked. The — uel rods began to melt. 200 Judgment Proo —

 Each individual decision was de --- ensible. Given the in --- ormation available at each moment, each action was what a competent pro --- essional would have done. The problem was systemic: the valve

ailure set o —

a cascade o — consequences that moved — aster than human understanding could track, and the instruments themselves were telling contradictory stories about what was happening. There was no time to think. There was no space between cause and e —

ect in which thinking could have operated. Charles Perrow, the Yale sociologist who studied the accident, called it a “normal accident”:230 not an unusual accident, not a preventable accident, but the inevitable result o — building systems that combine what he called complex interactions with tight coupling. In a tightly coupled system, components are connected so that process A must complete be — ore process B can begin. There is no slack. No bu —

er. No give between elements. When something goes wrong, the cascade begins immediately, — aster than human intervention can intercept it. The operators at Three Mile Island were competent. The reactor was their pro — essional world. What they hadn’t drilled — or was a — ailure that made the instruments lie, a — ailure whose signature was invisible in the only in — ormation they had. Tight coupling had eliminated the space between event and consequence where diagnosis could have happened. The system had been designed to prevent error by eliminating discretion. When the system — ailed, the eliminated discretion was precisely what was needed.

Coupling A di —

erent system has been — ailing productively every day — or — i — ty years. Chapter 12: The Hardware 201

 On any given day, thousands o ---  servers  --- ail across the internet. Cables are cut. Routers go o ---

line. Packets are lost in transit. Data is corrupted. The system keeps working. I — a data center in Singapore crashes, email in São Paulo still arrives. The packets — ind another path. The internet was designed around the assumption o — partial

ailure. It doesn’t assume all components will — unction. It assumes that some components will — ail continuously and unpredictably and distributes the tra —

ic around the — ailures rather than trying to prevent them. Karl Weick, the organizational theorist who brought loose coupling into institutional analysis, named the property that makes this possible:231 loosely coupled systems preserve the capacity

or localized adaptation. Each component retains enough autonomy to respond to local conditions without destabilizing the network. Loose coupling creates slack: the space between cause and consequence in which judgment can operate. Tight coupling is — aster under normal conditions. Loosely coupled systems survive when things break. Things always eventually break.

Architecture o

Resilience The preceding chapters traced how judgment develops: through practice, correction, and the — riction o — encounter with what the rules don’t cover. This chapter answers the architectural question: what structure allows that method to operate at scale? How does judgment coordinate across thousands o — practitioners, across decades, across communities that share principles without sharing geography, without collapsing into a single rigid standard? How 202 Judgment Proo —

does authority coexist with discretion? How does the system maintain coherence when the center — ails or was never there? Eight hundred years be — ore Perrow analyzed Three Mile Island, a Jewish physician in Cairo had designed the answer. Moses Maimonides was born in Córdoba in 1138, in a city that was at the time one o — the intellectual centers o — the Mediterranean world. Jewish, Christian, and Muslim scholars studied in proximity. Aristotle’s texts survived in Arabic translation. Philosophy and medicine — lourished. He was thirteen when the Almohad movement arrived. The Almohads were not interested in pluralism. They presented non-Muslims with a choice: conversion or — light. Maimonides’ — amily — led through Spain, across the Mediterranean, through Morocco. His — ather died in exile. His brother David drowned in the Indian Ocean, taking the — amily’s remaining wealth with him. Maimonides settled in Cairo, worked — rom dawn past midnight, and con — ronted a problem that had no institutional precedent. The Jewish legal tradition was a distributed network operating without a center. The Temple was gone. The Sanhedrin, the supreme court that had maintained legal uni — ormity, had ceased to

unction a thousand years earlier. Communities were scattered across three continents, living under di —

erent political rulers, speaking di —

erent languages, developing local customs that were beginning to diverge — rom one another in ways that threatened the tradition’s coherence. There was no king, no capital, no authority capable o — imposing unity. And yet the system had to — unction. Disputes had to be resolved. The community had to make decisions about marriage, divorce, inheritance, commerce, religious observance. The decisions had to cohere across communities that would never share a courtroom. Chapter 12: The Hardware 203

Maimonides’s solution was architectural.
The Mishneh Torah, completed a --- ter ten years o ---  labor, was

ourteen volumes covering the entire body o — Jewish law: organized by category rather than by the Talmud’s associative logic, written in clear Hebrew rather than technical Aramaic, structured as direct rulings. The law is X. The reason is Y. The application is Z. His goal was to enable a person who reads the Written Torah and this work to know the entire Oral Law without re — erence to any other text.232 This was the emergency sca —

old Chapter Ten described: the minimum viable plat — orm designed to prevent — ragmentation. But Maimonides built something else alongside it. He created a protocol

or managing disagreement. Not eliminating it. Managing it. The protocol is the hardware.

What Protocols Allow The Laws o — Rebels addresses a scenario whose resolution is not obvious.233 A local court (a regional Sanhedrin) disagrees with the ruling o —

the Great Sanhedrin in Jerusalem. The local court believes the Great Sanhedrin has misinterpreted the law. Perhaps they’re correct. Perhaps circumstances in their region make the standard interpretation produce injustice. The answer surprises readers who expect hierarchy. The local court may teach that the Great Sanhedrin is wrong. The court may explain to its students, in — ull, why the law should be read di —

erently. The court may write treatises de — ending its position. The court may work to persuade other courts. The intellectual disagreement is not merely tolerated but architecturally 204 Judgment Proo —

protected. A court that has concluded the law requires a di

erent interpretation is expected to say so. What the local court may not do is create a practical split: a situation where their community acts according to one rule while other communities act according to a di —

erent one. That is the line. The — racturing o — the community into incompatible practices (marriages valid in one community but not another, contracts en — orceable in one jurisdiction but disputed in the next) is what the prohibition addresses. The intellectual disagreement is not. Two layers operate simultaneously. At the intellectual layer (wisdom, tikkun ha-ne — esh), disagreement is essential and understanding develops through dialectic. A court that concludes the majority is wrong must say so and preserve that reasoning — or students and later courts. At the practical layer (social order, tikkun ha-gu — ), unity is required. A community cannot — unction when its legal determinations diverge across members. Loose coupling operates at the intellectual layer; tight coupling at the practical. Authority persists because a clear answer to “what is the law” exists at any moment. Judgment persists because that answer can be evaluated, challenged, and potentially supplanted by better reasoning. The local court exercises judgment by examining the ruling’s correctness, teaching its reasoning, preserving the minority view, and maintaining option value — or courts that — ollow. The Sa — ety Machine collapses these layers. It applies the logic o —

the practical (coercion, uni

ormity, tight coupling) to the intellectual domain. How pro — essionals reason, how judges weigh competing considerations, how teachers adapt instruction to di —

erent students—these become risks requiring the same tight coupling as physical sa — ety. Comment letters that — ail to persuade are procedurally resolved. Dissents — rom System Sa — ety Analyses Chapter 12: The Hardware 205

disappear

rom the certi — ication record. The regulatory process produces a document designed to show consensus because the process is built to manu — acture it. Maimonides understood that tight coupling o — thought and tight coupling o — action are di —

erent requirements, producing di —

erent kinds o —

ailure when applied to the wrong domain. The Sa — ety Machine has — orgotten this distinction.

Times Change The preservation o — dissenting reasoning is not sentiment. It is engineering. The Hebrew concept shinui ha’ittim (“change o — the times”) describes a — undamental shi — t in circumstances that makes a previously adequate ruling inadequate. When shinui ha’ittim occurs, the tradition either has resources to respond or must begin — rom nothing. A tradition that suppressed dissent, eliminated the minority view, and recorded only majority rulings is brittle. When that ruling — ails to account — or changed circumstances, there is no stored reasoning to draw on—only — ailure and the need to rebuild. A tradition that preserved minority views alongside majority rulings has stored the option. The reasoning that was wrong — or the current era may be exactly right — or the next. The Talmud addresses this explicitly. Mishnah Eduyot 1:5 asks why record the minority opinion when the law — ollows the majority. The answer: so a — uture court, — inding the times changed, may have an authority to rely upon.234 Not — or historical completeness but to preserve the intellectual resources — or adaptation when it is required. 206 Judgment Proo —

Basel III required all banks to use the same risk models, hold the same capital reserves,  --- ollow the same procedures. When the models proved wrong in 2008, in ways no single institution could detect because every institution was running the same analysis, every institution  --- ailed in the same way at the same time. There was no dissenting methodology preserved in the system. No alternative approach waiting to be activated. The tight coupling that had achieved coordination had eliminated the diversity required  --- or resilience.
Agricultural monoculture achieves higher yields than mixed planting until a pathogen arrives that targets the single crop. Intellectual monoculture achieves higher consistency than preserved dissent until the situation arrives that the consensus cannot handle.

Metaphysics o

Disagreement The most — amous dispute in Jewish legal history ran — or approximately seventy- — ive years. The School o — Hillel and the School o — Shammai disagreed on nearly every signi — icant question o — law: the rules o — Sabbath, the laws o — marriage, the calendar, the correct sequence — or lighting Hanukkah candles, and the minimum value that constitutes an act o — betrothal. On hundreds o — questions, their rulings pointed in opposite directions. The standard assumption about legal disagreement is that one side is right and one is wrong, and the purpose o — the process is to determine which. The Talmud declines this assumption. In Eruvin 13b, the tradition records that a divine voice, the bat kol, declared: “These and those are words o — the living God.”235 Chapter 12: The Hardware 207

 Two expressions o ---  truth, each capturing something the other does not.
 The Hillel/Shammai dispute maps onto a genuine metaphysical division. Hillel’s legal reasoning tends toward actualization: it attends to the person as he actually stands be --- ore the court, to the present situation in its concrete particulars, to accommodation o ---

the human condition as it is. The traditional connection is to chesed, the divine attribute o — loving-kindness236, which expands to meet the world where it is. Shammai’s reasoning tends toward potential: it attends to what a thing might become at its highest, to the ideal toward which law should draw its subjects, to standards maintained at their — ull weight. The traditional connection is to gevurah, the divine attribute o — strict judgment, which holds the line against diminishment. In the current era, the law — ollows Hillel. The world as it is requires the accommodation that chesed provides: the ruling that meets people in their actual circumstances rather than demanding they con — orm to an unreachable ideal. But the Shammai positions are not discarded. They are preserved alongside the Hillel positions throughout the tradition, not as historical — ootnotes but as live alternatives. The mystical tradition holds that in the ultimate era o —

human moral development, the law will revert to Shammai, the stricter standard stored until the community has grown capable o —

bearing it. The more demanding standard is preserved in the tradition because the journey toward it is not — inished. The minority position is not merely an error awaiting correction. It is the direction o —

travel, stored

or when the destination becomes achievable. The student who reads only the Hillel rulings learns what the present requires. The student who reads both learns to hold two 208 Judgment Proo —

truths: understanding the gap between what is and what might become, developing judgment that holds the tension between mercy and rigor without collapsing into either. The — riction o —

contradiction is the curriculum. The Sa

ety Machine eliminates the

riction, delivers the answer, discards the challenge. The Gymnasium (as Chapter Ten described) preserves the challenge in the text. Chapter Ten described what is preserved. This chapter names why the architecture o — preservation matters — or institutions that must coordinate across scale: not only because the minority might be right, but because the minority is the option value. The dissenting reasoning is the backup code. When shinui ha’ittim arrives (and it always does), the tradition that preserved its disagreements has resources. The tradition that eliminated them has only its — ailure.

The Judge in the Gate Deuteronomy 16:18: “You shall appoint judges and o —

icers in all your gates, which the Lord your God gives you, according to your tribes, and they shall judge the people with righteous judgment.” The instruction speci — ies location: judges at the gates, in the local community, accessible, embedded in the context they adjudicate. Not judges in the capital. Not judges appointed by a central authority and accountable to it. Judges who know the community, who see the — aces o — the people be — ore them, who live with the consequences o — their decisions. Loose coupling operates at the implementation layer. The local judge applies universal principles to the particular case using the practical wisdom Aristotle identi — ied as irreplaceable — or judgment. Chapter 12: The Hardware 209

The judge knows this community’s history, this dispute’s context, the di —

erence between error and exploitation. The central administrator applying rules mechanically cannot make this distinction—not — rom lack o — intelligence but because it requires what James C. Scott calls metis:237 practical, local, context-dependent knowledge developed through immersion in particular situations and resistant to — ormal speci — ication. The judge’s phronesis operates through metis. The sentencing algorithm does not. COMPAS scored de — endants on recidivism using variables that correlated with race.238 ProPublica’s 2016 analysis showed it barely exceeded random chance at prediction and systematically — avored white de — endants over Black de — endants with equivalent outcomes. The tool masked disparities judicial discretion was designed to prevent. A judge who saw the de — endant, heard the argument, and weighed circumstance against community context could — ail in an individual case. COMPAS — ailed systematically and invisibly because uni — orm application prevented the local knowledge that would have detected the — ailure. Elinor Ostrom — ound the same requirement in commons governance.239 The — isheries that survived, the alpine meadows managed — or eight centuries, the irrigation systems coordinating water across thousands o —

arms: all relied on local monitors embedded in the community, accountable to the people they served. They distinguished normal variation — rom exploitation. They knew which — amilies drew bad luck and which took advantage. Systems that — ailed replaced local monitors with centralized administration by outside experts who possessed technical knowledge but lacked metis—knowledge developed through sustained presence in the situation. 210 Judgment Proo —

Robert Ellickson’s study o ---  Shasta County cattle ranchers documented the same dynamic.240 Ranchers resolved disputes through in --- ormal norms en --- orced by community members who understood local conditions, distinguished negligence  --- rom bad luck, and remained accountable to each other. When  --- ormal legal rules administered by distant courts replaced in --- ormal norms, resolution became more expensive and less just. The  --- ormal system had rules but lacked metis—the knowledge required to apply them wisely in particular cases.
The Judge in the Gate, Ostrom’s local monitor, Ellickson’s ranching community: all instantiate the same architectural element: loosely coupled implementation that preserves judgment while maintaining coordination through shared principles. Maimonides encoded the same architecture in his protocol: the Great Sanhedrin’s ruling governs at the practical layer; the local court’s reasoning governs at the intellectual one; the two layers are maintained separately so that each can per --- orm the  --- unction only it can per --- orm.

Low Modernism James C. Scott named the — ailure mode “high modernism”: the belie —

that complex systems can be

ully legible, optimized, and controlled

rom a single vantage point. High modernist institutions demand uni — ormity because it makes the system readable — rom above. Local variation becomes noise. Loose coupling looks like ine —

iciency

rom the planner’s desk. The coupling is tightened. Scott documented the pattern: Soviet collectivization that destroyed centuries o — agricultural knowledge; Brasília’s geometrically per — ect grid (legible — rom the air, hostile to how people actually move); Chapter 12: The Hardware 211

industrial

orestry that replaced ecosystems with monocultures that thrived until the pathogen arrived. Modern institutions reproduce this pattern at scale. The Basel III uni — ormity described earlier in this chapter produced the same result in — inancial regulation: every institution running the same analysis, — ailing identically, with no alternative methodology preserved in the system. Regulatory uni — ormity had eliminated the redundancy that systems require to survive stress. Common Core set national educational standards: same content, pace, methods, assessments. Educators who understood their communities, who knew which students needed acceleration, who possessed the metis developed through time and proximity—their discretion became the problem the standard addressed. Variation was classi — ied as ine —

iciency. The tightened coupling produced the

ragility it prevented: schools optimizing — or assessment rather than understanding, students whose circumstances had no recognized category. Global supply chains optimized — or just-in-time delivery eliminated slack as waste. Every component arrived exactly when needed, — rom the single cheapest supplier. When Wuhan — actories shut in 2020, the cascade moved globally in weeks. There were no alternatives, no bu —

er inventory. Local disruption became systemic catastrophe because the tight coupling eliminated every absorption mechanism. Louisiana requires hair braiders to complete — i — teen hundred hours o — training (training that excludes braiding) be — ore operating pro — essionally. The rule applies uni — ormly and cannot distinguish practices requiring — ormal instruction — rom those requiring apprenticeship. The bureaucrat cannot make that distinction. The rule is applied. 212 Judgment Proo —

Laboratories o

Democracy Loose coupling does not mean chaos or the absence o — authority. It means what Justice Brandeis meant when he called the states “laboratories o — democracy.”241 I — multiple jurisdictions attempt di —

erent approaches, multiple data points accumulate. Some work better. Some — ail. The aggregate learns which approaches serve the purpose—but only i — jurisdictions maintain genuine discretion, only i — loose coupling prevents — ederal mandates requiring identical implementation regardless o — local conditions. Ostrom called it polycentric governance: multiple centers o —

authority, each with genuine discretion, learning

rom one another. The Swiss alpine commons managing timber and grazing since the thirteenth century were not governed by a single authority but by communities that developed locally appropriate rules, coordinated through shared principles, and maintained autonomy to adapt. Shared principles provided coordination; preserved discretion provided adaptive capacity. Subsidiarity (the principle that decisions should be made at the most local level consistent with e —

ective action) captures the same pre — erence: not because local is always right, but because metis lives locally. The judge who knows the community, the — armer who knows the soil, the teacher who knows the student—their knowledge is not bias to correct but in — ormation that makes rules serve their purpose rather than merely exist. Communities can be wrong. Local majorities can be unjust to minorities. The Foundation layer (physical sa — ety, basic rights) may require central en — orcement because local authority cannot be trusted to provide it. Tight coupling — or physical sa — ety maintains Maimonides’ distinction. The error is tight coupling applied to the Chapter 12: The Hardware 213

intellectual, the developmental, the domain where metis accumulates and wisdom grows. Maimonides built a legal network that ran without a central server — or two thousand years by distinguishing which layers required tight coupling and which required — reedom. The Foundation (practical, social order, physical li — e) required coordination. The Flourishing (intellectual, wisdom, evaluating whether the ruling is correct) required the Protocol o — Dissent: local courts — ree to disagree, minority positions preserved, reasoning stored — or when shinui ha’ittim arrives and consensus proves insu —

icient. The Sa — ety Machine replaced this with its inverse: central implementation control, elimination o — minority approaches, dissent suppressed — or consistency, bureaucrats in the capital rather than judges in the gate, documents recording consensus rather than texts preserving challenge, single answers where the tradition preserved option value. The Three Mile Island operators had two hours and — alse in — ormation. No slack, no space between cause and consequence — or diagnosis. Competent pro — essionals — ailed by an architecture that eliminated the margin where their competence could operate. The Alanya — ishermen meet in a co —

eehouse be — ore every season. Meeting, lottery, arguments about bad locations all take time. The record is handwritten. The agreement binds because participants shaped it, understand it, and see one another’s — aces when its terms are violated. By the Sa — ety Machine’s metrics, the system is ine —

icient. The Alanya — ishermen are still — ishing. The hardware is the architecture enabling Aristotle’s method: loose coupling at the intellectual layer where wisdom develops through preserved disagreement; tight coupling at the practical 214 Judgment Proo —

layer requiring coordination; local implementation by judges possessing the metis centralized planners cannot; preserved dissent as stored option value activating when consensus — ails. The next chapter asks what this hardware looks like when applied to arti — icial intelligence, and what happens when the hardware is absent. Chapter 13: The Silicon Havruta

The technology is already capable o

unctioning as oracle or adversary: as a system that delivers answers, or as a system that challenges the answers we have already produced. Most designers have made their choice, mostly without noticing it. Designers built the oracle.

The Brie

The brie

appeared sound. Properly — ormatted. Case names in Bluebook style. Pinpoint citations with volume numbers and page re — erences. Six cases on point, each summarizing a principle that supported opposing Avianca’s motion to dismiss Steven Schwartz’s client’s complaint. Varghese v. China Southern Airlines, Co., Ltd. Shaboon v. Egyptair. Zicherman v. Korean Air Lines Co. Miller v. United Airlines, Inc. Estate o —

Durden v. KLM Royal Dutch Airlines. Martinez v. Delta Air Lines, Inc. Five o — the six cases did not exist. Schwartz used ChatGPT to research the brie — . The AI produced citations — ormatted with the authority o — a legal database search— plausible names, volumes, holdings, all invented. When the opposing party could not locate the cases, Schwartz submitted an 216 Judgment Proo —

a

idavit explaining he did not know ChatGPT could generate — alse in — ormation. He had asked the system to con — irm the citations were real. The system con — irmed they were. The system was wrong. Schwartz asked ChatGPT: was Varghese v. China Southern Airlines a real case? The system con — irmed it was, a genuine — ederal decision on point. Could it be — ound in Westlaw or LexisNexis? The system assured him it could. Was it sa — e to rely on in a — ederal court submission? The system said yes. At each step, the AI responded to veri — ication questions with con — idence indistinguishable — rom its con — idence about everything else. The inter — ace carried no signal o — uncertainty. The system did not distinguish between what it could veri — y and what it generated by extrapolating patterns. The response to “is this case real?” came

rom the same mechanism that produced the — alse citation: a system optimized to generate plausible text. A plausible con — irmation o — a case looks identical to a plausible description o — one. The inter — ace o —

ered no way to tell the di —

erence. Schwartz did not misuse the tool. He used it exactly as the inter — ace invited, including the veri — ication step that should have been the sa — eguard. Judge P. Kevin Castel o — the Southern District o — New York imposed sanctions in Mata v. Avianca,242 noting the submission “wasted the Court’s and the opponent’s time and resources.” More

undamentally, Schwartz had outsourced a task inseparable — rom his pro — essional obligation. He did not veri — y because the inter — ace did not require it. The inter — ace presented the citations with the same con — idence it would use i — they were real. The inter — ace committed geneivat da’at: the — t o — the mind.243 Not

raud in the ordinary sense, but architectural suppression o — the understanding that would have detected — raud. The AI did not lie Chapter 13: The Silicon Havruta 217

straight

orwardly. The system per — ormed knowledge rather than possessing it. The appearance o — authoritative legal research was indistinguishable — rom authoritative legal research. The sur — ace was everything the inter — ace o —

ered.

The Oracle The Oracle delivers answers. Ask it a question, it responds — luently, con — idently, comprehensively. How it arrived at the response is hidden. The uncertainty is hidden. Fabrications are hidden behind the same sur — ace as accurate in — ormation. The Oracle is designed — or

rictionless output. Success is query satis — action, and the system reports success whether or not it has achieved it. At scale, the Oracle is Schwartz’s inter — ace applied to every pro — essional: the physician accepting di —

erential diagnosis without asking how the algorithm weighted symptoms; the compliance o —

icer approving transactions because the screening tool returned green; the board approving a strategic plan because the — inancial model showed positive numbers. In each case, the pro — essional received output and treated it as judgment. The inter — ace erases the distinction. The havruta interrogates answers. In the Jewish study tradition, havruta is dyadic learning: two students arguing about a text. The partner is not a teacher delivering conclusions but an adversary challenging every interpretation, demanding justi — ication, re — using weak argument. The — riction is pedagogy. The student develops understanding through sustained de — ense against an interlocutor who will not let it pass. The Talmud itsel — is havruta transcribed. Its pages preserve arguments between scholars centuries apart. Arguments appear 218 Judgment Proo —

alongside conclusions. Minority opinions sit next to majority rulings. The tradition understood that knowing an answer without knowing the argument that produced it is not knowing the answer. Applied to AI inter — ace design, havruta produces something

undamentally di —

erent — rom the Oracle. The Oracle says: here is what you need. The havruta says: are you sure? What about this counter-argument? What must your position accept that you haven’t examined? The Oracle removes — riction; the havruta intensi — ies it. The Oracle produces dependency; the havruta produces capacity. Haddaway’s Law names the institutional imperative to prevent hurt without limit, without vocabulary — or what the di —

iculty produces. The Oracle is Haddaway’s Law applied to in — ormation: removing the discom — ort o — legal research (the — riction o —

veri

ication, the cognitive labor o — distinguishing reliable — rom unreliable authority, the liability exposure accompanying reliance on uncon — irmed sources). Schwartz’s brie — showed the di —

iculty was the mechanism. The — riction o — veri — ication was the institutional practice maintaining citation record integrity. Remove the — riction, and you eliminate the process detecting — alse citations. Garry Kasparov discovered this in 2005 in — reestyle chess tournaments244, where human players consult computers during play. The expectation was that the strongest grandmasters augmented by the strongest computers would dominate. The result was di —

erent. Winning teams were not those with the strongest computers but those who learned to use them rightly: not as oracles delivering moves but as challengers interrogating the human’s analysis. The centaur con — iguration (human judgment augmented by machine analysis, each checking the other) outper — ormed both Chapter 13: The Silicon Havruta 219

unaided humans and unaided machines. The augmentation worked because the machine challenged rather than replaced. Every institution deploying AI — aces a clear choice: Oracle or havruta, butler or sparring partner. The same computational power that produces the Oracle can produce the adversary. The technology is not the constraint. The constraint is design: whether the system satis — ies the query or deepens the understanding that makes the query answerable.

Red Teams Lehman Brothers’ board approved leverage ratios o — thirty-one to one and mortgage-backed securities exposure that would prove

atal. The board had risk o —

icers, compliance departments, external auditors. The minutes show no meaning — ul dissent. The consensus was unanimous. The — ailure was not individual incompetence. Irving Janis identi — ied the organizational pathology245 in Bay o — Pigs, the Challenger disaster, and other catastrophic — ailures: cohesive groups suppress dissent, dismiss contradictory evidence, converge on decisions no individual member would endorse independently. Nassim Taleb named the same dynamic — rom another angle: the low-probability, high-impact event that cohesive groups systematically — ail to imagine because imagining it is adversarial work. Cohesive groups optimize — or consensus. Wells Fargo opened approximately three and a hal — million unauthorized accounts between 2011 and 2016 to meet cross-selling targets. The board’s risk committee received reports. Compliance generated — indings. Internal auditors — lagged irregularities. The system produced in — ormation but not challenge: no structural 220 Judgment Proo —

mechanism

orcing the board to con

—

ront whether sales culture was

generating

—

raud at scale. The strategy was pro

—

itable. Pro

—

itable

strategies attract consensus. Consensus suppressed the adversarial

thinking asking what happens when sales incentives produce the

compliance

—

ailures being documented.

The board completed ethics training: techne, procedural

compliance. The board lacked phronesis: judgment perceiving that

the incentive and compliance systems were simultaneously in

operation and incompatible.

Applied to corporate governance, havruta would require boards

to encounter adversarial challenge be

—

ore the vote, not a

—

ter

collapse. An AI system trained on historical data,

—

inancial models,

regulatory

—

indings, and case studies o

—

institutional

—

ailure would

generate the adversarial brie

—

the assumptions the strategy depends on, the historical scenarios in which similar assumptions proved

alse, and the internal data the strategy cannot account — or. The board must articulate why this case di —

ers — rom historical parallels, why contradictory evidence does not undermine the strategy. The articulation is the exercise. Making implicit reasoning explicit, subjecting con — ident assumptions to written de — ense—this is the constitutive — riction developing the board’s capacity to perceive errors be — ore they become catastrophes. The AI — unctions as the zaken mamre o — Chapter Twelve: the minority voice architecturally protected in expressing dissent but not permitted to create practical splits. The board decides. The challenge is preserved in the record. A mandate requiring structured adversarial analysis be — ore approving major strategic decisions need not speci — y technology. It could condition the business judgment rule’s protection: be — ore claiming de — erence, demonstrate that the decision survived Chapter 13: The Silicon Havruta 221

adversarial challenge. The

orm o — challenge (AI-generated, human- generated, or combination) is le — t to board judgment. The requirement is that challenge occurred and the board’s reasoning engaged with it rather than suppressing it.

Bias Audits COMPAS scored de — endants on recidivism using one hundred thirty-seven variables outputting a single number.246 Judges who used the score delegated sentencing determinations to an algorithm whose internal logic was opaque. ProPublica’s analysis showed the tool barely exceeded random chance at predicting recidivism and systematically — avored white de — endants: predicting higher risk — or Black de — endants who did not reo —

end and lower risk — or white de — endants who did. COMPAS is the Oracle applied to criminal sentencing: the machine delivers the answer, the human signs the — orm, the de — endant receives a sentence no one in the courtroom understands or can interrogate. The non-delegable duty—exercising phronesis in response to the particular person be — ore the court—is violated in the name o — consistency. The havruta alternative reverses the sequence. The judge reviews the case — ile (o —

ense, circumstances, de — endant’s history, sentencing purposes), weighs — actors, exercises discretion, and dra — ts a sentence. Be — ore — inalizing, the dra — t is submitted to an AI system trained on the judge’s own sentencing history and comparable courts’ patterns across similar cases. The system generates the adversarial audit: the dra — t sentence is

orty percent longer than the median — or — actually similar cases with similarly situated de — endants. Controlling — or o —

ense severity, prior 222 Judgment Proo —

record, and mitigating circumstances, the remaining variance correlates with race. The system sur — aces the judge’s own prior decisions in similar cases where shorter sentences were imposed, and asks: can the judge articulate why this case is di —

erent? The question — orces sel — -examination. The judge must con — ront that what — elt like phronesis (seasoned judgment about when severity is appropriate) is, in some portion, invisible bias. The judge must articulate the reasoning justi — ying departure — rom her own pattern. The articulation is the exercise: making implicit reasoning explicit is the constitutive — riction that develops, across many cases and audits, the judge’s capacity to recognize and correct her own patterns. Ostrom’s — ourth design principle247 (monitoring by users rather than external authorities) operates here trans — ormed. The AI is the monitor. The judge is the monitored user. The monitoring is adversarial, not supervisory: the system does not override the sentence or impose answers. It challenges the judge to de — end against evidence o — inconsistency. The judge retains authority and responsibility. The judge cannot retain the com — ort o — unexamined intuition. The contrast with COMPAS is architectural, not technical. COMPAS replaces judicial judgment with algorithmic output. The adversarial audit preserves the non-delegable duty by intensi — ying it. The judge must judge. The AI ensures that judging is harder, more sel — -aware, and more accountable.

Adversarial Classrooms A student reads an AI-generated essay on her topic. The prose is

luent. The argument is organized. The examples are plausible. On Chapter 13: The Silicon Havruta 223

the second page, she encounters a claim that stops her. The AI asserted that a legal doctrine emerged — rom a 1998 Supreme Court case. She knows the doctrine predates that case by decades. She checks her sources. She was right. The case does not establish the doctrine; it merely applies it. Reading more care — ully, she — inds three more demonstrably — alse claims. The prose — luency conceals logical

ailure. A domain-expert reader perceives the misalignment between con — ident assertion and unsupported claim. This moment—perceiving that — luent text can be wrong—is what the assignment develops. The student sitting in — ront o —

alse prose that — eels true is where pedagogy begins. Universities — ight the wrong war treating this as a detection problem. Students generate essays; pro — essors deploy detection tools; detection tools produce — alse positives; AI systems evade better; detection tools improve to catch evasion. Neither side asks: what is the essay supposed to develop? I — essay-writing means producing a document, AI has made the assignment obsolete. The machine produces — aster, more — luent, more consistent documents than most students. Banning AI de — ends a process whose product the technology has rendered trivial. I — essay-writing develops capacity to think (organizing evidence, constructing arguments, anticipating objections, distinguishing strong claims — rom weak), AI has not made the assignment obsolete. The technology has trans — ormed its optimal design. The assignment: generate an essay using AI. Evaluate it. Identi — y three weaknesses (logical gaps, unsupported claims, missed counterarguments, — alse premises). Rewrite the weak sections. Submit the original, revision, and a memo explaining what the AI produced, what was wrong, and why the revision is superior. 224 Judgment Proo —

The student exercising judgment at every stage. Evaluation requires critical reading: perceiving  --- luent prose versus sound argument. Identi --- ying weaknesses requires precision: articulating what speci --- ically  --- ails, not just that it  --- eels insu ---

icient. Revision requires constructive skill: producing something better. The memo requires metacognition: explaining evaluative criteria. The AI has not replaced the student’s thinking. The system provided raw material the student’s thinking must process. The machine-generated essay is the weight the student li — ts. The resistance (the gap between what the machine produced and sound scholarship requires) is the curriculum. The calculator analogy is instructive. Schools banning calculators in the 1970s preserved hand long division. Schools integrating calculators raised the ceiling by — reeing cognitive resources — rom mechanical computation — or mathematical reasoning. Schools banning AI will preserve — ive-paragraph essays

rom scratch. Schools integrating AI as havruta will raise the ceiling by — reeing students — rom generating prose — or evaluating, critiquing, and improving arguments. The adversarial classroom extends across disciplines: law students generating brie — s then demolishing them (identi — ying

abricated citations, exposing logical gaps, and dra — ting opposing arguments); medical students generating di —

erential diagnoses then challenging them (identi — ying missed diagnoses, incorrectly weighted symptoms, and rare presentations pattern-matching cannot detect); and business students generating strategic plans then red-teaming them (sur — acing assumptions, historical conditions under which similar assumptions — ailed, and unaccounted market scenarios). Chapter 13: The Silicon Havruta 225

In each case, the AI provides the sparring partner. The student provides judgment. The — riction is the pedagogy.

What the Havruta Requires The three applications (red-teamed board, bias-audited judge, adversarial classroom) share structural logic. Five principles describe this architecture. The human acts — irst. In every havruta application, the human produces judgment be — ore the AI engages: the board dra — ts strategy, the judge dra — ts sentence, the student writes revision. The AI responds to human output. This sequence matters. Acting — irst

orces judgment. Receiving — irst atrophies it. The Oracle dynamic (human’s — irst act is receiving the machine’s answer) is prevented by requiring human output be — ore machine response. The AI challenges rather than con — irms. The adversarial brie — , bias audit, student critique: each — inds weakness rather than a —

irms strength. The havruta partner does not say “your interpretation is excellent” but “your interpretation cannot account

or this counter-text.” The challenge is pedagogy. An AI con — irming user reasoning (like recommendation algorithms) produces the terrarium: com — ortable, rein — orcing, developmentally dead. An AI challenging user reasoning produces the Gymnasium: uncom — ortable, destabilizing, generative. The human retains authority and responsibility. The AI does not vote on strategy, impose sentences, or grade work. The human decides. The AI ensures the decision survived structured challenge. This distinction separates COMPAS (which replaces judgment) — rom the adversarial audit (which intensi — ies it). The 226 Judgment Proo —

non-delegable duty is not trans

erable. Machine challenge rein — orces the duty; delegation to the machine violates it. Friction is calibrated to capacity. Aquinas’s insistence that law must lead to virtue “gradually” is an inter — ace design principle: challenge must match current capacity, increasing as capacity develops. A — irst-year law student needs di —

erent challenges than a tenth-year litigator. A newly appointed judge needs a di —

erent audit than one with twenty years on the bench. The Gymnasium has adjustable resistance. The havruta tradition understood this: partnerships are chosen with care, matching students whose capabilities di —

er enough to generate productive — riction yet remain close enough to sustain engagement. The system preserves the record o — challenge and response. The board’s engagement with the adversarial brie — is documented. The judge’s reasoning in response to the bias audit is recorded. The student’s revision memo is submitted alongside the original. The record enables institutional learning by making patterns visible; enables accountability by demonstrating challenge was con — ronted rather than suppressed; instantiates Maimonides’ principle o — preserved minority opinions. The adversarial challenge, even where the original decision survives, is maintained as the record o — what the decision had to overcome. The challenge becomes institutional memory o — the — riction the system imposed.

Struggle The dominant AI design template is the butler: the algorithm learning pre — erences, predicting desires, eliminating — riction, anticipating needs be — ore articulation. The aesthetic is drawn — rom service literature: the loyal valet whose competence renders the Chapter 13: The Silicon Havruta 227

master’s unnecessary. The Silicon Valley version is the

rictionless experience: an inter — ace optimized — or engagement, a recommendation engine delivering what the user wants without requiring articulation. The butler model works. The user is com — ortable and satis — ied. The user returns. The user’s capacity to — unction without the butler atrophies with each interaction, because the butler absorbs the cognitive work that would have maintained it.248 The glass cockpit isolates pilots — rom — light sensation. The GPS user navigates without

orming the mental map navigation once required. The contract review AI identi — ies risks the junior lawyer never encounters. In each case, — rictionless inter — ace removes the — riction that was the curriculum. The havruta model is the Gymnasium’s operating so — tware. The user is challenged. The user is — orced to articulate reasoning, de — end positions, con — ront weaknesses the user would pre — er not to examine. The user may not return to havruta as eagerly as to butler. The user who does return develops capacities the butler’s user never acquires. The Talmudic — ormulation is unambiguous. Havruta o mituta: study-partnership or death. This is not melodrama. It is a design speci — ication. The mind not encountering structured resistance does not develop strength to stand under pressure. The pro — essional not con — ronting adversarial challenge does not develop the judgment the pro — ession exists to provide. The institution not subjecting decisions to structured critique does not develop capacity to recognize errors be — ore they become catastrophes. The Silicon Havruta is not a concept awaiting technology. The technology exists. The computational power to generate adversarial brie — s, audit sentencing patterns, critique student work, and red- 228 Judgment Proo —

team strategic decisions is a design choice away

rom the current Oracle. The same machine serving as oracle can be recon — igured as adversary using identical capabilities directed toward a di —

erent purpose. The obstacle is not technical. The obstacle is market incentive to build what users want rather than need, to smooth rather than challenge, to relieve rather than cultivate. The Sa — ety Machine’s deepest premise is that institutions exist to eliminate di —

iculty rather than calibrate it. That premise produces institutions that are e —

icient and — ragile, com — ortable and incapable, optimized — or imagined worlds and de — enseless against the actual one. The choice is available now. The Alanya — ishermen made it decades ago249 in commons governance, not AI: choosing the slower, participatory system requiring every member to show up, argue, draw lots, and abide the result. They chose it because sustained practice produced understanding that the — riction o — sel — - governance kept the — ishery alive. The New — oundland cod — ishery received expert management: centralized quotas, scienti — ic harvest models, optimized allocations administered by undisputed authorities. The cod collapsed in 1992 and have not recovered.250 The Alanya — ishermen are still — ishing. The — inal chapter asks what that choice means when the stakes are not a — ishery but a civilization. Chapter 14: Anti-Utopia

Thomas More asked the question

irst, in 1516, using the only method that could answer it without being censored: satire so well concealed that the joke took — our hundred years to be — ully heard. The answer was embedded in the names.

No Place Thomas More was an undersheri —

o — London be — ore he was anything else o — note. More had sat in actual courts, heard actual disputes, watched lawyers argue over what the law required and what the — acts supported and whether the two could be reconciled. More understood the — riction o — real legal practice: the messiness o —

human beings in con

lict, the — ailure o — general rules to produce just outcomes in particular cases, the exhausting and irreplaceable work o — judgment applied to circumstances that the rule-maker did not

oresee. He also understood the temptation to eliminate it. In December 1516, the Louvain press o — Dirk Martens published a slim Latin volume that More had written. A narrator named Raphael Hythloday described, at length and with apparent admiration, an island whose institutions had solved the problems o —

230 Judgment Proo

poverty, crime, and con

lict by engineering human society down to its last detail. The island’s citizens worked six hours a day, dressed in uni — orm clothing, lived in interchangeable houses, ate in communal dining halls, and had no private property. The streets were clean. The — ood supply was secure. The social — riction that produced inequality had been eliminated. The per — ect political order (Maimonides’ tikkun ha-gu — ) had been achieved. More titled the work Libellus vere aureus and gave the island a name: Utopia.251 For readers who could parse Greek, the name was a trap. Ou is the Greek negative pre — ix; topos means place; the su —

ix -ia — orms a toponym. Utopia: No-Place. More had initially considered naming the island Nusquama (the Latin — or “nowhere”) be — ore settling on the Greek derivation. The phonetic trick completed the joke: in early modern pronunciation, ou-topia sounds nearly identical to eu-topia (the Good Place). More added a clari — ying poem, written in the voice o — a — ictional poet, stating that the island deserves to be called Eutopia because o — its — elicity, but remains Utopia by name. The promise is an illusion. By the author’s own encoding, the per — ectly good place is the place that cannot exist. The narrator who describes this island is named Raphael Hythloday. The — irst name is Hebrew: the archangel associated with healing, with the divine messenger who brings cure. The surname is assembled — rom two Greek roots: hythlos, meaning nonsense or idle talk, and daiein, to distribute or to peddle. Raphael Hythloday is the Distributor o — Nonsense. He arrives claiming to carry the medicine that will heal the political diseases o — sixteenth-century Europe. The author has told the reader, in the name itsel — , that the medicine is — abricated. Chapter 14: Anti-Utopia 231

 The capital city o ---  Utopia is Amaurot, derived  --- rom the Greek amauroton (dim, shadowy, vanishing): the Phantom City. The river on whose banks it sits is the Anyder: an plus hydr, the Waterless River. The local magistrates who manage daily li --- e are the Syphogrants, assembled  --- rom sypheos (pigsty) and gerontes (elders): the Pigsty Elders. The prince who rules the whole system is Ademus: a plus demos, the leader without a people. He governs a spreadsheet.
 More was a jurist making a jurisprudential argument in the only register that could say it  --- ully: satirical  --- iction with the joke embedded in the vocabulary, legible only to readers trained in Greek. A society optimized  --- or the elimination o ---  all social  --- riction is not the good place. It is no place. The narrator is a babbler. The capital is a mirage. The river runs dry. The magistrates are swineherds managing livestock. The citizens are provided  --- or and rendered incapable, com --- ortable and diminished,  --- ed and deskilled.
 More saw,  --- rom his position as an undersheri ---

o — London, encoded in his most — amous work: the dream o — the — rictionless society is not wrong because it is too ambitious. It is wrong because it mistakes the conditions o — human li — e. Human beings require

riction to develop. Remove the — riction and you have not elevated them. You have le — t them with nothing to push against, and nothing to push against is nothing to grow — rom. Five hundred years later, the Sa — ety Machine is the Utopian project made institutional. The narrators are consultants and e —

iciency experts and compliance o —

icers who arrive claiming to carry the cure — or the harm that judgment produces. The capital is the phantom city o — per — ect documentation: the — iled report, the checked box, the procedure that was — ollowed, the outcome that cannot be traced to any individual decision because no individual was exercising judgment. The river runs dry. The pro — essionals who 232 Judgment Proo —

inhabit it are credentialed, trained, and increasingly hollow: capable o — per — orming the procedure, unable to recognize when the procedure is wrong.

The Trees In September 1991, eight researchers sealed themselves inside a three-acre glass structure in the Arizona desert. Biosphere Two was the most ambitious terrarium ever built: — ive interconnected ecosystems, each enclosed within two hundred thousand cubic meters o — sealed glass and steel. The designers intended it as a proo —

o

concept — or sel — -sustaining colonies beyond Earth: a demonstration that human beings could engineer a closed system so thoroughly controlled that every variable was accounted — or. Within seventeen months, the oxygen had dropped — rom Earth- normal levels to the equivalent o — living at thirteen thousand — eet. The crew grew sluggish. Simple tasks became exhausting. The engineers eventually broke the seal and pumped in outside air, because the system designed to sustain human li — e was slowly su —

ocating its inhabitants. The problem was the soil. The designers had chosen richly organic soil because it would support vigorous plant growth and the plants would produce oxygen and the cycle would be sel — -sustaining. Microbes in the soil, however, consumed oxygen — aster than the plants could produce it. In an open system, this imbalance is corrected by the vast atmospheric reservoir. In a closed system, it was lethal. The very richness that was supposed to sustain li — e became the mechanism o — su —

ocation. The trees were a separate story. They grew rapidly, — aster than trees in the wild. The conditions were ideal: regulated temperature, Chapter 14: Anti-Utopia 233

iltered light, enriched soil, ample water. Everything that could be optimized had been optimized. The trees grew tall and then — ell over be — ore reaching maturity. Scientists investigating the — ailures discovered what was missing: stress wood.252 The denser — iber — orms in response to mechanical pressure. In nature, wind bends trees; bending triggers stress wood, which drives roots deeper and allows the mature tree to support its own weight. From the perspective o — a growth optimizer, wind looks like pure — riction. The Biosphere Two engineers had eliminated it. Ivan Illich had already named the distinction in Tools — or Conviviality: a bicycle ampli — ies what the rider can do and demands the rider develop skill; a conveyor belt moves the worker toward its destination, building no capacity in the worker at all. Biosphere Two was a conveyor belt enclosed in glass. The organisms inside it were managed, provided — or, and protected — rom every identi — iable risk. The provision was total. The dependency was total. When the system proved inadequate, the organisms had no capacity to adapt, because the conditions that would have developed that capacity had been eliminated. The trees had been given everything except the resistance that would have made them strong enough to use what they had been given. They grew quickly and collapsed under their own weight.

Finite and In

inite Games In 1986, James Carse published a short book253 that took a single distinction seriously: there are two kinds o — games. A — inite game is played to be won. It has — ixed rules, clear boundaries, a de — inite end. The point is to reach a terminal state in which one player has 234 Judgment Proo —

prevailed and the game is over. A lawsuit is a

inite game. A surgical procedure is a — inite game. The institutional quest to eliminate all risk is a — inite game, played to reach a — inal state where all hazards have been controlled, all uncertainties resolved, all problems de — initively solved. An in — inite game is played to keep playing. Rules change to prevent any player — rom winning permanently. Boundaries shi — t to include new participants. It extends without a terminus, because the point is the ongoing engagement rather than any terminal outcome. Education, pursued honestly, is an in — inite game. Democracy,

unctioning properly, is an in — inite game. The development o —

human judgment is an in

inite game. There is no — inal state o —

per

ect wisdom, only the ongoing practice o — becoming wiser, encountering situations that resist the categories the previous situation established, developing the capacity to respond. The practitioner who stops practicing is not — inished; she is stopped. Carse observed that — inite games, played within an in — inite game, are healthy. A surgeon plays to win this operation. A judge plays to decide this case justly. The — inite game develops the capacities that the in — inite game requires: skill, judgment, the ability to read a situation and respond. The — inite game becomes catastrophic when it consumes the in — inite game; when the player plays to win so permanently that no — urther play is possible. The Sa — ety Machine is a — inite game that has consumed the in — inite game. It seeks a terminal state: zero accidents, zero errors, zero uncertainty. The system treats law as a problem to be solved, pro — essional judgment as a source o — error to be eliminated, the development o — human capacity as an ine —

iciency to be optimized away. When it succeeds (when the MCAS so — tware manages the pitch so smoothly that pilots stop learning aeronautical judgment, Chapter 14: Anti-Utopia 235

when the sentencing algorithm computes the recidivism score so e —

iciently that judges stop exercising discretion, when the AI generates the brie — so — luently that lawyers stop veri — ying legal authority), it has played to end the game. Alasdair MacIntyre, writing — ive years be — ore Carse, provided the vocabulary — or what this elimination destroys.254 In A — ter Virtue, MacIntyre distinguished between practices (activities whose internal goods can only be achieved through participation) and institutions, which secure the external goods that sustain practices. Medicine is a practice. The physician who diagnoses a di —

icult case develops diagnostic acumen through the encounter itsel — . That capacity is an internal good; it accrues to the practitioner as a consequence o — the practice and cannot be obtained any other way. The hospital is an institution. It provides the — acility, the credentialing, the — unding that makes the practice possible. Institutions and practices exist in permanent tension. The institutional logic o — e —

iciency, standardization, and measurable output continuously threatens the practice’s internal goods, which are inherently resistant to standardization. The Sa — ety Machine resolves this tension by eliminating the practice. The physician retains the credential and the salary; the diagnostic judgment atrophies. The lawyer retains the bar membership and the billable hour; the legal reasoning deteriorates. The external goods o — the institution survive. The internal goods o — the practice are consumed. MacIntyre’s — ramework explains the non-delegable duty that

ederal courts have articulated: pro — essional activities whose delegation destroys the internal good the activity produces. Judge Castel held that citation veri — ication cannot be delegated to an AI because the delegation eliminates the internal good the activity was 236 Judgment Proo —

supposed to produce: the lawyer’s capacity to distinguish sound legal reasoning — rom — abrication. Veri — ication o — legal authority is an internal good o — legal practice. Delegate it and the good vanishes, because the good exists only in its exercise.

What Judgment Is For Hannah Arendt identi — ied the condition o — human existence that the Sa — ety Machine has not absorbed:255 natality, the capacity to begin something new, to act in ways that are unprecedented, to introduce into the world something that has never existed be — ore. Every human being who enters the world is a new beginning. The capacity

or action ( — or initiating the unexpected) distinguishes human li — e

rom biological process and social behavior. Arendt distinguished three — undamental human activities: labor sustains biological li — e (eating, maintaining the body, the cyclical work o — survival); work — abricates the durable world o — objects and institutions (buildings, tools, legal codes, the arti — acts that outlast individual lives); action introduces the new ( — ounding a republic,

orgiving an injury, beginning a — riendship, rendering a judgment that changes how a community understands itsel — ). Labor is necessary. Work is important. Action is distinctively human. A world in which the durable institutions — unction smoothly, biological needs are met, but no one acts (no one begins anything new, no one exercises judgment in situations whose outcomes are uncertain) is a world that has eliminated the condition o — human existence itsel — . Inhabitants are alive in the biological sense and absent in the political sense. They consume. They produce. They comply. They do not act. Chapter 14: Anti-Utopia 237

 The Sa --- ety Machine, read through Arendt’s  --- ramework, is a project  --- or eliminating action. Each optimization that removes human judgment  --- rom a decision-making process eliminates a site where action was possible. Each algorithm that replaces discretion with computation closes a space where a human being could have introduced something unprecedented: a merci --- ul sentence, an innovative interpretation, a creative solution to a problem the system’s designers did not anticipate. The justi --- ication is always e ---

iciency, consistency, and reliability. These values are accurate on their own terms. The terms are inadequate because they measure only what the Sa — ety Machine values and ignore the activity that makes institutions worth inhabiting. Arendt called the public realm (the shared space in which action becomes possible because others are present to witness and respond) the space o — appearance. The co —

eehouse in Alanya is a space o —

appearance: the

ishermen gather, deliberate, argue, and reach agreements that bind because the participants exercised practical discernment in one another’s presence. The courtroom, when the judge exercises discretion rather than applying an algorithm, is a space o — appearance. The classroom, when the student con — ronts a genuine intellectual challenge, is a space o — appearance. Algorithmization closes these spaces. The sentencing guideline replaces the courtroom’s exercise o — judgment. The automated curriculum replaces the classroom’s intellectual — riction. Each closure is a small e —

iciency gain. The cumulative e —

ect is the elimination o — the public realm itsel — . Hans Jonas added the temporal dimension that completes the analysis.256 In The Imperative o — Responsibility, Jonas argued that the generation that possesses trans — ormative technological power bears an obligation to — uture generations that no previous generation has 238 Judgment Proo —

borne. The institution that automates judgment harms every subsequent generation, which inherits an architecture that no longer develops the capacities the architecture was designed to sustain. The chain is long and — ragile. A single generation that replaces the practice with automation (that substitutes the algorithm — or the co —

eehouse, that eliminates the — riction that maintains the capacity) severs the chain — or every generation that

ollows. Amartya Sen reached a compatible conclusion — rom development economics: development must be measured by the expansion o — human capabilities rather than by the accumulation o —

material goods.257 Ivan Illich arrived at the same destination

rom a di —

erent direction, distinguishing between convivial tools that enhance autonomous capacity and manipulative tools that substitute managed dependency — or independent action.258 What Arendt called the elimination o — the space o — appearance and Jonas called the severing o — intergenerational capacity transmission are one problem described — rom complementary angles: the optimization o — material conditions, pursued without regard — or the human capacities that make material conditions meaning — ul, produces a world that is richer, sa — er, more e —

icient, and less human. Inhabitants have been provided — or so thoroughly that they have ceased to — unction as agents.

The Choice That Isn’t One More’s Utopia is a trap. The per — ectly good place is no place because human beings cannot be human in it. The conditions that the Utopian state has eliminated are the conditions that human development requires. The citizens o — Utopia are — ed, housed, Chapter 14: Anti-Utopia 239

employed, and protected. They are also denied the commerce that requires discernment about value, the — ashion that requires judgment about identity, the private property that requires deliberation about priority and obligation, the political con — lict that requires judgment about justice. They have been given everything except the resistance that would have made them capable o — using what they received. The Anti-Utopia is not a di —

erent island. It is not a better design

or the same project. The Anti-Utopia is the recognition that the project itsel — is misconceived: an institution designed to eliminate all — riction cannot be a home — or human beings, because human beings require — riction to develop, and development is not a luxury that can be de — erred until the — riction has been removed. The Anti-Utopia is Hythloday’s — ailure to understand what he is describing. He praises the communal dining halls and does not notice that they are a management technique — or removing — rom citizens the daily practice o — deciding what to eat, when to eat, how to provide — or themselves and one another. He praises the uni — orm clothing and does not notice that it is a management technique — or removing — rom citizens the daily practice o — presenting themselves to the world and reading its responses. He praises the population management system that relocates citizens — rom city to city to maintain demographic equilibrium and does not notice that it is a management technique — or removing — rom citizens the experience o — belonging to a place and being accountable to it. He has described a civilization o — Hollow Pro — essionals: credentialed, maintained, and

undamentally incapable, and called it per — ect. The Anti-Utopia is achievable. The system does not promise the elimination o — su —

ering or the guarantee o — good outcomes. The system promises the conditions under which di —

iculty can be borne 240 Judgment Proo —

and capacities can be developed: that is, the conditions under which human beings can be human. The Gymnasium. The co —

eehouse. The courtroom where the judge must see the de — endant. The classroom where the student must de — end the argument. The board meeting where the strategy must survive the challenge. These are not luxury — eatures o — well- — unctioning institutions. They are how institutions develop the capacities that make them — unction. Calibrated resistance is the operative principle. The Gymnasium has walls. The havruta partnership has structure. Ostrom’s commons have rules. The institutional architecture that develops human capacity is bounded, organized, and deliberate. It accepts the speci — ic

rictions that build strength. It excludes the catastrophic — orces that destroy it. Aquinas’s “gradually” is the design speci — ication: challenge matched to developing capacity, increasing as the agent grows stronger, building the institutional equivalent o — stress wood. The Utopian project eliminates the wind. The Anti-Utopia requires it.

What Sa

ety Actually Requires Return to Boeing. The 737 MAX certi — ication was the Sa — ety Machine’s most complete expression: documentation that was thorough, processes that were — ollowed, delegations that were made according to established procedure, and an aircra — t that killed 346 people in the gap between what the paperwork certi — ied and what the aircra — t did. What would the certi — ication process have looked like i — designed on Gymnasium principles rather than Utopian ones? Begin with Ostrom’s — irst design principle: clearly de — ined boundaries, with the people who bear the consequences o — the resource’s management participating in its governance. Under the Chapter 14: Anti-Utopia 241

ODA structure, Boeing employees per

ormed certi — ication work on behal — o — the FAA. The manu — acturer certi — ied its own product. Flight crews and passengers—the people who bore the consequences o — certi — ication — ailure—had no representation in the process. Gymnasium certi — ication would require that the people who — ly the aircra — t participate in evaluating its sa — ety claims (not as commenters on a published standard, but as practitioners whose situated knowledge o — the aircra — t’s behavior in operational conditions is treated as evidence o — equal standing with engineering analysis). When an experienced line pilot reports that an aircra — t handles di —

erently — rom its predecessor in a particular — light regime, that report should trigger the same level o —

ormal review as an engineering change order, because the pilot’s knowledge o — how the aircra — t actually behaves is precisely the kind o — dispersed, tacit, operationally speci — ic knowledge that centralized analysis systematically misses. Apply the second principle: proportional equivalence between bene — its and costs. Under the existing architecture, Boeing captured the commercial bene — it o — maintaining the 737 type rating (airlines could transition pilots without simulator training) while the cost o —

that decision was distributed to

light crews who were not trained

or the — ailure modes the decision created. Gymnasium certi — ication would require that the entity claiming the commercial bene — it o — a sa — ety-relevant design decision bear a proportional share o — the cost i — the decision proves wrong. Structurally, the decision to classi — y MCAS as a minor modi — ication o — the speed trim system, which reduced certi — ication scrutiny, should have carried mandatory consequences — or Boeing i — the classi — ication later proved inadequate. The existing architecture rewarded Boeing — or 242 Judgment Proo —

minimizing scrutiny and imposed no cost until 346 people were dead. Apply the principle o — loose coupling at the oversight layer and tight coupling at the sa — ety-critical layer (the Maimonidean protocol that Chapter 12 described). Under the ODA structure, the coupling ran in the wrong direction. The oversight layer was tightly coupled: a single delegated authority, Boeing’s own engineers, per — ormed certi — ication — unctions that the FAA could not independently veri — y. The sa — ety-critical layer was loosely coupled: MCAS relied on a single angle-o — -attack sensor, with no cross-check, no redundancy, and no mechanism — or detecting the speci — ic — ailure that would kill. Gymnasium certi — ication inverts this architecture. The oversight layer is loosely coupled: multiple independent entities (the manu — acturer’s engineers, the regulator’s specialists, and a designated panel o — operational practitioners) each per — orm independent sa — ety assessments, and disagreement among them triggers mandatory escalation rather than resolution by the party with the strongest commercial interest in the outcome. The sa — ety- critical layer is tightly coupled: — light-critical systems require redundant sensor inputs, cross-checked by independent logic, with no single point o —

ailure capable o — commanding any uncommanded aircra — t movement. Apply determinatio (the principle that those acting in particular circumstances speci — y the particulars). Under the existing architecture, Boeing speci — ied the training requirements — or its own aircra — t. The determination that MAX pilots needed no simulator training was made by the entity whose commercial model depended on that determination being — avorable. Gymnasium certi — ication applies determinatio to the people closest to the operational reality: the chie — pilots and training captains at the airlines that will — ly the Chapter 14: Anti-Utopia 243

aircra

t determine, based on their experience with the aircra — t’s handling characteristics, what training their pilots need. Their determination is not advisory. The determination is binding, because they possess the situated knowledge o — what their pilots can and cannot handle (knowledge that Boeing’s engineers, however technically sophisticated, do not have and cannot acquire — rom engineering data alone). None o — this is exotic. Each element (practitioner participation, proportional accountability, redundant independent oversight, and local determination o — training requirements) exists somewhere in aviation regulation already. What does not exist is the architecture that combines them into a coherent design. The Gymnasium is that architecture. The system does not promise zero accidents. The system promises that the people who bear the consequences o — sa — ety decisions participate in making them, that the institution cannot certi — y its own product without independent challenge, and that the knowledge dispersed across the people who actually — ly the aircra — t is treated as irreplaceable rather than redundant. The trees in this architecture grow more slowly. They develop stress wood. They can stand in the wind.

Don’t Hurt Me? The book began with a song. Haddaway’s “What Is Love” captured the institutional logic o — the preceding century in — our words: don’t hurt me, no more. For thirteen chapters, the analysis has traced what that prayer produced: institutions designed to eliminate hurt that eliminated the judgment allowing human beings to endure a world that will hurt them regardless. The aspiration was protection. The achievement was dependency. 244 Judgment Proo —

 The Alanya  --- ishermen o ---

er a — inal image. They govern their own commons, gathering in a co —

eehouse each season to argue, draw lots, and commit to a rotation schedule that ensures every

isherman can make a living without depleting the resource. The institution requires their exercise o — judgment. Every year, the capacity is renewed. The New — oundland cod — ishery received expert management, centralized quotas, scienti — ic harvest models, optimized allocations. The cod collapsed in 1992 and have not recovered.259 The Alanya — ishermen are still — ishing, because they built institutions around the — riction that develops human capacity rather than trying to eliminate it. This is what More encoded in the etymology. Amaurot (the Phantom City) is the institution that has removed the need — or judgment — rom its citizens. The Anyder (the Waterless River) — lows without — riction, carries nothing, carves nothing. The Syphogrants (the Pigsty Elders) manage a population stripped o — the capacity to manage itsel — . The capital is a phantom because a society without

riction is a society without development. Haddaway’s Law is the mechanism this book has named: the institutional quest to eliminate all possibility o — harm produces a di —

erent, deeper harm—the elimination o — the capacity — or judgment itsel — . The Gymnasium is the design decision to require judgment rather than eliminate it. Aristotle’s insight that judgment develops through practice. Maimonides’ architecture preserving diversity within unity. Aquinas’s principle calibrating institutional demands to developing capacities. Ostrom’s proo — that communities organized on these principles outlast all alternatives. The trees in the Gymnasium grow more slowly. They develop stress wood. They can stand in the wind. Chapter 14: Anti-Utopia 245

 The wind is still blowing. It has always been blowing. The question the preceding  --- ourteen chapters have been building toward is not whether to eliminate it. The question is whether we will build institutions that teach people to stand in it, or whether we will continue building better terrariums, wondering why the trees keep

alling down. Notes and Re — erences

1 See Benjamin N. Cardozo, The Nature o — the Judicial Process 10–12, 167–73 (1921) (describing the trained instinct, social intuition, and accumulated practical experience that experienced jurists bring to legal reasoning; what he characterized as “the deposit o — the ages,” re — ined by practice into a — orm o — wisdom that resists

ull articulation). 2 Ronald H. Coase, The Problem o — Social Cost, 3 J.L. & Econ. 1 (1960). Coase’s normative in — erence (that institutional design should aim to minimize transaction costs) is a migration — rom the paper’s descriptive argument. Whether Coase himsel — endorsed the prescriptive reading in its strongest — orm has been debated; his later work suggests a more quali — ied view o — the relationship between transaction costs and institutional design. See Ronald H. Coase, The Firm, the Market, and the Law 157–85 (1988). 3 The shell company scenario is a composite illustration o — a documented pattern in anti-money laundering compliance. See FinCEN, National Money Laundering Risk Assessment 12–18 (2022) (describing the use o — legal entities to obscure bene — icial ownership); see also LexisNexis Risk Solutions, True Cost o — Financial Crime Compliance Study: Global Edition 4–7 (2022) (documenting global compliance expenditure o — $274 billion annually, the majority o — which does not prevent the sophisticated actors compliance — rameworks are ostensibly designed to detect). 4 See Natalie Kitroe —

& David Gelles, Be — ore Deadly Crashes, Boeing Reportedly Pushed Back on Sa — ety Regulator, N.Y. Times (Mar. 20, 2019) (discussing competitive market dynamics motivating the 737 MAX program). 5 The aerodynamic consequences o — engine repositioning are described in Boeing’s own Maneuvering Characteristics Augmentation System Aircra — t Flight Manual Bulletin, Boeing Document D6-82166, as well as in the investigations by the Joint Authorities Technical Review (see JATR Report to the FAA Administrator, Oct. 11, 2019) and the House Transportation Committee Sta —

Notes and Re

erences 247

Report (see H. Comm. on Transp. & In

rastructure, Final Committee Report: The Design, Development, and Certi — ication o — the Boeing 737 MAX 13–52 (Sept. 2020)). 6 See H. Comm. on Transp. & In — rastructure, supra note 4, at 53–70 (describing MCAS development, single-sensor reliance, and the characterization as a minor modi — ication o — existing speed trim — unctionality). 7 See FAA, Aircra — t Certi — ication Process Review and Re — orm Aviation Rulemaking Committee Final Report 10–15 (Oct. 2019) (describing the ODA — ramework and the extent o — Boeing’s delegated authority). 8 See id. at 10 (estimating the delegation rate). The delegated certi — ication structure and its implications — or the 737 MAX program are the central subject o — the House Committee investigation. See generally H. Comm. on Transp. & In — rastructure, supra note 4. 9 Nat’l Transp. Sa — ety Bd., Aircra — t Accident Report: Lion Air Flight 610, NTSB/AAR- 22/02 (2022). 10 Ethiopian Accident Investigation Bureau, Aircra — t Accident Investigation Preliminary Report, Ethiopian Airlines, Boeing 737-8 (MAX), ET-AVJ, ET-302 (Mar. 2019); Final Investigation Report: Ethiopian Airlines Group, Boeing 737-8 (MAX), ET- AVJ, ET-302 (Dec. 2022). 11 The total — atality — igure o — 346 is derived — rom the combination o — 189 on Lion Air 610 and 157 on Ethiopian 302. See National Transportation Sa — ety Board, supra note 8; Ethiopian Accident Investigation Bureau, supra note 9. 12 Moses Maimonides, The Guide — or the Perplexed pt. III, ch. 27 (Shlomo Pines trans., Univ. o — Chicago Press 1963) (c. 1190). Chapter 27 sets out Maimonides’ account o — law’s two purposes: tikkun ha-gu — (the wel — are o — the body: physical security, property, and the material conditions o — social existence) and tikkun ha- ne — esh (the wel — are o — the soul: the cultivation o — correct belie — s, practical wisdom, and the moral capacities that require exercise to develop). Maimonides is explicit that the — irst purpose is prior in time but secondary in rank: it exists to create the stable conditions under which the second purpose becomes possible. Critically, he argues that the per — ection o — the soul cannot be legislated directly. Law can only create the institutional conditions that make its development possible; coercion produces compliance, not wisdom. 13 Thomas Aquinas, Summa Theologica I-II, Q. 96, art. 2, ad 2 (Fathers o — the English Dominican Province trans., 1920) (1274) (“the purpose o — human law is to lead men to virtue, not suddenly, but gradually”). 14 Aristotle, Nicomachean Ethics bk. VI, ch. 4–5, 1140a1–1140b30 (W.D. Ross trans., rev. J.O. Urmson) (c. 350 B.C.E.) (distinguishing technē as productive knowledge

rom phronēsis as practical wisdom). 15 See Roger Lowenstein, When Genius Failed: The Rise and Fall o — Long-Term Capital Management 145–60 (2000); see also Ben S. Bernanke, Chairman, Fed. Reserve, The Financial Crisis and Community Banking (Apr. 9, 2010) (describing the systemic

ailure o — risk-management — rameworks in the 2008 crisis). 248 Judgment Proo —

16 See Mata v. Avianca, Inc., No. 22-cv-1461, 2023 WL 4114965 (S.D.N.Y. June 22, 2023) (imposing sanctions on attorneys who submitted AI-generated citations to nonexistent cases). 17 Aristotle, Nicomachean Ethics bk. X, ch. 9, 1180a18–22 (noting that legislators make citizens good by — orming habits in them). 18 Thomas Aquinas, Summa Theologica I-II, Q. 95, art. 2 (1274) (discussing determinatio as the process by which general principles o — natural law are particularized by human law in ways that cannot be derived by logical necessity but require judgment about circumstances). See also John Finnis, Natural Law and Natural Rights 281–90 (1980) (explicating Aquinas’s concept o — determinatio and its implications — or the limits o — legal speci — ication). 19 Maimonides, supra note 11 (arguing that the per — ection o — the soul cannot be legislated directly because coercion produces compliance, not wisdom). 20 The estimate that the Thirty Years’ War killed approximately one-third o — the German-speaking population is derived — rom a consensus o — demographic historians, though precise — igures remain contested. See Geo —

rey Parker, The Thirty Years’ War 166–70 (2d ed. 1997); Peter H. Wilson, The Thirty Years War: Europe’s Tragedy 786–88 (2009). 21 Hugo Grotius, De Jure Belli ac Pacis Proleg. ¶¶ 6, 11 (Francis W. Kelsey trans., Clarendon Press 1925) (1625) (grounding natural law in appetitus societatis and deploying the etiamsi daremus hypothesis to secularize its — oundation). 22 Thomas Hobbes, Leviathan ch. 11 (Richard Tuck ed., Cambridge Univ. Press 1991) (1651) (“there is no such Finis Ultimus (utmost aim) nor Summum Bonum (greatest good) as is spoken o — in the books o — the old moral philosophers”). 23 John Locke, A Letter Concerning Toleration 26–35 (James Tully ed., Hackett Publ’g Co. 1983) (1689) (drawing a strict line between civil interests and the care o — souls, and arguing that coercion in matters o — conscience is both impermissible and, in any event, ine —

ective). 24 John Stuart Mill, On Liberty 13 (Gertrude Himmel — arb ed., Penguin Books 1974) (1859) (“The only purpose — or which power can be right — ully exercised over any member o — a civilized community, against his will, is to prevent harm to others.”). 25 Frank H. Knight, Risk, Uncertainty and Pro — it 197–225 (Hart, Scha —

ner & Marx ed., 1921) (distinguishing “risk,” where the probability distribution governing outcomes is known or estimable, — rom “uncertainty,” where no such distribution is available because the situation is genuinely novel or structurally unprecedented). 26 See Nassim Nicholas Taleb, The Black Swan: The Impact o — the Highly Improbable 225–52 (2007) (analyzing the Ludic Fallacy: the systematic error o — treating the complex world as though it were a game with — ixed rules and a known probability distribution, and its institutional consequences). 27 Lowenstein, supra note 14, at 234 (“The pro — essors had con — used the measurable with the manageable.”). Notes and Re — erences 249

28 Administrative Procedure Act, 5 U.S.C. §§ 551–559 (originally enacted as Pub. L. 79-404, 60 Stat. 237 (1946)). 29 See Ethyl Corp. v. EPA, 541 F.2d 1 (D.C. Cir. 1976) (en banc); Vermont Yankee Nuclear Power Corp. v. NRDC, 435 U.S. 519 (1978); Motor Vehicle M — rs. Ass’n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29 (1983). The emergence and content o — the Hard Look doctrine are extensively analyzed in Richard J. Pierce Jr., Sidney A. Shapiro & Paul R. Verkuil, Administrative Law and Process §§ 7.4–7.5 (6th ed. 2014). 30 See Clyde Wayne Crews, Ten Thousand Commandments: An Annual Snapshot o —

the Federal Regulatory State 18–24 (2023) (quanti

ying “regulatory dark matter” (guidance documents, Dear Colleague letters, in — ormal agency communications) that carry practical regulatory — orce outside APA notice-and-comment procedures); Robert A. Anthony, “Interpretive” Rules, “Legislative” Rules and “Spurious” Rules, 8 Admin. L.J. Am. U. 1 (1994) (analyzing the doctrinal instability o — the binding/non-binding distinction in agency guidance). 31 Steven M. Teles, Kludgeocracy in America, 15 Nat’l A —

. 97 (2013). 32 See Michael Polanyi, The Tacit Dimension 3–25 (1966) (arguing that “we can know more than we can tell”: that signi — icant categories o — human knowledge are embodied and contextual and cannot be articulated in propositional — orm without

undamental distortion). 33 Roger Lowenstein, When Genius Failed: The Rise and Fall o — Long-Term Capital Management 155–60, 204–07 (2000). The opening scene draws on Lowenstein’s reconstruction o — the August and September 1998 collapse. McDonough convened the consortium meeting at the Federal Reserve Bank o — New York on September 23, 1998. Id. at 205. The — und’s total losses between May and the end o — September 1998 reached approximately $4.6 billion; losses — rom August 21 through the end o — September alone totaled roughly $4.4 billion. Id. at 207. 34 Id. at 234–35. Lowenstein’s diagnosis is that LTCM’s principals con — used their models’ utility as analytical tools with the models’ — idelity as descriptions o — reality: a distinction Knight had drawn in 1921 and which the — und’s — ounders had every reason to know. 35 Frank H. Knight, Risk, Uncertainty and Pro — it (1921). The text originated as Knight’s 1916 Cornell doctoral dissertation, submitted and revised under the supervision o — Alvin Johnson and subsequently published by Houghton Mi —

lin. For an intellectual history o — Knight’s in — luence on the Chicago School, see Ross B. Emmett, Frank Knight and the Chicago School in American Economics (2009). 36 Knight, supra note 3, at 233. Knight’s argument was that pro — it (in the economic sense o — returns above the competitive equilibrium) cannot exist in a world o —

pure risk, because the calculability o

risk enables competition to arbitrage it away. Only genuine uncertainty, which cannot be arbitraged because it cannot be calculated, creates space — or the exceptional returns that entrepreneurship generates. 250 Judgment Proo —

37 Eugene F. Fama, E —

icient Capital Markets: A Review o — Theory and Empirical Work, 25 J. Fin. 383 (1970). For Fama’s own assessment o — the hypothesis’s evolution, see Eugene F. Fama, E —

icient Capital Markets: II, 46 J. Fin. 1575 (1991). Fama received the Nobel Memorial Prize in Economic Sciences in 2013, shared with Lars Peter Hansen and Robert Shiller (the latter o — whom had spent much o —

his career documenting systematic anomalies in the e

icient market predictions). The committee’s decision to award the prize jointly to Fama and Shiller was widely interpreted as a comment on the state o — the debate. 38 Basel Committee on Banking Supervision, International Convergence o — Capital Measurement and Capital Standards: A Revised Framework (June 2004) [hereina — ter Basel II]. The incorporation o — internal VaR models — or market risk capital requirements had begun in the 1996 Market Risk Amendment to the original Basel Accord; Basel II systematized and expanded this regime. 39 Nassim Nicholas Taleb, The Black Swan: The Impact o — the Highly Improbable 127- 31 (2007). The “Ludic Fallacy” chapter argues that — ormal models derived — rom structured games (lotteries, dice, roulette wheels) are systematically misapplied to domains characterized by open-ended, evolving structures: domains more analogous to ecological systems than to casinos. 40 Id. at 225-41. Taleb draws on the mathematical literature on — at-tailed distributions, including Mandelbrot’s earlier work on the — ractal geometry o —

inancial markets. See Benoit Mandelbrot & Richard L. Hudson, The (Mis)Behavior o — Markets: A Fractal View o — Financial Turbulence (2004). 41 Taleb, supra note 7, at 40-41. The Turkey Problem is Taleb’s re — ormulation o —

the classic problem o

induction as applied to risk management. See also Bertrand Russell, The Problems o — Philosophy 63 (1912) (the “inductivist turkey” — ormulation attributed to the English domestic — owl). 42 For a contemporaneous account o — how VaR models per — ormed in 2008, see Til Schuermann, What Do We Know About Loss Given De — ault?, in Credit Risk: Models and Management (David Shimko ed., 2004); and — or the post-mortem analysis, Pablo Triana, The Number That Killed Us: A Story o — Modern Banking, Flawed Mathematics, and a Big Financial Crisis (2011). 43 Nassim Nicholas Taleb, Anti — ragile: Things That Gain — rom Disorder 3-18 (2012). Taleb’s tripartite taxonomy is presented in the opening chapter. The biological literature on hormesis is surveyed in Edward Calabrese & Linda Baldwin, Hormesis: The Dose-Response Revolution, 43 Ann. Rev. Pharmacology & Toxicology 175 (2003). 44 Taleb, supra note 11, at 304-05. The Lindy E —

ect was — irst articulated in a 1964 New Republic essay by Albert Goldman about Broadway comedians, and was subsequently developed into a general principle by Mandelbrot and, extensively, by Taleb. For Taleb’s mathematical treatment, see Nassim Nicholas Taleb, Silent Risk: Lectures on Fat Tails (2015) (working paper, available at

ooledbyrandomness.com). Notes and Re — erences 251

45 The seminal study documenting the limits o — clinical dangerousness predictions is John Monahan, Predicting Violent Behavior: An Assessment o — Clinical Techniques (1981), which — ound that mental health pro — essionals accurately predicted violent behavior in only about one in three cases: a — alse positive rate that prompted the turn toward actuarial instruments. For sentencing disparity, see Marvin Frankel, Criminal Sentences: Law Without Order (1972), which directly inspired the — ederal sentencing guidelines movement. See also Alan Dershowitz, Fair and Certain Punishment: Report o — the Twentieth Century Fund Task Force on Criminal Sentencing (1976). 46 The — oundational studies on anchoring in legal contexts include Birte Englich, Thomas Mussweiler & Fritz Strack, Playing Dice with Criminal Sentences: The In — luence o — Irrelevant Anchors on Experts’ Judicial Decision Making, 32 Personality & Soc. Psychol. Bull. 188 (2006). For the in — luence o — extralegal — actors on sentencing generally, see Cassia Spohn, How Do Judges Decide? The Search — or Fairness and Justice in Punishment (3d ed. 2018). 47 The “hungry judge e —

ect” (the — inding that Israeli parole board decisions were signi — icantly more — avorable early in judicial sessions and immediately a — ter — ood breaks) was documented in Shai Danziger, Jonathan Levav & Liora Avnaim- Pesso, Extraneous Factors in Judicial Decisions, 108 Proc. Nat’l Acad. Sci. 6889 (2011). The — inding has been contested on methodological grounds, but the underlying phenomenon (that decision-making quality degrades under conditions o —

cognitive depletion) is robustly documented across multiple disciplines. 48 Julia Angwin, Je —

Larson, Surya Mattu & Lauren Kirchner, Machine Bias, ProPublica (May 23, 2016). The investigation examined 7,214 de — endants arrested in Broward County, Florida, in 2013 and 2014, and compared their COMPAS risk scores against their actual two-year recidivism rates. The — alse positive rate — or violent recidivism was 44.9 percent — or Black de — endants and 23.5 percent — or white de — endants. Id. For the company’s response, see William Dieterich, Christina Mendoza & Tim Brennan, COMPAS Risk Scales: Demonstrating Accuracy Equity and Predictive Parity (Northpointe, Inc., July 8, 2016). The ensuing methodological debate is use — ully — ramed in Alexandra Chouldechova, Fair Prediction with Disparate Impact: A Study o — Bias in Recidivism Prediction Instruments, 5 Big Data 153 (2017). 49 The doctrinal dimension is complicated by State v. Loomis, 881 N.W.2d 749 (Wis. 2016), in which the Wisconsin Supreme Court upheld the use o — a COMPAS risk score in sentencing over the de — endant’s objection that it violated due process, reasoning that the score was one — actor among many considered by the judge. The court’s treatment o — the proprietary nature o — the algorithm’s weights has drawn sustained criticism. See Bernard Harcourt, Against Prediction: Pro — iling, Policing, and Punishing in an Actuarial Age (2007); Hannah Sassaman & Upturn, Help Wanted: An Examination o — Hiring Algorithms, Equity, and Bias (2018). 252 Judgment Proo —

50 For a technical description o — the Allegheny Family Screening Tool, see Rhema Vaithianathan, Emily Putnam-Hornstein, Nan Jiang, Parma Nand & Tim Maloney, Developing Predictive Risk Models to Support Child Maltreatment Hotline Screening Decisions: Allegheny County Methodology and Implementation (2017). The instrument draws on over 130 variables — rom county administrative databases. 51 Virginia Eubanks, Automating Inequality: How High-Tech Tools Pro — ile, Police, and Punish the Poor 127-73 (2018). Eubanks’s analysis o — the Allegheny instrument emphasizes what she terms the “ — eedback loop” problem: tools trained on administrative data encode existing surveillance patterns, and their deployment intensi — ies those patterns, producing training data — or the next iteration o — the tool that — urther concentrates algorithmic attention on the same population. Id. at 167-69. 52 Peter H. Wilson, The Thirty Years War: Europe’s Tragedy (Harvard University Press, 2009), 787 (estimating total deaths between eight and twelve million, with some German territories losing more than hal — their populations). The canonical “one-third o — Germany” — igure re — lects regional averages across the Holy Roman Empire and has been a standard re — erence point in historical scholarship since at least J.V. Polisensky, The Thirty Years War (1971). 53 Thomas Aquinas, Summa Theologiae I-II, Q.95, Art. 1 (c. 1270). The — uller passage reads: “Now human law is — ramed — or a number o — human beings, the majority o — whom are not per — ect in virtue. Where — ore human laws do not — orbid all vices, — rom which the virtuous abstain, but only the more grievous vices, — rom which it is possible — or the majority to abstain; and chie — ly those that are to the hurt o — others, without the prohibition o — which human society could not be maintained: thus human law prohibits murder, the — t and such like.” 54 Aristotle, Nicomachean Ethics, trans. W.D. Ross, Book II.1, 1103b: “Legislators make the citizens good by — orming habits in them, and this is the wish o — every legislator, and those who do not e —

ect it miss their mark, and it is in this that a good constitution di —

ers — rom a bad one.” 55 Moses Maimonides, The Guide — or the Perplexed, Part III, Chapter 27 (c. 1190), trans. M. Friedlander (1904): “The true per — ection o — man is the possession o — the highest intellectual — aculties… The per — ection o — the body is antecedent to the per — ection o — the soul… But the per — ection o — the soul is the ultimate end.” 56 Hugo Grotius, De Jure Belli ac Pacis, Prolegomena, § 11 (1625), trans. Francis W. Kelsey (Clarendon Press, 1925). The passage in — ull: “What we have been saying would have a degree o — validity even i — we should concede that which cannot be conceded without the utmost wickedness, that there is no God, or that the a —

airs o — men are o — no concern to Him.” 57 On Grotius’s irenicism and his li — elong e —

ort toward church reuni — ication, see Henk J.M. Nellen, Hugo Grotius: A Li — elong Struggle — or Peace in Church and State, 1583–1645, trans. J.C. Grayson (Brill, 2015), 1–25. His work De veritate religionis Notes and Re — erences 253

christianae (1627) was written explicitly to de

end Christianity against skepticism and to promote Protestant-Catholic reconciliation. 58 Grotius, Meletius, written c. 1611, edited and translated by Guillaume H.M. Posthumus Meyjes (E.J. Brill, 1988), sets out his ecumenical vision with particular clarity. See also Richard Tuck, The Rights o — War and Peace: Political Thought and the International Order — rom Grotius to Kant (Ox — ord University Press, 1999), 78– 108. 59 Thomas Hobbes, Leviathan, Part I, Chapter 11 (1651), ed. C.B. Macpherson (Penguin Books, 1985), 160. 60 Id. at Part I, Chapter 11, 160. 61 Hobbes, Dialogue Between a Philosopher and a Student o — the Common Laws o —

England (c. 1666), in The English Works o

Thomas Hobbes, vol. 6, ed. Sir William Molesworth (John Bohn, 1840), 5. The phrase auctoritas, non veritas — acit legem is conventionally attributed to Hobbes as a summary o — his legal positivism, though he nowhere uses the Latin — ormulation verbatim. The substance appears throughout Leviathan and the Dialogue. 62 John Locke, A Letter Concerning Toleration (1689), in The Works o — John Locke, vol. 6, 10th ed. (London: J. Johnson, 1801), 9–10: “The commonwealth seems to me to be a society o — men constituted only — or the procuring, preserving, and advancing their own civil interests. Civil interests I call li — e, liberty, health, and indolency o — body; and the possession o — outward things, such as money, lands, houses, — urniture, and the like.” 63 Id. at 11. 64 Id. at 13. 65 J.S. Mill, On Liberty (1859), in Collected Works o — John Stuart Mill, vol. 18, ed. J.M. Robson (University o — Toronto Press, 1977), 223. 66 Id. at 261–275, setting out the “individuality” argument: “the — ree development o — individuality is one o — the leading essentials o — well-being… it is not only a co- ordinate element with all that is designated by the terms civilization, instruction, education, culture, but is itsel — a necessary part and condition o — all those things.” Mill’s position is that the gymnasium o — human development is liberty itsel — ; a claim that assumes the existence o — institutions and practices through which judgment is in — act exercised, without speci — ying what secures their existence. 67 Robert Conquest, The Harvest o — Sorrow: Soviet Collectivization and the Terror- Famine (Ox — ord University Press, 1986), remains the standard historical account o — Stalin’s agricultural collectivization and the resulting — amine. Conquest estimates the — amine deaths at approximately 5–7 million across the Soviet Union, with Ukraine particularly devastated. For more recent scholarship integrating archival evidence, see Timothy Snyder, Bloodlands: Europe Between Hitler and Stalin (Basic Books, 2010), 32–56, which situates the Holodomor within the broader pattern o — twentieth-century atrocities that emerged — rom attempts to implement utopian visions through centralized state control. 254 Judgment Proo —

68 Judith N. Shklar, “The Liberalism o — Fear,” in Liberalism and the Moral Li — e, ed. Nancy L. Rosenblum (Harvard University Press, 1989), 21, 26–27: “The liberalism o —

ear… regards cruelty as an absolute evil, an evil independent o — any other human quality or virtue… [It] does not, to be sure, o —

er a summum bonum toward which all political agents should strive, but it certainly does begin with a summum malum, which all o — us know and would avoid i — only we could.” 69 John Rawls, A Theory o — Justice (Harvard University Press, 1971), 3: “Justice is the

irst virtue o — social institutions, as truth is o — systems o — thought.” 70 John Rawls, A Theory o — Justice, rev. ed. (Harvard University Press, 1999), 28–

1. The priority o

   the right over the good is stated explicitly: “the priority o — right means that the principles o — justice set limits to permissible ways o — li — e; and the claims that citizens make to pursue ends that transgress these boundaries have no weight.” 71 Id. at 118–123, describing the “veil o — ignorance” as the device by which the parties to the original position are deprived o — knowledge o — their particular place in society, their assets, and “their conception o — the good or their special psychological propensities.” 72 John Rawls, Political Liberalism, expanded ed. (Columbia University Press, 2005), xvi–xxii, acknowledging the “Kantian” or “liberal” character o — the political values that public reason presupposes, and attempting to explain why this does not make political liberalism simply another comprehensive doctrine. 73 Rio Declaration on Environment and Development, Principle 15 (1992): “Where there are threats o — serious or irreversible damage, lack o —

ull scienti — ic certainty shall not be used as a reason — or postponing cost-e —

ective measures to prevent environmental degradation.” The Precautionary Principle appears in variant — ormulations across EU law, the Cartagena Protocol on Biosa — ety, and numerous domestic regulatory — rameworks. 74 Cass R. Sunstein, Laws o — Fear: Beyond the Precautionary Principle (Cambridge University Press, 2005), 35–41, noting the deep structural tension in the Precautionary Principle: many precautionary measures create risks o — their own, and the principle provides no vocabulary — or adjudicating between them. The result is a — ramework that activates regulatory intervention but cannot determine when su —

icient intervention has occurred. 75 U.S. Bureau o — Labor Statistics, Occupational Employment and Wage Statistics, SOC 13-1041 (Compliance O —

icers), May 2022, reporting 353,400 employed in the occupation nationwide. This — igure excludes attorneys, auditors, risk managers, and consultants whose primary — unction is compliance-related but whose occupational classi — ication di —

ers; estimates that include these adjacent

unctions place the compliance work — orce considerably higher. See also Society o —

Corporate Compliance and Ethics, SCCE 2023 Benchmark Survey (2023) (reporting continued growth in compliance sta —

ing across industries). Notes and Re — erences 255

76 On the expansion o — compliance and administrative in — rastructure in American higher education, see Benjamin Ginsberg, The Fall o — the Faculty: The Rise o — the All-Administrative University and Why It Matters (Ox — ord University Press, 2011), documenting the approximately 85 percent growth in administrative personnel at American universities between 1975 and 2005. The relationship between

ederal regulatory requirements and administrative growth is analyzed in Paul F. Campos, “The Real Reason College Tuition Costs So Much,” New York Times, April 4, 2015. 77 Thomson Reuters, Cost o — Compliance 2023 (Thomson Reuters Institute, 2023), reporting that large global — inancial institutions spend an average o —

approximately $10,000 per employee annually on compliance

unctions. Cross- sector aggregate estimates — or compliance-related expenditure in the United States exceed $270 billion annually. See also Deloitte, Future o — Regulatory Compliance (2022). 78 Richard A. Posner, Economic Analysis o — Law (Little, Brown and Co., 1st ed. 1973). Posner’s wealth-maximization norm, which proposes that legal rules should be evaluated by whether they maximize total social wealth, appears throughout the

irst edition. For the — oundational statement, see id. at 4–13. 79 Aristotle, Nicomachean Ethics, Book VI, chapters 3–5, 1139b14–1140b30, trans. W.D. Ross, rev. J.O. Urmson, in The Complete Works o — Aristotle, ed. Jonathan Barnes (Princeton University Press, 1984). The distinction between techne (productive knowledge whose end is external to the practitioner) and phronesis (practical wisdom whose end is the action itsel — and the character it expresses) is central to Aristotle’s account o — intellectual virtue. See especially id. at 1140a1–24 (techne) and 1140a24–b30 (phronesis). 80 Id. at Book VI, ch. 8, 1141b8–21: “Phronesis is concerned with the last particular, which is the object not o — scienti — ic knowledge but o — perception (not the perception o — qualities peculiar to one sense but a perception akin to that by which we perceive that the particular — igure be — ore us is a triangle).” 81 On the proli — eration o —

ederal — inancial regulations and the growth o —

“administrative dark matter” (guidance documents, interpretive letters, and en — orcement-based rulemaking that — unctions as regulation without going through the notice-and-comment process), see Philip Hamburger, Is Administrative Law Unlaw — ul? (University o — Chicago Press, 2014), and Nicholas Parrillo, “Federal Agency Guidance and the Power to Bind: An Empirical Study o —

Agencies and Industries,” 36 Yale J. on Reg. 165 (2019). 82 On compliance sta —

ing growth in the — inancial sector — ollowing Dodd-Frank, see Federal Reserve Bank o — New York, Compliance Costs, Economies o — Scale, and Compliance Per — ormance (Sta —

Reports No. 820, 2017), documenting that community banks spent approximately $4.5 billion annually on Dodd-Frank- related compliance in the years immediately — ollowing passage. For the approximate 60 percent growth — igure in compliance sta —

ing at larger 256 Judgment Proo —

institutions, see Thomson Reuters, Cost o

Compliance (2018 edition). The Dodd- Frank Wall Street Re — orm and Consumer Protection Act, Pub. L. 111-203, 124 Stat. 1376 (2010), required approximately 398 new — ederal rulemakings and authorized eleven new regulatory entities. 83 Ian Urbina, “It’s a Fork, It’s a Spoon, It’s a… Weapon?”, New York Times, Oct. 11, 2009, at A1. The case attracted national attention and prompted the Christina School District to revise its zero-tolerance policy to permit case-by-case assessment o — intent, though similar policies remained in e —

ect in hundreds o —

districts across the country. 84 Id. The policy language (“regardless o — possessor’s intent”) is quoted — rom the Christina School District’s Code o — Conduct as reported in contemporaneous coverage. 85 Id. 86 Id. (quoting George Evans, president o — the Christina School Board). 87 Thomas Aquinas, Summa Theologiae I-II, Q. 90, Art. 1 (de — ining law as “an ordinance o — reason — or the common good”). On the relationship between a rule’s text and its telos, see id. at Q. 96, Art. 6: “I — a literal application o — the law’s words would have an e —

ect contrary to its purpose, the spirit o — the law should be

ollowed.” 88 Gun-Free Schools Act o — 1994, Pub. L. 103-382, § 14601, 108 Stat. 3907 (codi — ied at 20 U.S.C. § 7961). The Act conditioned the receipt o —

ederal elementary and secondary education — unding on the adoption o — state laws requiring one-year expulsions — or students who bring weapons to school. The provision — or chie —

administering o

icers to modi — y expulsions “on a case-by-case basis” was widely interpreted by districts as creating an exception that required a —

irmative justi — ication rather than a de — ault o — contextual assessment. 89 FAA Human Factors Team, Operational Use o — Flight Path Management Systems, Final Report to the FAA Flight Standards Service (September 2013), at 17 (“Pilots over-rely on automation… and may have limited ability to take over manual control o — the airplane when needed”) and 21 (attributing 60 percent o — reviewed incidents to manual handling and — light control errors). 90 The — our-stage automation paradox was — irst systematically described in Lisanne Bainbridge, “Ironies o — Automation,” 19 Automatica 775 (1983), which remains the — oundational paper in the — ield. Bainbridge identi — ied that the more reliable an automated system, the less the human operator can contribute and the more deteriorated their skills will be when manual intervention is required. For the speci — ic aviation application, see also Federal Aviation Administration, “Automation Policy and Training Aid” (2014). 91 Louisa Dahmani & Véronique D. Bohbot, “Habitual Use o — GPS Negatively Impacts Spatial Memory During Sel — -Guided Navigation,” Nature Communications, 11:4022 (2020). The study combined cross-sectional data (n = 50) with a longitudinal component demonstrating causation: participants who Notes and Re — erences 257

increased GPS use between measurement intervals showed corresponding declines in spatial memory per — ormance (p < 0.001), controlling — or baseline spatial ability, age, and — requency o — navigation. 92 Julia Angwin, Je —

Larson, Surya Mattu & Lauren Kirchner, “Machine Bias,” ProPublica (May 23, 2016). COMPAS (Correctional O —

ender Management Pro — iling — or Alternative Sanctions) is developed by Equivant ( — ormerly Northpointe) and is used in pretrial and sentencing proceedings in Wisconsin, New York, Cali — ornia, and other states. The competing de — initions o —

airness (equal — alse positive rates across demographic groups versus equal positive predictive values) are mathematically incompatible whenever base rates di —

er across those groups, as demonstrated in Alexandra Chouldechova, “Fair Prediction with Disparate Impact: A Study o — Bias in Recidivism Prediction Instruments,” 5 Big Data 153 (2017). 93 On anchoring e —

ects in judicial sentencing, see Jon Kleinberg, Himabindu Lakkaraju, Jure Leskovec, Jens Ludwig & Sendhil Mullainathan, “Human Decisions and Machine Predictions,” 133 Q.J. Econ. 237 (2018), demonstrating that judges systematically adjust sentences toward algorithmic risk scores even in case types where unassisted judicial judgment outper — orms the algorithm; and Birte Englich, Thomas Mussweiler & Fritz Strack, “Playing Dice with Criminal Sentences: The In — luence o — Irrelevant Anchors on Experts’ Judicial Decision Making,” 32 Pers. & Soc. Psychol. Bull. 188 (2006). 94 Shannon Vallor, Technology and the Virtues: A Philosophical Guide to a Future Worth Wanting (Ox — ord University Press, 2016), at 25–30 (developing the “moral muscle” metaphor and grounding it in Aristotle’s hexis) and 67–82 (analyzing moral deskilling as the systematic atrophy o — practical judgment through algorithmic substitution). 95 Nicholas Carr, The Glass Cage: Automation and Us (W.W. Norton & Co., 2014), at 63–90. Carr draws on Heidegger’s account o — ready-to-hand engagement with tools and Michael Polanyi’s concept o — tacit knowledge to describe the phenomenological dimension o — genuine competence (the “dwelling” in a domain that develops through the — riction o — direct engagement rather than mediated monitoring). 96 Brett Frischmann & Evan Selinger, Re-Engineering Humanity (Cambridge University Press, 2018), at 47–73. Their central argument is that the “ — riction” o —

deliberation (the resistance o

the world to our intentions and the cognitive labor required to navigate that resistance) is not an ine —

iciency to be engineered away but the condition under which human agency develops. To design — riction out o —

human experience is to design agency out o

human beings. 97 Aristotle, Nicomachean Ethics, Book I, ch. 3, 1094b11–27: “It is the mark o — an educated man to look — or precision in each class o — things just so — ar as the nature o — the subject admits; it is evidently equally — oolish to accept probable reasoning

rom a mathematician and to demand — rom a rhetorician scienti — ic proo — s.” The 258 Judgment Proo —

application o

mathematical precision to domains whose nature does not admit it constitutes, — or Aristotle, an intellectual error regardless o — the sophistication o —

the mathematics applied. 98 Administrative Procedure Act, Pub. L. No. 79-404, 60 Stat. 237 (1946) (codi — ied at 5 U.S.C. §§ 551–559, 701–706). The legislative history is use — ully canvassed in George B. Shepherd, Fierce Compromise: The Administrative Procedure Act Emerges

rom New Deal Politics, 90 Nw. U. L. Rev. 1557 (1996). For the APA’s notice-and- comment requirement speci — ically, see 5 U.S.C. § 553. 99 The Hard Look doctrine’s origins are traced to Greater Boston Television Corp. v. FCC, 444 F.2d 841, 851 (D.C. Cir. 1970) (Leventhal, J.) (“I — the agency has not considered all relevant — actors, or has given an inadequate explanation — or its decision, the court must remand — or — urther consideration”). Its consolidation as a constitutional-grade requirement o — reasoned decision-making is associated with Motor Vehicle M — rs. Ass’n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29 (1983). For the ossi — ication literature, see Thomas O. McGarity, Some Thoughts on “Deossi — ying” the Rulemaking Process, 41 Duke L.J. 1385 (1992); Richard J. Pierce Jr., Seven Ways to Deossi — y Agency Rulemaking, 47 Admin. L. Rev. 59 (1995). 100 Clyde Wayne Crews Jr., Ten Thousand Commandments: An Annual Snapshot o —

the Federal Regulatory State (Competitive Enterprise Institute, annual). Crews’s “regulatory dark matter” — raming is developed in his contributions to the CEI’s annual regulatory report. The scholarly treatment is most extensively canvassed in Nina A. Mendelson, Regulatory Bene — iciaries and In — ormal Agency Policymaking, 92 Cornell L. Rev. 397 (2007). 101 U.S. Dep’t o — Education, O —

ice — or Civil Rights, Dear Colleague Letter: Sexual Violence (Apr. 4, 2011) [hereina — ter 2011 DCL]. The letter was issued by Assistant Secretary — or Civil Rights Russlyn Ali. For the procedural requirements it imposed, see speci — ically pages 8–11 o — the letter, which address the preponderance standard and cross-examination limitations. 102 The 2011 DCL was withdrawn in September 2017. The Trump administration issued new interim guidance in 2017 and — inal regulations under 34 C.F.R. Part 106 in 2020. The Biden administration proposed — urther revisions in 2022. The regulatory history illustrates both the instability o — guidance-based governance and its persistence: each administration — ound it easier to issue new guidance than to conduct comprehensive — ormal rulemaking, meaning the regulated institutions have — aced continual procedural uncertainty. 103 Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law o —

Privacy, 114 Colum. L. Rev. 583, 586 (2014). The article provides the

oundational analysis o — how FTC en — orcement actions — unction as precedent in the absence o —

comprehensive statutory authority. 104 FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) (a —

irming FTC’s authority to regulate data security under the “un — airness” prong o — Section 5 o — the FTC Act). For the LabMD en — orcement action and its resolution, see LabMD, Inc. Notes and Re — erences 259

v. FTC, 894 F.3d 1221 (11th Cir. 2018) (vacating the Commission’s cease-and-desist order as insu —

iciently speci — ic, without reaching the — air notice question that had been the center o — the district court proceedings). 105 The constructive notice argument is developed in the FTC’s summary judgment submissions in the original LabMD proceeding. See FTC’s Motion — or Summary Decision at 34, In re LabMD, Inc., Docket No. 9357 (F.T.C. Apr. 23, 2014) (“[LabMD] had ample notice that its data security practices were unreasonable” through prior FTC settlements, speeches, and publications). 106 The compliance isomorphism concept draws on the organizational sociology literature, speci — ically Paul J. DiMaggio & Walter W. Powell, The Iron Cage Revisited: Institutional Isomorphism and Collective Rationality in Organizational Fields, 48 Am. Sociological Rev. 147 (1983). The application to regulatory compliance is developed in Kimberly D. Krawiec, Cosmetic Compliance and the Failure o —

Negotiated Governance, 81 Wash. U. L.Q. 487 (2003). 107 The description o — the compliance o —

icer’s navigational — unction draws on David Zaring, Rulemaking and Rule Writing at the Border o — Administrative and Contract Law, 78 Geo. Wash. L. Rev. 1020 (2010), and Miriam Hechler Baer, Governing Corporate Compliance, 50 B.C. L. Rev. 949 (2009). 108 Steven M. Teles, Kludgeocracy in America, 97 Nat’l A —

airs 97 (Fall 2013). The term’s origin in engineering and its application to the American wel — are state were developed simultaneously in Jacob S. Hacker, The Divided Wel — are State (2002), and Paul Pierson, Politics in Time (2004), though neither used the speci — ic term. 109 The Federal Register page count is tracked annually by the O —

ice o — the Federal Register and reported in The Federal Register: 2023 Summary (Nat’l Archives & Records Admin., 2024). The — igure o — 185,000+ pages in the Code o — Federal Regulations is approximate and re — lects the annual print edition. 110 RegData was developed at the Mercatus Center at George Mason University. See Patrick A. McLaughlin & Oliver Sherouse, RegData 2.0: A Panel Dataset on U.S. Federal Regulations (Mercatus Center Working Paper, 2016). For the Shannon entropy analysis applied to state regulatory codes, see McLaughlin et al., A Snapshot o — Regulation in [State] States (Mercatus Center Policy Brie — series, 2016– 2019). 111 Id. The Shakespeare comparison is developed explicitly in the Mercatus state regulatory snapshots. The — inding that several state regulatory codes exceed Shakespearean entropy is presented as a benchmark — or cognitive accessibility, not as a claim about literary merit. For the in — ormation-theoretic — ramework, see Claude E. Shannon & Warren Weaver, The Mathematical Theory o — Communication (1949). 112 The disproportionate compliance burden on small — irms is documented in W. Mark Crain & Nicole V. Crain, The Cost o — Federal Regulation to the U.S. Economy, Manu — acturing, and Small Business (Nat’l Ass’n o — Manu — acturers, 2014), and in 260 Judgment Proo —

Mercatus Center research on the regulatory incidence o

speci — ic statutes. The per-employee compliance cost di —

erential between small and large — irms has been consistently estimated at a — actor o — two to three, with larger di —

erentials in industries with high regulatory complexity. 113 The “Kludge Industry” concept is Teles’s, supra note 11, at 108. The economic analysis o — complexity as a barrier to entry and a source o — rents — or incumbent- protecting intermediaries draws on George J. Stigler, The Theory o — Economic Regulation, 2 Bell J. Econ. & Mgmt. Sci. 3 (1971) (regulatory capture), and more recently on Luigi Zingales, A Capitalism — or the People: Recapturing the Lost Genius o — American Prosperity (2012). 114 Industrial Union Dep’t, AFL-CIO v. American Petroleum Inst., 448 U.S. 607 (1980) [hereina — ter Benzene]. The plurality opinion was authored by Justice Stevens; — our justices joined the judgment on the Signi — icant Risk issue, though the Court did not achieve a majority rationale. For the principle’s subsequent application, see American Textile M — rs. Inst. v. Donovan, 452 U.S. 490 (1981) (holding that once signi — icant risk is established, the OSH Act requires regulation to the extent technologically and economically — easible, without a separate cost-bene — it balancing requirement). 115 Benzene, 448 U.S. at 655 (Stevens, J.) (“I — the odds are one in a billion that a person will die — rom cancer by taking a drink o — chlorinated water, the risk clearly could not be considered signi — icant. On the other hand, i — the odds are one in a thousand that regular inhalation o — gasoline vapors that are 2% benzene will be

atal, a reasonable person might well consider the risk signi — icant and take appropriate steps to decrease or eliminate it.”). 116 Rio Declaration on Environment and Development, Principle 15, U.N. Doc. A/CONF.151/26/Rev.1 (1992) (“Where there are threats o — serious or irreversible damage, lack o —

ull scienti — ic certainty shall not be used as a reason — or postponing cost-e —

ective measures to prevent environmental degradation”). For the principle’s origins in German law and its transmission into international environmental practice, see Arie Trouwborst, Evolution and Status o — the Precautionary Principle in International Law (2002). 117 The scienti — ic controversy over the LNT model is substantial and ongoing. See T.D. Luckey, Radiation Hormesis (1991); compare National Council on Radiation Protection and Measurements, Implications o — Recent Epidemiologic Studies — or the Linear-Nonthreshold Model and Radiation Protection, NCRP Commentary No. 27 (2018) (endorsing LNT as a conservative assumption — or radiation protection purposes). For the model’s role in generating signi — icant risk — indings that satis — y the Benzene doctrine without independent empirical support, see Cass R. Sunstein, Laws o — Fear: Beyond the Precautionary Principle 37–42 (2005). 118 O —

ice o — Mgmt. & Budget, Circular A-4, Regulatory Analysis (Nov. 9, 2023) (revised). The 2023 revision introduced distributional weighting into the standard — ederal cost-bene — it — ramework — or the — irst time. For critical analysis, Notes and Re — erences 261

see W. Kip Viscusi, The Revised OMB Circular A-4 Is Not an Improvement, 11 J. Ben.- Cost Analysis 327 (2023); compare Richard L. Revesz & Max L. Mintz, The Revised Circular A-4 and Distributional Considerations in Cost-Bene — it Analysis (2023) (de — ending the revision as an improvement on the prior — ramework’s systematic undervaluation o — regulatory bene — its to lower-income populations). 119 Nick Haslam, Concept Creep: Psychology’s Expanding Concepts o — Harm and Pathology, 7 Psychological Inquiry 1 (2016). The concept creep phenomenon had been described earlier, in less systematic terms, in Christopher Lasch, The Culture o — Narcissism (1979), and in more recent cultural analysis in Jonathan Haidt & Greg Lukiano —

, The Coddling o — the American Mind (2018), though neither used Haslam’s terminology. 120 OSHA, Psychosocial Hazards in the Workplace: Supporting Worker Mental Health (OSHA Fact Sheet, 2024). OSHA’s authority to regulate psychosocial hazards derives — rom the general duty clause o — the Occupational Sa — ety and Health Act, 29 U.S.C. § 654(a)(1), which requires employers to — urnish employment — ree — rom “recognized hazards that are causing or are likely to cause death or serious physical harm.” The extension o — this language to psychological harm has not been de — initively adjudicated. 121 Tom D. Crouch, A Dream o — Wings: Americans and the Airplane, 1875–1905 259– 62 (1981) (describing the December 1903 Aerodrome — ailures and Langley’s withdrawal — rom — urther experimentation). Langley died in 1906. The Smithsonian Institution continued to contest the Wrights’ priority claim — or several decades, in part because it had institutional interests in maintaining Langley’s reputation; the controversy was not — ully resolved until 1942. 122 See David McCullough, The Wright Brothers 73–106 (2015) (describing the Wrights’ experimental method and their correspondence with Chanute); Fred Howard, Wilbur and Orville: A Biography o — the Wright Brothers 88–95 (1987). The Wrights’ deliberate rejection o — received aeronautical wisdom, including their skepticism o — Lilienthal’s li — t tables, which they tested and — ound inaccurate, is a central — eature o — their method. See Tom D. Crouch, The Bishop’s Boys: A Li — e o —

Wilbur and Orville Wright 206–08 (1989) (describing the Wrights’ discovery that Lilienthal’s coe —

icient was too high by a — actor o — roughly 2.5). 123 See Arnold Barnett, Aviation Sa — ety: A Whole New World?, 66 Transp. Sci. 97 (2020) (documenting the dramatic improvement in commercial aviation sa — ety over the past six decades and the contribution o — regulatory requirements to that improvement). Barnett’s estimate that the per- — light — atality risk — or commercial aviation in developed-country carriers — ell by roughly two orders o — magnitude between 1960 and 2020 is consistent with the general narrative o — regulatory success in aviation sa — ety. The point is not that aviation regulation — ailed but that the conditions justi — ying it (accumulated operational data, understood mechanisms o —

ailure, established engineering disciplines) di —

er — undamentally

rom the conditions o — genuine Knightian uncertainty. 262 Judgment Proo —

124 Frank H. Knight, Risk, Uncertainty and Pro — it 197–225 (Hart, Scha —

ner & Marx ed., 1921). The terminology o — the Knight distinction, and its application to regulatory contexts, is developed in Israel M. Kirzner, The Meaning o — Market Process: Essays in the Development o — Modern Austrian Economics 3–39 (1992). 125 Id. at 7–9. Knight’s pre — ace situates the book as an intervention in a methodological dispute about the — oundations o — economic theory, not merely an empirical contribution to price theory. 126 Id. at 226–32 (developing the concept o — “true uncertainty” through the analysis o — business judgment and entrepreneurial decision-making). For the application to regulatory contexts, see Daniel Schwarcz & Peter Siegelman, Law and Economics o — Insurance 45–52 (2014); Cass R. Sunstein & Adrian Vermeule, Law and Leviathan: Redeeming the Administrative State 62–67 (2020). 127 Knight, supra note 4, at 269–83. The pro — it-as-reward- — or-uncertainty-bearing theory remains controversial; — or a critique, see Fritz Machlup, Theories o — the Firm: Marginalist, Behavioral, Managerial, 57 Am. Econ. Rev. 1 (1967). The epistemological point (that genuine entrepreneurial judgment cannot be reduced to calculable risk management) is broadly accepted independent o — the distributional controversy over pro — it. 128 Moses Maimonides, The Guide — or the Perplexed (Shlomo Pines trans., Univ. o —

Chicago Press 1963) (c. 1190). The Guide is addressed, in Maimonides’s dedicatory letter, to a student who has mastered philosophy and is perplexed by apparent con — licts between philosophical knowledge and revealed religious teaching. The epistemological argument developed in Part I is — oundational to everything that

ollows. 129 Id. pt. I, chs. 50–60 (developing the doctrine o — negative attributes). The key

ormulation is in chapter 58: “Know that the description o — God . . . by means o —

negations is the correct description—a description that is not a

ected by an indulgence in — acile language, and does not imply any de — iciency with respect to God in general or in any particular mode.” Maimonides’s negative theology is analyzed in comparison with Christian apophatic traditions in Denys Turner, The Darkness o — God: Negativity in Christian Mysticism 19–49 (1995). 130 Maimonides, supra note 8, pt. III, ch. 27 (discussing the dual purposes o — law). The point about the sca —

olding — unction depending on practices that law can create conditions — or but cannot — ully speci — y is implicit in Maimonides’s treatment o — law as operating “gradually” toward the — ormation o — character that ultimately transcends explicit legal command. 131 Trent D. Stephens & Rock Brynner, Dark Remedy: The Impact o — Thalidomide and Its Revival as a Vital Medicine 1–30 (2001) (providing the most accessible account o — the thalidomide catastrophe and its origins). The estimate o — 10,000 a —

ected children is approximate; the actual number o — children born with thalidomide embryopathy who survived is estimated at approximately 8,000, with a much larger number o — stillbirths and miscarriages attributable to the drug. Notes and Re — erences 263

132 Morton Mintz, At Any Cost: Corporate Greed, Women, and the Dalkon Shield 3– 22 (1985); see also Suzanne White Junod, FDA and Clinical Drug Trials: A Short History, in A Quick Guide to Clinical Trials (Madhu Davies & Faiz Kerimani eds., 2008) (describing Kelsey’s review and the institutional context in which it occurred). Kelsey received the President’s Award — or Distinguished Federal Civilian Service in 1962 in recognition o — her role in keeping thalidomide o —

the American market. 133 Ke — auver-Harris Drug Amendments, Pub. L. No. 87-781, 76 Stat. 780 (1962) (codi — ied as amended in scattered sections o — 21 U.S.C.). The amendments require sponsors to demonstrate e —

icacy through adequate and well-controlled studies and give the FDA authority to withdraw approval on the basis o — new sa — ety in — ormation. See Peter Temin, Taking Your Medicine: Drug Regulation in the United States 58–79 (1980) (analyzing the political origins o — the 1962 amendments). 134 Sam Peltzman, The Bene — its and Costs o — New Drug Regulation, in Regulating New Drugs 113, 146–50 (Richard L. Landau ed., 1973); see also William M. Wardell, Therapeutic Implications o — the Drug Lag, 1 Clinical Pharmacology & Therapeutics 73 (1974) (documenting the di —

erential availability o — cardiac drugs between the United States and the United Kingdom). The range o — 10,000 to 30,000 deaths is derived — rom academic analyses o — the period o — non-availability and applies assumptions about treatment e —

ectiveness — rom European clinical trials to estimated American patient populations. See Daniel B. Klein & Alexander Tabarrok, Do O —

-Label Drug Practices Argue against FDA E —

icacy Requirements? A Critical Analysis o — the Physicians’ Desk Re — erence, 6 Am. J. Bioethics 2 (2006). 135 Michael Silverman, Philip Lee & Mia Lydecker, Prescriptions — or Death: The Drugging o — the Third World 44–47 (1982); see Byron L. Cryer, Mucosal De — ense and Repair: Role o — Prostaglandins in the Stomach and Duodenum, 81 Gastroenterology Clinics North Am. 87 (2001) (summarizing the mechanism and clinical utility o —

misoprostol prophylaxis). 136 See Jean-François Escudier et al., Metastatic Renal Cell Carcinoma: First-Line Therapy, in Kidney Cancer: Principles and Practice (Primo N. Lara & Eric Jonasch eds., 2012) (discussing interleukin-2 therapy outcomes and approval history). The FDA granted approval o — aldesleukin (recombinant interleukin-2) — or metastatic renal cell carcinoma in May 1992. European approvals in individual jurisdictions preceded the American approval. 137 Sam Peltzman, An Evaluation o — Consumer Protection Legislation: The 1962 Drug Amendments, 81 J. Pol. Econ. 1049 (1973). Peltzman’s analysis and its subsequent methodological critiques are canvassed in Henry G. Grabowski & John M. Vernon, The Regulation o — Pharmaceuticals: Balancing the Bene — its and Risks (1983). 138 See Arie Trouwborst, Evolution and Status o — the Precautionary Principle in International Law 9–44 (2002) (tracing the principle — rom German Vorsorgeprinzip through its incorporation into international environmental law). The Rio Declaration — ormulation appears at Principle 15, U.N. Doc. 264 Judgment Proo —

A/CONF.151/26/Rev.1 (1992). For the principle’s role in European Union regulatory law, see Commission Communication on the Precautionary Principle, COM(2000) 1 — inal (Feb. 2, 2000). 139 Cass R. Sunstein, Laws o — Fear: Beyond the Precautionary Principle 13–35 (2005). Sunstein’s argument: “In its strongest — orms, the precautionary principle is literally incoherent—it cannot be satis — ied. Any action can be subject to suspicion, and hence regulation, under the precautionary principle.” The incoherence is not a practical observation about regulatory capacity; it is a logical point about the structure o — the principle’s demand. 140 Nick Haslam, Concept Creep: Psychology’s Expanding Concepts o — Harm and Pathology, 7 Psychological Inquiry 1 (2016). Haslam documents the expansion o —

psychological categories (trauma, abuse, bullying, mental disorder) to encompass conditions that previous generations o — clinicians would have classi — ied di —

erently, and o —

ers a theoretical account o — the cognitive and institutional mechanisms driving the expansion. 141 See Morris M. Kleiner, Licensing Occupations: Ensuring Quality or Restricting Competition? (2006); Morris M. Kleiner & Alan B. Krueger, Analyzing the Extent and In — luence o — Occupational Licensing on the Labor Market, 31 J. Lab. Econ. S173 (2013) ( — inding that occupational licensing is associated with wage premiums o —

ourteen to eighteen percent, consistent with rent-seeking rather than quality assurance as the dominant — unction); Obama White House, Occupational Licensing: A Framework — or Policymakers (2015) (government report on the costs and bene — its o — licensing regimes, — inding that many licensing requirements appear to reduce competition without producing commensurate quality improvements). 142 Obama White House, Occupational Licensing: A Framework — or Policymakers 3, 11–14 (2015) ( — inding 2.85 million — ewer jobs attributable to licensing requirements and documenting disproportionate impact on lower-income and minority workers). The cosmetology training-hour data is compiled in Dick M. Carpenter II et al., License to Work: A National Study o — Burdens — rom Occupational Licensing 8–10 (Institute — or Justice, 2d ed. 2017). For the comparison to EMT training requirements, see id. at 10 (noting that the average cosmetology licensing requirement exceeds the training required — or EMTs in — orty-one states). The Kleiner research on employment e —

ects is developed in Morris M. Kleiner & Evgeny Vorotnikov, Analyzing Occupational Licensing Among the States, 52 J. Reg. Econ. 132, 138–45 (2017). 143 The ex ante/ex post distinction in regulatory theory is developed in Steven Shavell, The Optimal Structure o — Law En — orcement, 36 J.L. & Econ. 255 (1993), and in Shavell, Liability — or Harm versus Regulation o — Sa — ety, 13 J. Legal Stud. 357 (1984). Shavell’s analysis is grounded in the economics o — deterrence rather than the epistemological argument developed here, but the structural conclusion is consistent: ex post liability is appropriate when actors have superior in — ormation Notes and Re — erences 265

about the risk o

harm to potential victims, which is an epistemic asymmetry that parallels the genuine uncertainty argument. 144 See 21 U.S.C. § 356 (Accelerated Approval); FDA, Guidance — or Industry: Expedited Programs — or Serious Conditions—Drugs and Biologics (May 2014) (consolidating FDA guidance on Fast Track, Breakthrough Therapy, Accelerated Approval, and Priority Review). The FDA Modernization Act 2.0, Pub. L. No. 117-328 (Dec. 29, 2022), extended and modi — ied some o — these expedited pathways. For a critical assessment, see Jerry Avorn & Aaron S. Kesselheim, The 21st Century Cures Act—Will It Take Us Back in Time?, 314 JAMA 2473 (2015). 145 See Financial Conduct Authority (UK), Regulatory Sandbox (Nov. 2015); Monetary Authority o — Singapore, FinTech Regulatory Sandbox Guidelines (Nov. 2016). For academic analysis o — regulatory sandboxes as a design mechanism — or uncertainty, see Primavera De Filippi & Benjamin Loveluck, The Invisible Politics o — Bitcoin: Governance Crisis o — a Decentralised In — rastructure, 5 Internet Pol’y Rev. (2016); Michele Finck, Regulatory Sandbox Programs: De — inition, Rationale, Design, in Research Handbook on EU Internet Law (2019). The critical literature notes that sandboxes, in practice, sometimes — avor incumbent applicants over genuinely novel entrants, undermining their — unction as uncertainty-management tools. 146 For the post-market surveillance — ramework under U.S. pharmaceutical regulation, see FDA Amendments Act o — 2007, Pub. L. No. 110-85, § 905, 121 Stat. 823 (establishing the Sentinel System — or active post-market drug surveillance). The Sentinel System’s capacity to detect adverse events that clinical trials did not identi — y represents an epistemically appropriate complement to pre-market review, though its institutional relationship to pre-market approval decisions remains underdeveloped. 147 For the design o — products liability under conditions o — uncertainty, see Robert D. Cooter & Thomas Ulen, Law and Economics 340–82 (6th ed. 2012); W. Kip Viscusi, The Social Costs o — Punitive Damages against Corporations in Environmental and Sa — ety Torts, 87 Geo. L.J. 285 (1998). The design question o — how to internalize the costs o — uncertain harms through liability without creating excessive deterrence o — bene — icial activity is substantially unsettled. 148 F.A. Hayek, The Use o — Knowledge in Society, 35 Am. Econ. Rev. 519 (1945). The paper has been reprinted in numerous anthologies and remains among the most cited articles in economics. See F.A. Hayek, Individualism and Economic Order 77– 91 (1948) (collecting the essay with related work). 149 Hayek, supra note 1, at 519. 150 Id. at 519–20. 151 Id. at 527 (“The marvel is that in a case like that o — a scarcity o — one raw material, without an order being issued, without more than perhaps a hand — ul o — people knowing the cause, tens o — thousands o — people whose identity could not be ascertained by months o — investigation, are made to use the material or its products more sparingly.”). 266 Judgment Proo —

152 The migration o — Hayek’s knowledge argument into legal theory has been partial and uneven. See Richard A. Epstein, Simple Rules — or a Complex World 22– 35 (1995) (applying the knowledge argument to the case — or simple legal rules); Jonathan Macey, The Death o — Corporate Reputation: How Integrity Has Been Destroyed on Wall Street 213–20 (2013) (applying the argument to — inancial regulation). For the under-development o — the argument in administrative law speci — ically, see Adrian Vermeule, Law’s Abnegation: From Law’s Empire to the Administrative State 120–35 (2016) (noting the tension between the knowledge problem and the expansive de — erence doctrine). 153 Dodd-Frank Wall Street Re — orm and Consumer Protection Act, Pub. L. No. 111-203, 124 Stat. 1376 (2010). The implementing rulemaking required by Dodd- Frank exceeded 400 separate rules. See Davis Polk & Wardwell LLP, Dodd-Frank Progress Report (quarterly tracking publication). For an assessment o — the regulatory burden, see Hester Peirce, Ian Robinson & Thomas Stratmann, How Are Small Banks Faring Under Dodd-Frank?, Mercatus Ctr. Working Paper No. 14- 05 (Feb. 2014). 154 Patient Protection and A —

ordable Care Act, Pub. L. No. 111-148, 124 Stat. 119 (2010). The number o — implementing regulations and sub-regulatory guidance documents issued under the ACA substantially exceeds the statutory page count. 155 Hayek, supra note 1, at 521 (“Today it is almost heresy to suggest that scienti — ic knowledge is not the sum o — all knowledge. But a little re — lection will show that there is beyond question a body o — very important but unorganized knowledge which cannot possibly be called scienti — ic in the sense o — knowledge o — general rules: the knowledge o — the particular circumstances o — time and place.”). 156 Michael Polanyi, The Tacit Dimension (1966). Polanyi’s earlier work Personal Knowledge: Towards a Post-Critical Philosophy (1958) develops the philosophical

oundations o — the tacit dimension argument at greater length. 157 Polanyi, The Tacit Dimension, supra note 9, at 4. 158 Id. at 3–4. Polanyi’s extended example involves the recognition o — a — ace (the expert physiognomist who recognizes character in a — ace that she cannot — ully describe) but his clinical examples are equally compelling. See also Polanyi, Personal Knowledge, supra note 9, at 55–57 (discussing the clinical skills o — the physician as a paradigm o — tacit knowledge). 159 Hubert L. Drey — us, What Computers Can’t Do: A Critique o — Arti — icial Reason (1972); Hubert L. Drey — us & Stuart E. Drey — us, Mind over Machine: The Power o —

Human Intuition and Expertise in the Era o

the Computer (1986). For a more recent assessment in light o — developments in machine learning, see Hubert L. Drey — us, Why Heideggerian AI Failed and How Fixing It Would Require Making It More Heideggerian, 171 Phil. Psychol. 23 (2007). 160 Drey — us & Drey — us, Mind over Machine, supra note 12, at 16–51 (describing the

ive stages — rom novice to expert: novice, advanced beginner, competent, pro — icient, expert). The key transition is between the competent and pro — icient Notes and Re — erences 267

stages, at which point rule-

ollowing gives way to situational recognition that is no longer experienced as the application o — rules. 161 James C. Scott, Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed (1998). 162 Id. at 11–22 (describing the development o — German scienti — ic — orestry and Waldsterben). The term Waldsterben ( — orest death or — orest dieback) entered German public discourse in the 1970s and 1980s as the long-term consequences o —

monoculture

orestry became apparent. 163 Id. at 342. 164 Ludwig Wittgenstein, Philosophical Investigations §§ 138–242 (G.E.M. Anscombe et al. trans., 4th ed. 2009) (1953) (the rule- — ollowing discussion). For the legal implications o — the rule- — ollowing argument, see Frederick Schauer, Playing by the Rules: A Philosophical Examination o — Rule-Based Decision-Making in Law and Li — e 68–72 (1991); Stanley Fish, There’s No Such Thing as Free Speech: And It’s a Good Thing Too 1–27 (1994). 165 The claim that judgment is constitutive o — rule- — ollowing rather than supplementary to it is developed in Saul Kripke, Wittgenstein on Rules and Private Language (1982), which o —

ers one in — luential reading o — the rule- — ollowing argument. For an alternative reading with direct implications — or legal interpretation, see John McDowell, Wittgenstein on Following a Rule, 58 Synthese 325 (1984). See also Frederick Schauer, Formalism, 97 Yale L.J. 509 (1988) (the best de — ense o — rule- — ormalism in law, which concedes that the indeterminacy o — rules is real but argues that the predictability gains — rom adhering to rules justi — y accepting some misapplication in outlier cases). 166 See Consumer Financial Protection Bureau, Ability-to-Repay and Quali — ied Mortgage Standards, 78 Fed. Reg. 6408 (Jan. 30, 2013) (codi — ied at 12 C.F.R. pt. 1026) (implementing the quali — ied mortgage rule under the Dodd-Frank Act, which imposed documentation and veri — ication requirements and established sa — e harbors designed to limit lender discretion in underwriting). 167 Federal Deposit Insurance Corporation, 2020 Community Banking Study tbl. 1.1 (2021) (documenting the decline in community bank charters — rom approximately 7,000 in 2010 to approximately 4,900 by the end o — 2019). 168 See Peirce et al., supra note 6, at 6–9 ( — inding that community banks bear disproportionate compliance burdens relative to large institutions, with compliance costs representing a higher — raction o — operating costs and competitive disadvantage concentrated in compliance-intensive product categories). See also FDIC, Community Banking Research and Policy Con — erence Papers (documenting compliance cost asymmetries). 169 See Christine A. Sinsky et al., Allocation o — Physician Time in Ambulatory Practice: A Time and Motion Study in 4 Specialties, 165 Annals Internal Med. 753 (2016) ( — inding that physicians in ambulatory practice spent 27 percent o — their time on direct clinical — ace time and 49 percent on EHR and desk work). 268 Judgment Proo —

170 See Tai-Seale et al., Electronic Health Record Logs Indicate That Physicians Split Time Evenly Between Seeing Patients and Desktop Medicine, 36 Health A —

. 655 (2017) ( — inding that primary care physicians spent on average 5.9 hours per day on electronic health record tasks during an 11.4-hour work day). 171 Thomas Aquinas, Summa Theologica I-II, Q. 95, art. 2 (Fathers o — the English Dominican Province trans., 1920) (1274). See John Finnis, Natural Law and Natural Rights 281–90 (1980) (explicating the determinatio concept and its implication that neither legislation nor adjudication can close the gap between general principle and particular application; the gap is structural, not a — ailure o — dra — tsmanship). 172 Indonesian National Transportation Sa — ety Committee, Aircra — t Accident Investigation Report: PT. Lion Mentari Airlines, Boeing 737-8 (MAX), PK-LQP, KNKT.18.10.35.04, at 5–8, 180–95 (2019) [hereina — ter KNKT Report] (describing the October 28, 2018 positioning — light and the circumstances o — the October 29, 2018 accident — light). The third pilot’s role in the JT043 outcome is described at pages 185–86. The accident — light killed all 189 aboard, including the crew o — six and 183 passengers. 173 Airbus, A320neo Family Commercial Aircra — t (2015) (product speci — ication); Dominic Gates, Fate — ul Decisions Inside Boeing: From 737 MAX’s Origin to its Dual Disasters, Seattle Times, Nov. 18, 2019 (describing Boeing’s competitive response to the A320neo launch). The A320neo received its type certi — icate — rom EASA in November 2015 and entered service with Lu — thansa in January 2016. 174 See S. Comm. on Commerce, Sci. & Transp., Final Committee Report: The Design, Development, and Certi — ication o — the Boeing 737 MAX, at 13–15 (2020) [hereina — ter Senate Committee Report] (describing the engine repositioning decision and its aerodynamic consequences). 175 Id. at 15–16; KNKT Report, supra note 1, at app. C (aerodynamic analysis o — pitch- up tendency — rom engine nacelle li — t). The handling characteristic is speci — ically associated with the LEAP-1B engine’s larger-diameter — an cowling, which generates li — t di —

erently — rom the CFM56 cowling it replaced. 176 Senate Committee Report, supra note 3, at 21–24 (describing Boeing’s type rating strategy and its commercial signi — icance). The House Committee on Transportation and In — rastructure investigation — ound that Boeing personnel communicated internally about the importance o — avoiding a new type rating requirement. See H. Comm. on Transp. & In — rastructure, The Boeing 737 MAX Aircra — t: Costs, Consequences, and Lessons — rom its Design, Development, and Certi — ication, at 79–82 (2020) [hereina — ter House Committee Report]. 177 Senate Committee Report, supra note 3, at 17–20; House Committee Report, supra note 5, at 93–100 (describing MCAS as designed to compensate — or the pitch-up tendency created by engine repositioning and to preserve handling characteristics consistent with previous 737 variants, thereby maintaining the common type rating). Notes and Re — erences 269

178 Senate Committee Report, supra note 3, at 40–48 (describing the Organization Designation Authorization program and the delegation o — certi — ication — unctions to Boeing employees). See also 49 U.S.C. § 44702(d) (authorizing the FAA to delegate certi — ication — unctions to private designees). 179 Senate Committee Report, supra note 3, at 48 ( — inding that the FAA had delegated approximately eighty-seven percent o — the MAX’s certi — ication work to Boeing under the ODA program). 180 House Committee Report, supra note 5, at 133–42 (documenting Boeing management pressure on ODA unit members to limit time spent on certi — ication reviews and to avoid raising issues that might delay the certi — ication schedule). 181 Senate Committee Report, supra note 3, at 25–28; House Committee Report, supra note 5, at 101–06 (describing Boeing’s classi — ication o — MCAS as a modi — ication to the existing speed trim system rather than as a new — light control — unction, which placed the system below the threshold — or the most rigorous FAA review categories). 182 Senate Committee Report, supra note 3, at 28–32 (documenting the expansion o —

MCAS stabilizer authority during development beyond the original 0.6-degree- per-activation speci — ication). See also House Committee Report, supra note 5, at 107– 12. 183 Senate Committee Report, supra note 3, at 32–36 (documenting the gap between the System Sa — ety Analysis, which evaluated MCAS at its original limited authority, and the production con — iguration with expanded authority; the analysis was not updated to re — lect the design change). 184 KNKT Report, supra note 1, at 37–42 (describing MCAS reliance on a single angle-o — -attack sensor without cross-check against the second sensor); Senate Committee Report, supra note 3, at 36–38. 185 Senate Committee Report, supra note 3, at 53–58; House Committee Report, supra note 5, at 115–22 (documenting Boeing’s decision not to include MCAS by name in the Flight Crew Operations Manual and the rationale that pilots would recognize an MCAS mal — unction as a runaway stabilizer event addressable through existing memory items). 186 House Committee Report, supra note 5, at 159 (reproducing the January 2016 internal Boeing message in which a test pilot wrote: “I basically lied to the regulators (unknowingly)” regarding MCAS authority during a meeting with Japan Civil Aviation Bureau representatives). 187 House Committee Report, supra note 5, at 166 (reproducing the September 2018 internal message: “This airplane is designed by clowns who are in turn supervised by monkeys”). 188 House Committee Report, supra note 5, at 163 (reproducing the 2018 internal message — rom a Boeing test pilot expressing unwillingness to — ly his — amily on a MAX with only simulator-based di —

erences training). 270 Judgment Proo —

189 Boeing, Operations Manual Bulletin, Multi Operator Message MOM-MOM- 18-0670-01B (Nov. 6, 2018) (addressing uncommanded nose-down stabilizer trim on the 737 MAX and reiterating the runaway stabilizer memory item without naming MCAS as the cause). 190 Fed. Aviation Admin., Emergency Airworthiness Directive 2018-23-51 (Nov. 7, 2018) (requiring 737 MAX operators to revise their airplane — light manual and quick re — erence handbook to address the risk o — uncommanded nose-down stabilizer trim — rom erroneous angle-o — -attack input). 191 KNKT Report, supra note 1, at 195–200; Senate Committee Report, supra note 3, at 58–62 ( — inding that neither the Operations Manual Bulletin nor the Emergency Airworthiness Directive in — ormed operators that the MCAS — ailure scenario di —

ered materially — rom the runaway stabilizer scenarios the existing procedure was designed to address). 192 Ethiopian Accident Investigation Bureau, Aircra — t Accident Investigation Preliminary Report: Ethiopian Airlines Group, Boeing 737-8 (MAX), ET-AVJ, Report No. AI-01/19, at 3–5 (2019) [hereina — ter Ethiopian AIB Report] (identi — ying the

light crew and their quali — ications). 193 Ethiopian AIB Report, supra note 21, at 12–14 (documenting the 74.5-degree divergence between le — t and right angle-o — -attack sensor readings beginning — our seconds a — ter li — to —

). 194 Ethiopian AIB Report, supra note 21, at 22–24 (documenting the — inal — light data recorder readings and the impact site near the town o — Bisho — tu, approximately 62 kilometers southeast o — Addis Ababa). 195 Fed. Aviation Admin., Emergency Order o — Prohibition (Mar. 13, 2019) (grounding all Boeing 737 MAX aircra — t operated by U.S. airlines or in U.S. territory). China’s Civil Aviation Administration issued its grounding order on March 11, 2019, — ollowed by the Ethiopian Civil Aviation Authority, EASA, and Transport Canada be — ore the FAA acted. 196 United States v. Boeing Co., No. 21-CR-005 (N.D. Tex. Jan. 7, 2021) (de — erred prosecution agreement). The agreement required total payments o —

approximately $2.5 billion: $243.6 million in criminal penalties, $1.77 billion in compensation to airline customers, and $500 million to a — und — or crash victim bene — iciaries. 197 See United States v. Boeing Co., No. 21-CR-005, Government’s Motion Regarding Breach o — De — erred Prosecution Agreement (N.D. Tex. 2024) (alleging that Boeing — ailed to implement a genuine corporate compliance program as required by the de — erred prosecution agreement and seeking revocation o —

de

erred prosecution status). 198 LexisNexis Risk Solutions, True Cost o — Financial Crime Compliance Study: Global Edition 4–7 (2022) [hereina — ter LexisNexis Global Report] (reporting $274 billion in total global compliance expenditure — or 2022). The — igure represents sel — - reported direct compliance costs across surveyed — inancial institutions in multiple Notes and Re — erences 271

jurisdictions; indirect costs are not captured. For U.S. and Canada speci

ically, see id. at 12 (reporting $61 billion). For the SAR — iling volume, see FinCEN, Annual Report FY2023, at 14 (2024). 199 Bank Secrecy Act, Pub. L. No. 91-508, 84 Stat. 1114 (1970) (codi — ied as amended at 31 U.S.C. §§ 5311–5336). The SAR requirement speci — ically appears at 31 U.S.C. § 5318(g). The Know Your Customer requirements were substantially expanded by the USA PATRIOT Act o — 2001, Pub. L. No. 107-56, 115 Stat. 272, § 326, which added § 5318(l) requiring customer identi — ication programs. For the regulatory implementation, see 31 C.F.R. § 1020.220 (customer identi — ication program requirements — or banks). The Financial Action Task Force (FATF), an intergovernmental body established in 1989, sets the global standard — ramework to which national AML regimes are expected to con — orm. See FATF, The FATF Recommendations (updated 2023). 200 FinCEN, Annual Report FY2023, at 14 (reporting 4,614,949 SARs — iled in — iscal year 2023). The comparable — igure — or prior years reported as a baseline in the same report is approximately 4.2 million, re — lecting a consistent upward trend in annual — iling volumes. See also FinCEN, SAR Stats (FinCEN online database updated annually). 201 The most rigorous assessment o — the relationship between SAR volume and law en — orcement outcomes is Peter Reuter & Edwin M. Truman, Chasing Dirty Money: The Fight Against Money Laundering 123–45 (Peterson Inst. — or Int’l Econ., 2004). Reuter and Truman examined the evidence that the AML — ramework achieves its stated objectives and concluded that the evidence o — e —

ectiveness, relative to the resources expended, is limited. See also John A. Cassara, Money Laundering and Illicit Financial Flows: Following the Money and Value Trails 211–27 (2020). The — igure sometimes cited is that law en — orcement agencies review approximately one percent o —

iled SARs as investigative leads, and prosecutions

rom SAR-initiated investigations represent a — raction o — that. The precise rate is contested and varies by jurisdiction; the academic consensus is that it is substantially below the rate that would justi — y the reporting volume on e —

ectiveness grounds. 202 George A. Akerlo — , The Market — or “Lemons”: Quality Uncertainty and the Market Mechanism, 84 Q.J. Econ. 488 (1970). Akerlo — shared the 2001 Nobel Prize in Economic Sciences with Michael Spence and Joseph E. Stiglitz, in part — or this contribution. The paper was — amously rejected by three leading journals be — ore publication; the initial re — eree reports described the result as “trivial” and queried whether it could be correct. For subsequent development o — the in — ormation asymmetry — ramework, see Michael Spence, Market Signaling: In — ormational Trans — er in Hiring and Related Screening Processes (1974); Joseph E. Stiglitz & Andrew Weiss, Credit Rationing in Markets with Imper — ect In — ormation, 71 Am. Econ. Rev. 393 (1981). 272 Judgment Proo —

203 For a description o — how sophisticated — inancial crime organizations adapt their transaction structures to compliance monitoring requirements, see Gary Shi —

man & Cynthia Reese, The Business o — Terror: Mapping Terrorist Financing (2006); see also Financial Action Task Force, Pro — essional Money Laundering (2018) (documenting the role o — pro — essional intermediaries (attorneys, accountants, corporate service providers) in structuring transactions to produce clean compliance pro — iles). The FATF report speci — ically discusses the “gatekeeping”

unction o — pro — essional advisors who structure entities and transactions to minimize detection risk. 204 The hypothetical is composite and representative. The structural — eatures (the anomalous legitimate transaction — lagged — or review, the structurally sophisticated illegitimate transaction that passes) are documented in the empirical literature on AML e —

ectiveness. See Brigitte Unger et al., Money Laundering in the Real Estate Sector 67–89 (2018) (documenting the use o — legal entity structures in real estate transactions to avoid SAR triggers); see also Global Financial Integrity, Illicit Financial Flows to and — rom Developing Countries: 2005–2014, at 22–28 (2017) (describing the mechanisms by which sophisticated actors structure cross-border trans — ers to avoid monitoring thresholds). The wire trans — er timing (“three seconds”) re — lects the operational reality o — automated transaction clearance through correspondent banking networks — or transactions that do not trigger monitoring — lags. 205 LexisNexis Global Report, supra note 1, at 4. The survey methodology is described at pages 2–3; the $274 billion — igure represents responses — rom — inancial services organizations across the United States, Canada, the United Kingdom, France, Germany, Italy, the Netherlands, Spain, Brazil, Mexico, South A — rica, Australia, Hong Kong, India, Japan, and Singapore. The survey captures direct compliance costs; methodological limitations are described at pages 3–4. 206 FinCEN, Annual Report FY2023, supra note 3, at 14. The ten percent year-over- year increase is approximate, derived — rom comparison o —

iscal year 2023 — igures to the prior three-year average cited in the same report. The consistent upward trend in annual SAR — ilings re — lects both expansion o — reporting entity categories and expansion o — reportable transaction types under successive regulatory guidance. 207 Reuter & Truman, supra note 4, at 138–45. Reuter and Truman note speci — ically that the absence o — reliable data on the volume o — money laundered be — ore and a — ter the introduction o — the AML — ramework makes e —

ectiveness evaluation inherently di —

icult. This methodological point itsel — re — lects the knowledge problem: the phenomenon the — ramework is designed to prevent is not directly observable, so the — ramework’s e —

ect on the phenomenon cannot be directly measured. What is measurable is the volume o — compliance activity. See id. at 139 (“The best that can be said is that no one knows whether the system is e —

ective.”). Notes and Re — erences 273

For a more recent assessment reaching similar conclusions, see Brigitte Unger, The Scale and Impacts o — Money Laundering (2007). 208 Reuter & Truman, supra note 4, at 123–35 (concluding that “the evidence that the existing AML regime works as intended is disturbingly thin” relative to the scale o — resources devoted to compliance). For a more recent assessment reaching similar conclusions, see Brigitte Unger, The Scale and Impacts o — Money Laundering (2007). 209 Maimonides, Mishneh Torah, Hilkhot De’ot 2:6 (R. Eliyahu Touger trans., Moznaim Publishing) (discussing the prohibition on deceiving others through

alse impressions created by actions or circumstances, not only through — alse statements). The concept appears also in the Talmud at Chullin 94a, where the Sages hold that it is prohibited to deceive a gentile just as it is prohibited to deceive a Jew, establishing the prohibition as a universal moral principle rather than a sectarian one. See Aaron Levine, Case Studies in Jewish Business Ethics 3–22 (2000) (explicating the geneivat da’at concept and its commercial applications in the modern business context). The term geneivat da’at translates literally as “the — t o —

the mind” (geneivah, the

t; da’at, mind or knowledge), capturing the idea that deception through — alse impressions is a — orm o — taking (that is, taking the other person’s accurate perception o — reality) rather than merely a — ailure o — disclosure. 210 The Ravad’s glosses are printed in virtually all standard editions o — the Mishneh Torah, including the Vilna edition and modern critical editions. The gloss discussed here appears in Mishneh Torah, Hilkhot Teshuvah 3:7. For the intellectual context o — the Ravad’s critique, see Isadore Twersky, Rabad o — Posquières: A Twel — th-Century Talmudist 3–47 (1962). Twersky notes that the Ravad’s choice o —

the gloss

orm (rather than a separate tractate or responsum) was deliberate: “the gloss is the most intimate, irreducible — orm o — engagement with the text one is criticizing.” Id. at 44. 211 The Tribunal de les Aigües o — Valencia has been recognized by UNESCO as an element o — Intangible Cultural Heritage. For its governance structure and historical continuity, see Tom F. Glick, Irrigation and Society in Medieval Valencia 63–91 (1970); Elinor Ostrom, Governing the Commons: The Evolution o — Institutions

or Collective Action 69–82 (1990) [hereina — ter Governing the Commons]. Glick documents the tribunal’s structure as o — the tenth century, with elements o — the canal network predating Arab rule. The oral proceeding — ormat and the Thursday schedule are continuous — eatures o — the tribunal’s operation. 212 Garrett Hardin, The Tragedy o — the Commons, 162 Science 1243 (1968). Hardin’s model assumed that common-pool resources were either (a) subject to private property rights or (b) subject to state regulation, and that arrangements lacking both would collapse. The empirical literature on success — ul commons governance (developed substantially a — ter 1968) documents the third category Hardin’s model did not accommodate. 274 Judgment Proo —

213 Ostrom, Governing the Commons, supra note 1, at 88–101 (describing the Alicante and Valencia huerta systems), 61–65 (describing the törbel commune in Switzerland, where alpine meadow and — orest governance has been documented since 1224), 69–82 (Japanese iriaichi common lands, documented governance arrangements — rom the seventeenth century through the twentieth). For the Balinese subak irrigation system, see J. Stephen Lansing, Priests and Programmers: Technologies o — Power in the Engineered Landscape o — Bali (1991), documenting the water temple networks that coordinated rice cultivation across watersheds — or centuries be — ore the Indonesian state’s Green Revolution interventions and the collapse o — coordination that — ollowed when those interventions displaced the water temples. 214 Ostrom, Governing the Commons, supra note 1, at 90 (stating the eight design principles). The list as I have presented it — ollows Ostrom’s ordering while elaborating each principle in the terms o — the present analysis. The principles as stated by Ostrom are: (1) clearly de — ined boundaries; (2) congruence between rules and local conditions; (3) collective choice arrangements; (4) monitoring; (5) graduated sanctions; (6) con — lict resolution mechanisms; (7) recognition o — rights to organize; and (8) nested enterprises ( — or larger systems). Id. at 90–102. For subsequent empirical validation across ninety-one cases — rom the commons literature, — inding that monitoring and graduated sanctions showed the strongest association with success — ul governance, see Michael Cox, Gwen Arnold & Sergio Villamayor Tomás, A Review and Reassessment o — Design Principles — or Community- Based Natural Resource Management, 15(4) Ecology & Soc’y 38 (2010), doi:10.5751/ES-03704-150438. 215 For the Alanya coastal — ishery and the lottery-based rotation system, see Ostrom, Governing the Commons, supra note 1, at 18–22. Ostrom studied the system in the early 1980s, documenting the September lottery, the seasonal rotation schedule, and the posting o — assignments in the co —

eehouse. For the New — oundland Grand Banks cod collapse, see Je —

rey A. Hutchings & Ransom A. Myers, What Can Be Learned — rom the Collapse o — a Renewable Resource? Atlantic Cod, Gadus morhua, o — New — oundland and Labrador, 51 Can. J. Fisheries & Aquatic Sci. 2126 (1994) (documenting the decline — rom 1960s abundance levels and the — ailure o — centrally managed quota regimes to incorporate local ecological knowledge). The moratorium was imposed in July 1992; estimates o — the population decline to approximately two percent o — historical levels are drawn — rom this source. The

ishery remains commercially nonviable. 216 Richard H. Thaler & Cass R. Sunstein, Nudge: Improving Decisions About Health, Wealth, and Happiness (2008); Cass R. Sunstein, Sludge: What Stops Us — rom Getting Things Done and What to Do About It (2021). Sunstein’s later work develops the concept o — “sludge” speci — ically as administrative — riction that imposes costs without reciprocal bene — its (paperwork burdens, waiting periods, redundant veri — ication requirements) and proposes a “sludge audit” methodology — or Notes and Re — erences 275

identi

ying and reducing it. The distinction I draw between sludge and constitutive — riction is not one Sunstein develops; his — ramework is primarily concerned with reducing — riction, not with identi — ying the category o —

riction

that is the institution’s substantive purpose.

217

On the bat kol declaring “both are the words o

—

the living God” regarding the

disputes o

—

Beit Hillel and Beit Shammai, see Babylonian Talmud, Eruvin 13b. The

Talmud’s preservation o

—

the school o

—

Shammai’s positions throughout the

Mishnah and Gemara, even where the ruling

—

ollows Beit Hillel, is a deliberate

editorial choice documented by the Talmudic tradition itsel

—

the minority opinion is preserved “ — or the generation that might need it.” See Babylonian Talmud, Eduyot 1:5 (Mishnah) (explaining that minority opinions are recorded so that — uture courts can rely on them when reconsidering the law). 218 Aristotle, Nicomachean Ethics II.4, 1105a17–b12 (Terence Irwin trans., 2d ed. 1999). The three conditions are stated at 1105a29–34: the agent must act with knowledge (eidōs), — rom choice (prohairesis), and — rom a — irm and stable character (bebaiōs kai ametakinētōs). Aristotle draws an explicit contrast with the arts: in the arts, the product’s quality matters independently o — how it was produced, but with virtuous acts, the manner o — production, particularly the third condition (the stable character), matters constitutively. For the relationship between habituation and character development, see id. II.1–2, 1103a14–1103b26; Rosalind Hursthouse, On Virtue Ethics 118–45 (1999). 219 John Locke, A Letter Concerning Toleration 23–28 (Patrick Romanell ed., Bobbs- Merrill, 1955) (1689). The relevant passage: “It is only light and evidence that can work a change in men’s opinions; and that light can in no manner proceed — rom corporal su —

erings, or any other outward penalties.” Id. at 27. Locke’s argument is speci — ically that the church cannot accomplish through compulsion what it can only accomplish through persuasion, because the object (genuine — aith) is an internal state that external — orce cannot reach. The extension to any coerced internal state is direct, and has been developed in the compliance context by Robert Eli Rosen, Risk Management and Corporate Governance: The Case o — Enron, 35 Conn. L. Rev. 1157, 1165–72 (2003) (arguing that the — ailure o — Enron’s compliance structures was partly a — ailure to understand that compliance documents cannot produce the internal orientations they describe). 220 Kenneth L. Lay, letter to o —

icers and employees, in Enron Corp., Code o — Ethics 1–2 (July 2000). The Code is reproduced in — ull as an appendix to William C. Powers, Jr. et al., Report o — Investigation by the Special Investigative Committee o — the Board o — Directors o — Enron Corp. (Feb. 1, 2002) [hereina — ter Powers Report]. For the accounting — raud and special purpose entity structures, see Powers Report at 3–28; U.S. Senate Permanent Subcommittee on Investigations, The Role o — the Board o — Directors in Enron’s Collapse, S. Rep. No. 107-70 (2002). The bankruptcy

iling is In re Enron Corp., No. 01-16034 (Bankr. S.D.N.Y. Dec. 2, 2001). The eBay 276 Judgment Proo —

auction price is reported in Richard Lacayo & Amanda Ripley, Persons o

the Year: The Whistleblowers, Time, Dec. 30, 2002. 221 The traditional apprenticeship model’s role in developing clinical judgment is analyzed in Kenneth Ludmerer, Time to Heal: American Medical Education — rom the Turn o — the Century to the Era o — Managed Care 166–90 (1999). For the speci — ic argument that genuine responsibility — or patient outcomes (including the possibility o — adverse outcomes) is essential to the development o — clinical judgment rather than incidental to it, see Gawande, supra note 7, at 11–34. 222 Alasdair MacIntyre, A — ter Virtue: A Study in Moral Theory 187–91 (3d ed. 2007). The de — inition o — a practice appears at 187; the distinction between internal and external goods at 188–91; the account o — how institutional pressures corrupt practices at 194–95. For the application o — MacIntyre’s — ramework to legal practice speci — ically, see Howard Lesnick, Listening — or God: Religious and Moral Voices in Legal Thought 125–47 (2004); — or medicine, see Edmund D. Pellegrino & David C. Thomasma, A Philosophical Basis o — Medical Practice (1981), anticipating MacIntyre’s

ormulation in the medical context. 223 Maimonides, The Guide — or the Perplexed pt. III, ch. 27 (Shlomo Pines trans., Univ. o — Chicago Press 1963) (c. 1190); see also Maimonides, Mishneh Torah, Hilkhot De’ot (Laws o — Human Dispositions) ch. 1 (discussing the cultivation o — virtuous character dispositions and the role o — practice in their development). The speci — ic point that wisdom must be cultivated rather than commanded is implicit in Maimonides’s treatment o — the relationship between law and character: the law creates the conditions, but the cultivation o — the soul requires voluntary engagement with di —

iculty. For the broader jurisprudential — ramework distinguishing bodily — rom spiritual per — ection, see Isadore Twersky, Introduction to the Code o — Maimonides (Mishneh Torah) 356–71 (1980). 224 Id. The distinction between bodily per — ection (tikkun ha-gu — ), which law can command, and spiritual per — ection (tikkun ha-ne — esh), which requires voluntary engagement, is — undamental to Maimonides’s jurisprudential — ramework. The Guide — or the Perplexed articulates this in the context o — the Law’s dual purpose (the wel — are o — the body politic and the wel — are o — the soul) and speci — ies that the instruments appropriate to each di —

er in kind, not merely in degree. See Twersky, supra note 5, at 356–71. The concept o — geneivat da’at appears in the Talmudic tractate Hullin 94a and is developed in subsequent rabbinic literature as encompassing any act that creates a — alse impression in the mind o — another, regardless o — the speaker’s intent; — or its application in commercial and institutional contexts, see Aaron Levine, Economic Public Policy and Jewish Law 56– 63 (1993). 225 Shannon Vallor, Technology and the Virtues: A Philosophical Guide to a Future Worth Wanting 32–43 (2016). The concept o — moral deskilling is developed at 36– 38, drawing on Harry Braverman’s account o — skill degradation in industrial labor, Labor and Monopoly Capital: The Degradation o — Work in the Twentieth Century Notes and Re — erences 277

(1974), and extending it to cognitive and moral capacities. Vallor’s central concern is that when moral work is o —

loaded to automated systems, “we lose not only the habit but the very capacity — or exercising” the relevant moral — aculties. Id. at 37. For the medical context, see Atul Gawande, Complications: A Surgeon’s Notes on an Imper — ect Science 13–34 (2002), describing the acquisition o — surgical judgment through supervised practice and the irreducible role o — error in developing clinical competence. 226 The debate over the purposes and methods o — legal education (between the case method’s development o — legal reasoning and the skills-based emphasis on producing practice-ready graduates) is canvassed in William M. Sullivan et al., Educating Lawyers: Preparation — or the Pro — ession o — Law 85–128 (Carnegie Foundation — or the Advancement o — Teaching, 2007) [hereina — ter Carnegie Report] ( — inding that American legal education develops analytical skill but provides limited — ormation o — practical judgment and pro — essional character). See also Roy Stuckey et al., Best Practices — or Legal Education: A Vision and a Roadmap (2007). 227 MacIntyre, supra note 4, at 30–31 (the “bureaucratic manager” as the characteristic — igure o — modernity, whose expertise is the manipulation o — means toward ends that are not themselves subject to rational evaluation); see also id. at 74–78 (the “emotivist sel — ,” which has lost access to the tradition o — virtue within which its choices could be rationally assessed). For the application to regulated pro — essions, see Donald C. Langevoort, Monitoring: The Behavioral Economics o —

Corporate Compliance with Law, 2002 Colum. Bus. L. Rev. 71, 77–85 (describing the structural incentives o — compliance roles that systematically — avor documentation over judgment). 228 See Frank Cooke et al., Outcomes-Based Competency-Based Education: Is the Theoretical Foundation and Practice in the UK Medical Schools Up to the Evidence — or Best Practice?, in Competency-Based Education in the Health Pro — essions 47–68 (2016). For a critical assessment o — competency-based medical education that speci — ically addresses the loss o — clinical judgment development, see Lorelei Lingard, Rethinking Competence in the Context o — Teamwork, in The Question o — Competence: Reconsidering Medical Education in the Twenty-First Century 42–69 (Brian D. Hodges & Lorelei Lingard eds., 2012). 229 For the relationship between Aristotle’s conditions — or virtue development and institutional design, see Lawrence B. Solum, Virtue Jurisprudence: A Virtue-Centred Theory o — Judging, 34 Metaphilosophy 178 (2003) (arguing that legal theory must attend to the character o — legal actors, not only the content o — legal rules, and examining the institutional conditions that develop or undermine judicial virtue). For legal education speci — ically, see Sullivan et al., supra note 10, at 88–120 (recommending conditions more closely resembling the apprenticeship model Aristotle’s account o — hexis implies). For virtue jurisprudence in the 278 Judgment Proo —

administrative context, see Amalia Amaya, The Tapestry o

Reason: An Inquiry into the Nature o — Coherence and Its Role in Legal Argument 211–40 (2015). 230 Charles B. Perrow, Normal Accidents: Living with High-Risk Technologies (New York: Basic Books, 1984), 4. Perrow introduced the concept o — “normal accidents” to describe — ailures that are the inevitable product o — systems combining tight coupling with complex interactions, not o — individual human error. 231 Karl E. Weick, “Educational Organizations as Loosely Coupled Systems,” Administrative Science Quarterly 21, no. 1 (1976): 1–19. Weick developed the concept o — loose coupling in organizational contexts, distinguishing between loosely coupled systems’ capacity — or localized adaptation and tightly coupled systems’ susceptibility to cascade — ailures. 232 Moses Maimonides, Mishneh Torah, Introduction (Hakdamah) (trans. Eliyahu Touger, Moznaim Pub., 1989). Maimonides states explicitly that his goal was to enable a reader to know the entire Oral Law without re — erence to any other work. 233 Moses Maimonides, Laws o — Rebels (Hilchot Mamrim), ch. 1 (Mishneh Torah). The distinction between the permissible intellectual disagreement o — a local court and the impermissible creation o — a practical split is elaborated in chapters 1–3. 234 Babylonian Talmud, Eduyot 1:5 (Mishnah). “Why do we record the opinion o —

the individual against the many, since the halakhah

ollows the majority? So that, i — a later court should pre — er the reasoning o — the individual, it will have an authority to rely upon.” See also Rabbi Judah’s statement that minority opinions are preserved “so that i — the times require them, they can be utilized.” 235 Babylonian Talmud, Eruvin 13b. “These and those [the rulings o — both the School o — Hillel and the School o — Shammai] are the words o — the living God.” The traditional explanation is elaborated in subsequent generations: Hillel’s ruling

ollows because his students were gentle, and because they studied the rulings o —

Shammai alongside their own. 236 The Hillel/Shammai Chesed/Gevurah — ramework is developed in R. Aharon Lichtenstein’s essays on the dialectic o — the two schools and in kabbalistic sources connecting the dispute to the divine attributes. See R. Yitzchak Luria (the Ari), Shaar HaGilgulim, ch. 34, §2 (on Hillel and Shammai as embodiments o — Chesed and Gevurah respectively). The teaching that the law will — ollow Shammai in the messianic era appears in Kuntres Acharon and related sources. 237 James C. Scott, Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed (New Haven: Yale University Press, 1998), ch. 8. Scott’s concept o — metis (the practical, local, situational knowledge that resists — ormal reduction) is developed in contrast to techne (technical knowledge) and episteme (theoretical knowledge), both o — which can be — ormalized and taught at a distance. 238 The COMPAS analysis is documented in Julia Angwin et al., “Machine Bias,” ProPublica, May 23, 2016. The tool predicted higher recidivism rates — or Black de — endants than white de — endants who in — act recidivated at the same rate or at lower rates. Notes and Re — erences 279

239 Elinor Ostrom, Governing the Commons: The Evolution o — Institutions — or Collective Action (Cambridge: Cambridge University Press, 1990). Ostrom’s eight design principles (including clearly de — ined boundaries, local monitors, and graduated sanctions) emerged — rom comparative study o — commons governance systems across cultures and centuries. For the application o — polycentric governance theory to complex adaptive systems, and the limits o — centralized scienti — ic authority in governing distributed resources, see James M. Wilson, Elinor Ostrom & Michael E. Cox, “Boundaries o — Science in Polycentric Governance o —

Complex Systems,” Journal o

Economic Behavior & Organization 90, supplement (2013): S2–S10 (arguing that polycentric governance enables the use o — knowledge distributed across multiple actors and scales in ways that monocentric governance structurally cannot). 240 Robert Ellickson, Order Without Law: How Neighbors Settle Disputes (Cambridge: Harvard University Press, 1991). Ellickson’s study o — Shasta County ranchers demonstrated that in — ormal, locally en — orced norms resolved disputes more e —

ectively and more justly than — ormal legal rules administered by external authorities. 241 Louis D. Brandeis, dissent in New State Ice Co. v. Liebmann, 285 U.S. 262, 311 (1932): “It is one o — the happy incidents o — the — ederal system that a single courageous State may, i — its citizens choose, serve as a laboratory; and try novel social and economic experiments without risk to the rest o — the country.” 242 Mata v. Avianca, Inc., No. 22-CV-1461 (PKC), 2023 WL 4114965 (S.D.N.Y. June 22, 2023). Judge Castel’s opinion imposed sanctions o — $5,000 each on attorneys Steven Schwartz and Peter LoDuca and their — irm, Levidow, Levidow & Oberman. The opinion is notable — or its detailed account o — the exchange between Schwartz and ChatGPT in which the AI con — irmed the existence o — cases that did not exist. 243 The concept o — geneivat da’at (literally “the — t o — the mind”) is codi — ied in Maimonides, Mishneh Torah, Laws o — Sales (Hilchot Mekhira), ch. 18, §1, and in the Shulchan Aruch, Choshen Mishpat 228:6. The prohibition encompasses not only explicit deception but the creation o — a — alse impression through architectural means, including the design o — an inter — ace that simulates understanding it does not produce. 244 Garry Kasparov described the centaur con — iguration and its unexpected competitive dominance in “The Chess Master and the Computer,” New York Review o — Books, February 11, 2010. Kasparov noted that the winning centaur teams were “not those with the best computers but the ones who were the best at instructing their machines.” The observation re — rames human-AI collaboration

rom substitution to augmentation through adversarial engagement. 245 Irving L. Janis, Groupthink: Psychological Studies o — Policy Decisions and Fiascoes, 2d ed. (Boston: Houghton Mi —

lin, 1982). Janis analyzed the Bay o — Pigs invasion, the Challenger disaster, the escalation o — the Vietnam War, and other 280 Judgment Proo —

institutional

ailures as products o — the groupthink dynamic in which cohesive groups suppress dissent and converge on bad decisions. 246 Julia Angwin et al., “Machine Bias,” ProPublica, May 23, 2016. The investigation documented that COMPAS predicted — uture crime at nearly twice the rate — or Black de — endants who did not reo —

end compared to white de — endants in the same category, and that white de — endants who did reo —

end were more likely to be rated low risk than Black de — endants in the same situation. 247 Elinor Ostrom, Governing the Commons, 88–102. Ostrom’s — ourth design principle (monitoring by users or by o —

icials accountable to users) is the governance analog to the adversarial audit: the monitor is embedded in the situation being monitored, accountable to the people whose behavior is being assessed, and able to distinguish normal variation — rom exploitative deviation. 248 Shannon Vallor, Technology and the Virtues: A Philosophical Guide to a Future Worth Wanting (New York: Ox — ord University Press, 2016). Vallor’s concept o —

“moral deskilling” (the degradation o

the moral judgment capacity that results

rom systematic delegation o — moral decisions to algorithms) grounds the havruta model’s prescription: the exercise o — moral judgment must be preserved architecturally because the capacity degrades when not exercised. 249 The Alanya — ishery documentation appears in Ostrom, Governing the Commons, 18–20, drawing on Fikret Berkes’s — ieldwork. The seasonal co —

eehouse lottery, the daily rotation system, and the en — orcement mechanism through the local gendarme’s o —

ice represent a governance system developed organically that satis — ies every design principle Ostrom’s comparative analysis identi — ied. 250 On the New — oundland cod — ishery collapse: Anthony T. Charles, “Fisheries Management in Canada,” in A Sea o — Change: Canada’s Marine and Freshwater Environments, ed. R. G. Randall and C. C. Christie (Ottawa: National Research Council o — Canada, 2007). The Department o — Fisheries and Oceans’ centralized quota management, driven by scienti — ic models developed without adequate local knowledge, — ailed to detect stock collapse until the cod population had — allen below two percent o — historic levels. 251 Thomas More, Utopia (1516), in The Complete Works o — St. Thomas More, vol. 4, ed. Edward Surtz, S.J. and J.H. Hexter (New Haven: Yale University Press, 1965). The etymological analysis o — More’s place-names (Utopia, Amaurot, Anyder, Hythloday, Syphogrant, Ademus) is documented by More’s editors; the puns were legible to humanist readers with Greek training and appear to have been recognized as such — rom the work’s earliest reception. 252 The Biosphere Two experiment is documented in Jane Poynter, The Human Experiment: Two Years and Twenty Minutes Inside Biosphere 2 (New York: Thunder’s Mouth Press, 2006), and in scienti — ic analyses o — the atmospheric — ailures in B.D.V. Marino and H.T. Odum, eds., Biosphere 2: Research Past and Present (New York: Elsevier, 1999). The stress wood de — iciency was identi — ied in subsequent Notes and Re — erences 281

botanical research on the

ailure o — trees to develop normal structural — iber in the absence o — mechanical stimulation. 253 James P. Carse, Finite and In — inite Games: A Vision o — Li — e as Play and Possibility (New York: Free Press, 1986). Carse’s distinction between games played to be won and games played to continue playing maps directly onto the di —

erence between the Sa — ety Machine’s terminal aspirations and the ongoing practice o — developing human judgment. 254 Alasdair MacIntyre, A — ter Virtue: A Study in Moral Theory, 2d ed. (Notre Dame: University o — Notre Dame Press, 1984), 181–203. MacIntyre’s distinction between the internal goods o — practices (goods achievable only through participation) and the external goods o — institutions is the philosophical — oundation — or understanding why the delegation o — pro — essional judgment destroys what it purports to preserve. 255 Hannah Arendt, The Human Condition, 2d ed. (Chicago: University o — Chicago Press, 1998), 7–9 (on natality), 175–247 (on action and the space o — appearance). Arendt’s analysis o — the distinction between labor, work, and action provides the

ramework — or understanding what is lost when the Sa — ety Machine eliminates the sites where action (novel, consequential, unscripted human judgment) was previously possible. 256 Hans Jonas, The Imperative o — Responsibility: In Search o — an Ethics — or the Technological Age, trans. Hans Jonas and David Herr (Chicago: University o —

Chicago Press, 1984), 26–37. Jonas’s argument that technological power creates intergenerational obligations and that the automation o — judgment severs the chain o — capacity transmission across generations grounds the temporal dimension o — the institutional argument this book has developed. 257 Amartya Sen, Development as Freedom (New York: Knop — , 1999), 14–20, 74–76. Sen’s capabilities approach (measuring development by the expansion o — what people can do and be, rather than by material accumulation) is the economic analog to this book’s argument that the Sa — ety Machine produces prosperity at the cost o — the capacities that make prosperity meaning — ul. 258 Ivan Illich, Tools — or Conviviality (New York: Harper & Row, 1973), 11–21. Illich’s distinction between convivial tools (which enhance user autonomy) and manipulative tools (which substitute managed dependency — or autonomous action) maps precisely onto the Oracle/havruta distinction developed in Chapter Thirteen. 259 Elinor Ostrom, Governing the Commons, 18–20 (Alanya). On the New — oundland cod collapse, see Je —

rey A. Hutchings and Ransom A. Myers, “What Can Be Learned — rom the Collapse o — a Renewable Resource? Atlantic Cod, Gadus morhua, o — New — oundland and Labrador,” Canadian Journal o — Fisheries and Aquatic Sciences 51, no. 9 (1994): 2126–46. The cod population — ell to approximately two percent o — historic levels be — ore the moratorium in 1992. As o — the date o — this writing, recovery remains negligible despite three decades o — reduced harvest.