Principle
Warrant: Derivation
Who bears the cost of a wrong clearance is decided before the first incident.
A wrong clearance in this domain can mean an injury, not a bad transaction, and everything on this page follows from that sentence.
01 · A wrong clearance can mean an injury
Warrant: Foundation
The error does not land in a ledger. It lands on a site.
Most judgements sold commercially are wrong in a recoverable way. A forecast misses and a budget is revised. A grade is generous and a price is corrected later. The loss is real, it is denominated in money, and money is the medium in which it can be argued about afterwards.
A clearance about industrial capability is not that kind of judgement. It says that this crew, this welder, this contractor is fit to be put in front of this specific piece of work, under these conditions, at this time. When it is wrong the consequence arrives physically. A joint fails under load. A lift is taken by somebody who has not done that lift. A turnaround overruns because the work that was cleared could not be performed. Somewhere in that chain a person is standing next to the outcome.
That single property changes what the surrounding legal design has to do. Where the loss is financial, an ambiguous allocation is merely expensive: the parties argue, and the argument is itself denominated in the thing that was lost. Where the loss is physical, the ambiguity is worse than expensive. It is resolved after somebody has already been hurt, by parties whose first instinct is to protect themselves, at the precise moment when nobody involved is capable of a calm reading of what was agreed.
So the question of who bears the cost of being wrong is not deferred to the point where it becomes urgent. It is answered while it is still abstract, which is the only time it can be answered honestly by everyone in the room.
An ambiguity about money is a dispute. An ambiguity about safety is a dispute held over a casualty.
- A clearance
-
A decision, rendered fresh at the moment it is asked for, that a named capability is fit for a named piece of work under named conditions. Never a certificate held and re-presented.
The shape of the thing itself is set out in what is sold.
- The allocation
-
The named rule that says, for each way a clearance can be wrong, which party carries the resulting cost. Written per relationship, agreed before anything is measured.
Fixed here, and used in this sense throughout the site.
02 · Decided in advance, per relationship
Not a clause that shifts the loss away. A rule that says where it goes.
The allocation is settled at the start of a relationship, in writing, as a term of the work rather than as a document appended to it. It is written per relationship, because the parties differ: the party who supplies the input, the party who performs the assessment and the party who acts on the answer are not arranged the same way on every job, and a rule that ignores that arrangement is a rule about nothing.
The method is to name the cases. A clearance can be wrong in a small number of structurally different ways, and those ways are known before any of them happens. Each one is written down. Against each one is written who was in a position to prevent it and where the resulting cost lands. That is the whole instrument: a short list of failure modes, each with an owner, agreed while the list is still hypothetical.
Naming the cases does something a general statement cannot. It forces the parties to say out loud what they are each responsible for supplying and maintaining, and the saying of it is most of the value. A relationship in which nobody can articulate which failures are theirs is a relationship in which nobody is managing those failures.
- 01 The cases are enumerated The structurally different ways a clearance can be wrong are written down while all of them are still hypothetical.
- 02 Each case is given a preventer For every case, the party who was in a position to stop it is named, by function rather than by goodwill.
- 03 Each case is given a destination Where the cost lands is stated in the same line, so prevention and consequence sit on the same party.
- 04 The list is agreed before anything is measured It is a condition of beginning the work, not a negotiation that follows the first difficult result.
A rule written while nobody is bleeding is a different object from one written afterwards.
03 · The cases, named
Three ways to be wrong, and three different owners.
The list below is the shape the term takes. It is short deliberately, because a list nobody can hold in their head is a list nobody applies. Each row pairs a way the answer can be wrong with the party who was best placed to prevent that particular wrongness, and states where the cost of it lands.
| The case | Who was best placed to prevent it | Where the cost lands |
|---|---|---|
| Stale input supplied by the operator | The operator. The record of who did what, on which equipment, to which revision of a standard, sits inside their operation and nowhere else. No assessment can recover a fact that was never handed over. | With the operator, because the missing fact was theirs to supply and its currency was theirs to maintain. |
| A miscalibrated instrument | This firm. An assessor who has drifted, a scoring step that has gone out of true, a model that has not been re-checked against what actually happened, are all internal failures of calibration. | Here. The instrument is ours, the drift is ours to detect, and the loss from a reading it produced is not passed downward. |
| A genuinely unforeseeable failure | Nobody. Some outcomes were not visible to any party at the time of the decision, and pretending otherwise after the fact is the most common way an allocation is quietly rewritten. | Where the term says it lands, by a share agreed at the start. The point is that the answer exists in advance rather than being invented under pressure. |
A disclaimer says the loss is not ours. A rule says whose it is.
04 · Why a rule and not a disclaimer
A general denial of responsibility transfers nothing and specifies nothing.
The ordinary alternative is a paragraph of general exclusion appended to the end of a document, disclaiming responsibility for consequences of any kind. It is the default because it is cheap to write and requires no thought about the work it is attached to. It fails in three separate ways, and the failures compound.
The first is that it transfers very little. A blanket exclusion attached to a judgement that a party was invited to rely on, in a setting with physical consequences, is exactly the kind of instrument that gets read narrowly by anybody with the authority to read it. A firm relying on it is relying on a protection whose extent it does not know, which is a strange thing to build a safety-critical relationship on.
The second failure is the important one. A disclaimer removes the incentive to specify. If everything is excluded in general, nothing has to be examined in particular, and the exercise of asking which failures are actually possible and who is actually positioned to stop them never happens. The document that was meant to manage the risk is the reason nobody looked at it.
The third is a matter of timing. A general exclusion does not decide the allocation, it defers it. The actual question of who carries the loss is left to be settled later, during the worst week the relationship will ever have, by people who are frightened and advised. Every party then discovers what they agreed to at the moment they can least afford to be surprised by it.
The document that was supposed to manage the risk is the reason nobody examined it.
05 · The effect is prevention, not protection
Each party knows in advance which failures land on it.
The reason to write the allocation this way is not defensive. A pre-agreed allocation is a mechanism for making failures less likely, and it works before anything goes wrong rather than after.
Consider what each party does once it knows which cases are its own. An operator who knows that stale input is theirs has a standing reason to keep the record current, because the currency of that record is now attached to a consequence they will meet. This firm, knowing that a drifted instrument is ours, has a standing reason to re-check assessors against held-out reference work and to re-check predictions against what actually happened, which is the same discipline the record is built on anyway.
That is the whole design. An allocation aligns the cost of a failure with the party who could have prevented it, so that ordinary self-interest points at prevention rather than at documentation. It is the same reasoning that decides the payer, and it produces the same kind of result.
Because the case of stale input is theirs, keeping the deployment history current stops being an administrative courtesy and becomes a live commercial interest of their own.
Because a miscalibrated reading is ours to carry, re-standardisation of assessors and re-checking of past claims are protected activities rather than costs to be trimmed.
Because some share of it is allocated in advance, no party has an interest in reclassifying a genuine surprise as somebody else's negligence once the answer is known.
The question the parties would otherwise be arguing about was answered on the first day, so the week after an incident is spent on the incident.
Allocation is a prevention instrument. Protection is only what it looks like from outside.
Principle
Warrant: Foundation
Every party knowing which failures are theirs is the safety mechanism.
The settlement is not read as a shield. It is read as a list of the things each party has undertaken to keep true, which is why writing it down changes behaviour long before any of the cases on it occurs.
06 · Part of the product, not paperwork around it
A firm that intends to be relied on settles this first, and treats the settlement as the work.
There is a version of this firm in which the allocation is drafted late, by somebody who was not in the room when the work was designed, and attached to the front of an engagement as a formality. That version has already conceded the argument. It is saying that the legal shape of the relationship is a wrapper around the product rather than part of it, and a wrapper is precisely what a disclaimer is.
The position taken here is the opposite one. A clearance is a decision another party takes physical risk on the strength of. What happens when it is wrong is therefore a property of the thing being sold, in the same way that its freshness and its checkability are properties of it. It belongs in the design, agreed before anything is measured, alongside who pays and what is contributed back.
None of this is a legal opinion, and this page states no view about any jurisdiction, statute or scheme. It is a description of how the relationship is designed, which is a question this firm answers for itself rather than one it waits to have answered for it.
It also sits inside a set. Whoever pays is whoever bears the cost of being wrong, in who pays. Access to the pooled record is conditioned on contributing to it, including unflattering outcomes, in reciprocity of contribution. What is enforced mechanically rather than promised is set out in assurance, and the drift a distributed network of assessors is re-standardised against is described in the centre and the network.
How the relationship fails is part of what is being bought.
The rule, as it binds
The allocation is named before the first incident.
For every relationship, the ways a clearance can be wrong are enumerated, each one is given the party who was best placed to prevent it, and each one is given the party who carries the cost. It is agreed in writing before anything is measured, it is a condition of the work rather than a preference about it, and it binds from the next engagement forward.
A firm that intends to be relied on for decisions with physical consequences cannot leave this to be discovered. The cost of naming the cases early is a harder first conversation. The cost of not naming them is an argument conducted over a casualty, by parties who each believe something different about what was agreed, at the one moment when being right about it matters most and is worth least.
Every claim that leaves here carries a dated, checkable statement about what happens next, and that claim is revisited: see closing the loop and the calibration ledger. Where the evidence runs out is stated in stated limits, and what is genuinely unresolved is published rather than settled by optimism in open questions.
The hardest conversation available on the first day is cheaper than any version of it held later.