The Dual Operating System

On the Monday evening, the man with excellence in his title went down two floors to find somebody, and he had not worked out on the stairs what he was going to say when he got there.

The report had arrived that morning and he had given it forty minutes and written the line for Tuesday’s deck before eleven. What he had not finished with was the appendix. Three of the sixty-one names sat in his own function, and one of them belonged to a process engineer he had put forward for a development programme in March — a nomination he had written himself, three paragraphs, and he could remember using the word initiative in the second one because he had thought at the time that it was a slightly lazy word and had left it in anyway.

Seeing that name under a heading about unmanaged usage did not make him angry either. What it made him feel was that he had recommended somebody on the strength of an impression, and that the impression had turned out to be correct in a way he had known nothing about, which is a stranger thing to sit with than being wrong.

The engineer was still at his desk with his coat already over the back of the chair. He is thirty-four. He came off the floor, which matters to all of what follows — six years as a setter on the presses before he did the qualification, and people who have done that job know, in a way that cannot be arrived at from an office, exactly which two steps of a changeover are the ones where it goes wrong.

He asked him what he had been using it for. He asked it badly, because he had not found a way of putting the question that did not sound like the first line of a disciplinary conversation. The engineer heard that, picked his coat back up, and said it was easier to show him.

So they walked out to the line at twenty past five, which is how the head of a function comes to be standing at a seal press in the second half of a shift, being shown something nobody had ever intended him to see.

The board is on a stand at the end of the machine, at the height of somebody standing at it, and it is the kind of board that exists to carry the shift’s numbers. There were no numbers on it. What was on it, in marker, in two colours, was the changeover procedure — the steps in the order they actually happen rather than the order the 2011 document lists them in, in German down the left-hand side, and beside it, line for line, the same steps in Turkish.

Two stations along, on another board, the same thing in Czech.

At the bottom of the German column, under a line he had ruled himself with the edge of a clipboard, were two items that appear in no controlled document anywhere in that plant: the two points in the changeover where it goes wrong, which he knows because for six years he was the person it went wrong for.

In the top right corner of the board there was a post-it. NICHT WISCHEN.

Underneath it, a second one, older, the adhesive gone brown at the edges, with the same two words on it in a different hand.

The executive asked about the post-its, which is the question anybody asks, and got the answer that the board had been wiped once in February by somebody doing a housekeeping sweep at the weekend who could not possibly have known what it was, and that putting it back had taken most of a Saturday shift, and that the second post-it had been written a fortnight later by a team leader on nights who did not trust the first one to be enough.

Then he asked the obvious thing, which is how a process engineer from the office comes to be writing Turkish on a board. The engineer said he does not speak Turkish. Nobody in the office does. He puts the controlled instruction into a chat tool on the machine at his desk, gets back a version in plain German with the steps reordered, asks for it again in Turkish and in Czech, and copies it onto the board by hand, which takes about twenty minutes and which he does on a Tuesday, usually because somebody on shift has asked him the same question for the third time and he would rather answer it once where they can all see it.

Eleven stations since April.

Asked whether any of it is written down anywhere that is not a whiteboard, he said there is a file. Somebody started it four years ago on a shared drive, and the night shift types things into it when there is time, and things get carried from one shift to the next in it, and he is not certain who owns it or whether anybody does. The two failure points from the bottom of the board are in that file, somewhere around row sixty, in German only.

He said all of this without preparing an account of it and without appearing to think that one was needed, which is the part the executive kept returning to afterwards. Asked why it had never come up, he said he had not thought of it as something that came up. Then he said, without being asked and without any change in his voice, that he did not know what would happen if somebody from the auditor’s side stopped at the board.

He was right to wonder, and the executive knew precisely what would happen, and it is worth being exact about it, because nobody in this story is behaving badly. A document that controls a safety-relevant changeover exists in one approved version, carrying a revision number and a signature, and that is not bureaucracy for its own sake — it is the mechanism by which a plant can say afterwards what a person on shift was told to do on a given day.

What is on that board is a second version of a controlled instruction. It is unapproved, it is machine-translated, and there is nobody in the quality department who can read the Turkish column to check that it says what the German says. The finding writes itself. The corrective action is a cloth, and the auditor who writes it up is doing the job the standard exists to make them do.

And the board is better than the document. It is in the language the crew reads, in the order the work happens, and it carries two pieces of information about how that press fails that exist nowhere in the plant’s controlled documentation and are otherwise held by one man and an unowned spreadsheet. Both of those things are true at the same time and neither cancels the other, and the executive stood in front of a whiteboard with two post-its on it and held both.

He went through what he could do about it, and there turned out to be four things. He could escalate it, in which case the board is wiped inside a fortnight, correctly. He could ask for the work instructions to be reissued properly in four languages, which is not a request but a project, with a scope and an owner and a budget line, and Chapter 8 has already explained what happens to the size of a thing that needs those. He could say nothing, which had stopped being available to him about ninety seconds earlier. Or he could leave the line that was already sitting in tomorrow’s deck.

Four routes, and every one of them ends with a clean whiteboard.

He did not think about Maria once that evening, and there is no version of the evening in which he would have. She is not in his function, she is not on the report, and in fourteen years nothing about her has ever arrived on his desk as a question — and a man who has just been handed a list of names does not go looking for the people who are not on it. The instrument missed her because of what it had been scoped to see. He missed her because she has never given him a reason to look, which is the same absence arriving twice by two entirely different routes.

The line stays in the deck. He thought about taking it out, on the walk to the car, and could not think what he would put in its place.

Two conditions, not one decision

Chapter 9 ended on a sentence that has been carrying a debt ever since, and this is where it gets paid. Both roads lose. Hiding costs the person continuously and loses the improvement eventually; surfacing risks losing the improvement immediately and, done badly, costs the organisation everything that person would have offered afterwards. I said then that what gives is the assumption that this is one decision.

It is two, and they are not merely different. They are opposed.

An improvement needs one set of conditions to survive being born and a different set to survive being twenty. At birth it needs privacy, no forecast, no owner other than the person building it, and time — the delayed assessment from Chapter 6, which is the only thing that lets a tool that clusters by supplier in week one become a tool that clusters by failure mode in week six. Every one of those conditions is a condition of being unobserved, which is the observation principle from the other side. What protects the embryo is that nobody is looking at it yet.

Adulthood needs the reverse of all of it. Documentation, because Chapter 9’s Nonaka argument says knowledge that stays in one head cannot be built on. A second user, because one user is a dependency. A name, an owner who is not necessarily the builder, a place it lives that is not a laptop, and somebody accountable when it is wrong on a Thursday. All of those are conditions of being seen.

So the resolution is a sentence about sequence rather than about culture, and it is the smallest thing this book has to offer.

Hide to survive birth, surface to survive adulthood. The submarine is a phase rather than a home, and almost every organisation runs one of the two states and applies it to everything.

There are exactly two ways to get this wrong and both are common enough to have a smell. The first is to apply the adulthood conditions at birth, which is Part II of this book in one line. The form in Chapter 6 asked for expected benefit in month zero. The gate in Chapter 4 asked for a case before there was anything to make a case about. Both were reasonable, both were the wrong test at the wrong time, and both produced the same result, which is that the thing either dies or goes under.

The second is to apply the birth conditions forever, which is the failure this book is least often accused of enabling and should be. Give everyone a capable tool, say nothing else, and you have built an efficient factory for producing submarines.

They work. They are not documented, they have no second user, and they leave the building in a laptop bag when their author transfers, which is next spring in Maria’s case and some other spring in everyone else’s. The continuous-improvement literature has been describing this failure in manufacturing for twenty years — local gains that regress when the conditions that enabled them turn out to have been one person. There are widely quoted figures about how fast that happens and I am not repeating them, for the reason given in Chapter 2, but the direction is not in dispute in any study I can find.

Which means democratisation is half an answer. It is the birth half, and it is the half that can be announced, and most companies stop there because stopping there produces a press release and the other half does not.

The other half is duller and it has a shape that the industry survey work keeps arriving at from a different direction. Organisations that get anywhere with this tend to formalise what their people were already doing rather than start from a platform decision, and the deployments that stick often began with somebody private who had worked it out and was then made a champion of it. Channel rather than ban. Which is the same conclusion Chapter 11 reached from the other end, since banning does not stop the work — it moves it somewhere you cannot see, and then you have lost the route as well as the visibility.

What big programmes are for

I want to concede something properly here rather than in a subordinate clause, because a reader who has got this far has every right to think this book is an argument against large projects, and it is not. Big programmes are the correct instrument for a class of problem that increments cannot touch. You cannot crowdsource a retooling. A new line, a platform migration, a change to the physical layout of a plant, a system that has to be replaced entirely or not at all — these have genuine capital indivisibility, they have coordination costs that only a programme structure can carry, and Chapter 5’s arithmetic about lumpy investment is not a critique of them but a description of why they are correct. An organisation that tried to reach those outcomes by letting four hundred people improve their own work would reach none of them.

The two are for different physics. And each has a failure mode that the other one does not.

Big programmes fail by escalation and by theatre. They become too large to cancel, they acquire a roadmap that ships slides rather than product, and the eighteen-month programme in Chapter 1 is still eighteen months from delivering when Maria builds her tool on a Sunday. Increments fail the opposite way. They work, they are never written down, and they evaporate — which is Chapter 7’s Improvement Time and the whole of the paragraph above.

So the target of this book has never been either category. It is the organisation that owns only one of them and forces everything through it. A company with only big programmes starves its increments, because an increment has no structural weight and therefore never attracts any attention, and Chapter 5 explained why that is a property of finite attention rather than a failure of anybody’s judgement. A company with only democratised increments watches its gains decay and never lands the bets that need mass. Both are one-system organisations. They fail differently and they fail for the same reason.

Which raises the obvious objection, and it is the one I would raise, because this book has spent an entire chapter demolishing exactly this kind of proposal. Improvement Time was a second system. So was twenty per cent time. Both were announced by somebody senior, both worked, and both thinned out into the past tense without anybody deciding anything, for the reason Chapter 7 gave — a cost line with no matching benefit line survives only as long as somebody with standing keeps defending it, which is to say about as long as that person’s tenure. Chapter 8 then made it worse, by showing that any structure large enough to be visible acquires a floor beneath which nothing is worth its attention. A second operating system that is a programme, a centre or a slot in the calendar is a thing this book has already buried twice.

The version I am proposing survives that test by being smaller than the things that failed it. It has no address, no head count, no director, no budget of its own and nothing to put in a planning round, because none of what follows is a programme. It is wiring. Who may see individual-level output from a monitoring tool, what that seeing is attached to, whether a person may change their own work without permission, how much money sits with the person rather than with the approver — every one of those is a standing arrangement rather than an activity, and a standing arrangement has no annual defender because it makes no annual request. Nobody has to protect it in February. There is nothing to withdraw.

It is exposed to a different failure mode from the one that killed Improvement Time, which is a smaller claim than saying it is easy, and it is the one I can defend.

Who pays

The cost objection arrives at about this point in every conversation I have had about this material, and it arrives in a specific and reasonable form. Not everybody should be on the frontier model. You cannot hand ten thousand people an unmetered account against the most expensive tier and expect the bill to be defensible.

That is true, and I want to give it away completely before doing anything else with it. Tokens are not free, the frontier tier is the expensive one by a wide margin, and a policy of putting everybody on the largest available model is a policy with a real number attached. Leapfrog argued at some length that the frontier is rarely the right tool for the routine task, that most of what a working engineer needs runs on something smaller, cheaper or open, and that the instinct to reach for the biggest model is usually an instinct about reassurance rather than about capability. Nothing here contradicts that. This book inherits it.

But watch what the cost argument actually produces when it is made in a room.

It almost never produces a cheap default that everybody may use freely. What it produces is a central team, an approval route, a quota, and a business case per use case — which is the capital gate from Part II wearing a different jacket. One-way-door caution applied to a two-way-door expense. And the moment that machinery exists, the scale threshold from Chapter 4 reappears with it, because only a use large enough to be worth an approval cycle can survive an approval cycle, and every improvement of the kind this book is about is smaller than that by construction.

Maria’s whole tool runs on about eighteen euros a month. The meeting required to approve eighteen euros a month costs more than the eighteen euros in its first sitting, and that is before anybody writes the form. I am offering that as an illustration rather than as a figure — I have not costed it and neither has anyone else — but the shape of it is not controversial to anybody who has sat in the meeting.

The flip is the part worth having, and it runs against the intuition. Central control is what produces runaway bills, not what prevents them. A person spending from a pool they do not feel spends without noticing, and a platform team asked to serve everybody optimises for coverage rather than for thrift, because coverage is what it is judged on.

Push the capability and a small real budget out to the person doing the work, and the person living inside that budget becomes efficient in ways no policy could specify — smaller model by default, cache the thing that gets asked twice, batch the overnight job, stop when the answer is good enough. That is the learning curve from Chapter 6 applied to spend, and it works for the same reason it works everywhere else, which is that the knowledge is where the work is.

So the shape is a cheap or open default that nobody has to ask for, a small owned allowance that the person controls and can exhaust, and a clear route to the expensive tier for the task that warrants it. This is stricter than central approval rather than looser. It just puts the discipline in the hands of the only person in the building who knows whether this particular call needs the big model.

What keeps it honest

Four governors, and the chapter does not work without them, because a resolution with no limits is a slogan.

Not everything needs to surface. Some tools are one person’s helper and should be left where they are. If somebody has worked out a way of drafting their own emails faster, that is not a governance event, it does not belong on a register, and hauling it into daylight produces nothing except a person who will not tell you about the next thing. Surfacing is a door offered, not a net thrown, and the test is whether anybody other than the builder would be worse off if it vanished tomorrow. Where the answer is no, leave it alone. Chapter 11’s report classified a scheduler asking how to phrase a supplier email alongside everything else, because it could not tell the difference and was never built to, and a human system that cannot tell the difference either is not an improvement on it.

Safety is not cost. Chapter 11 granted a class of legitimate reasons to look — data protection, audit trails under a quality standard, licensing, retention — and deferred them here, and separating them from cost-theatre is most of the work of building anything that functions.

There is a test that does most of it. A real constraint names a category of data: this may not leave the estate, that may not enter any model at all, cheap or expensive. A cost constraint names a category of spend: who may use which tier, and who signs. The first survives being made free — if the tokens cost nothing tomorrow, the data-protection limit is unchanged and every word of it still applies. The second evaporates. Run the objections in your own organisation through that and you will find they sort cleanly, and you will also find that the ones that evaporate are usually the ones being argued hardest.

And there is a hard line. In safety-critical and regulated work the gate is load-bearing and surfacing is not optional. The man with the whiteboard is inside that line, and the answer is not that he should be left alone, because he should not. An unverifiable translation of a safety-relevant instruction is a real finding, and the auditor who writes it up is doing their job.

But notice what the two-system question does to that case rather than what the one-system answer does. Under one system the only available move is removal, and removal is what happens, and the plant loses the only version of that instruction the crew can read. Under two, there is a second question available — how long does it take this organisation to turn a better page into the controlled page — and the answer to that question is a fact about the plant rather than about him. If it is a week, there is a second system. If it is eleven months and a project number, there is one, and the whiteboard was the workaround for it.

And futility eats all of it. Chapter 9 established that the belief that speaking up changes nothing does more damage than fear does, lasts longer, and is harder to reverse. A protected route that produces no visible response is not a neutral thing that failed to help. It is a demonstration, delivered to exactly the people who were willing to try, that trying does not work — and it teaches the lesson more efficiently than never having offered the route at all, because these are the people who took it up.

Improvement Time did not fail because two hours were insufficient. It failed because the third session was cancelled and there was never a fourth, and everyone in the room learned something that Friday morning that no subsequent programme has been able to unteach.

Bernstein’s four boundaries, made operable

Everything above is the shape. This is the part somebody can act on, and I take it from the same paper that carries the strongest evidence in this book, because Bernstein did not stop at the curtain. He set out what the boundaries around a zone of privacy have to be, and the reason his prescription is narrower than the story people tell about it is that he was describing a control system rather than a mood. There are four of them, and each translates almost directly onto the case this book is about.

Privacy around teams, not around individuals. The curtain went around a stretch of line, not around a person. Applied here, the immediate consequence is about the report from Chapter 11: a discovery tool that produces a row per named employee is doing the thing Bernstein’s factory stopped doing, and one that reports at the level of a function or a site answers the governance question without producing a list of names. The information an executive actually needs — is plant data leaving the estate, is there exposure under the standard, how much of this is happening — survives aggregation completely. The appendix is what does not, and the appendix is the part that was read.

Feedback separated from evaluation. This is the wiring question and it has a factual answer in every organisation. Does anybody who sees individual-level output from this data write, contribute to, or sign off a performance review for anybody who appears in it? Where the answer is yes, the instrument is evaluative regardless of what the covering note says, and Chapter 11’s meta-analytic finding applies: control-use is where the counterproductive behaviour comes from. Where the answer is no, and where the separation is structural rather than a promise about intent, the same data can be developmental and the harms are muted. Nothing about the sensitivity of the data changes between those two arrangements. Only the wiring does.

Decision rights separated from improvement rights. This is the one that matters most and the one almost nobody has, and it is a single sentence: you do not need permission to change how you do your own work; you need permission to change how anybody else does theirs. Maria has never had that distinction available to her. Her tool changes only her own afternoon and it has sat under nine months of the same calculation as a proposal to change the plant’s reporting standard, because her organisation makes no distinction between the two and processes both through the same gate.

Write the distinction down, for one department, and most of the fleet in that department has no reason to be submerged the following week. The improvement stays local, the person keeps the right to make it, and the moment it starts changing somebody else’s work it becomes a decision and enters the machinery — which is the correct place for it to enter, because at that point it is one.

Protected periods for experimentation. The trap here is the one Chapter 7 walked into, and the difference is worth being exact about. Improvement Time was two hours in a calendar, which is a cost line, which is why an escalation on the third Friday was always going to win.

A protected period attached to a piece of work rather than to a slot in the week has no cost line to defend: the thing is exempt from being assessed until an agreed point — a date, a number of runs, a first external user — and until then nobody asks what it is worth. That is Chapter 6’s delayed assessment written as a rule rather than as an accident, and it costs nothing, and there is nothing in it for a planning round to remove.

Put those four together and you have a system that is smaller than the problem it addresses and duller than any of the programmes that have failed at it, which is the strongest thing I can say for it.

The improvement is born unobserved and stays that way until it has become what it is going to be. The person building it is not deciding whether to break a rule, because there is no rule against improving your own work. When it starts to matter to somebody else there is a route with a name, and the route is short, and somebody has been down it in the last twelve months. And the monitoring that a regulated manufacturer legitimately needs runs at a level that answers the governance question and produces no list of names, so nobody learns the lesson that Chapter 9 spent itself on.

None of that requires anybody in the building to be braver than they are.

The route, described

Everything above this point is wiring, and wiring has a defect I should name before somebody else does. Its virtue is the one I have already claimed. A standing arrangement makes no annual request and therefore has no annual defender, and that is why I think it survives in a building where Improvement Time did not. But none of it is a thing a person does on a particular afternoon. Somebody with a budget and an org chart can read this chapter, agree with every line of it, and find that nothing whatever has changed by Friday — because agreement is not an action, and everything above describes a state rather than a move.

So here are three moves, with parameters in them.

Each is small enough that one manager can grant it without escalating. None has an address, a head count, a director or a budget line, and none of them goes into a planning round, so the survival argument from the last section applies to these as it applies to the wiring. And every number below is a starting value rather than a finding. They are the least-evidenced material in this book, the next section says so again in stronger terms, and they belong in something that can be corrected by the people who run them, because a book cannot be updated and a practice can.

The Protected Window

The one to build first, and the one that goes closest to the mechanism.

Criscuolo and colleagues found that bootleg effort raises innovative performance, and their explanation was delayed assessment — not avoided assessment, delayed. An idea in week one cannot survive a gate review, and the reason is not that it is bad. It is that it is young, and there is no path from the first version to the approvable version that runs through a meeting.

Which means the thing people are hiding to obtain was never permission to build; it is permission not to be judged yet. No organisation I know of offers that, so they take it by concealment, and the window is the legitimate version of what Maria has been stealing for nine months.

A manager grants an idea a fixed period — six weeks is my working number — with a hard cap on spend, five hundred euros or thereabouts, and one condition, which is that closing it costs nothing except the time already spent. In exchange the idea is exempt from assessment for the duration. No business case, no gate review, no steering committee, no status update, no alignment check against whatever large programme is currently running in the same territory.

What it requires at the end is one conversation. The person says what they learned, and the answer it does not work is a complete and acceptable one, which is the part most organisations will find hardest to actually mean.

The mechanism is doing something narrow and I want to be exact about it. It gives the person the single thing concealment was buying them, at a price the organisation can afford to pay openly, and it converts hidden work into visible work without applying the judgement that caused the hiding in the first place. Nothing else in this chapter does that in one move.

The open questions are real and I would rather set them down than pretend the design is finished. Six weeks may be wrong in either direction — long enough to reach a defensible version, short enough that a manager can grant it without asking anybody, and those two constraints may not overlap in every organisation. The end of a successful window is where I think this is most likely to fail, because the idea now has to enter the normal world and that transition is exactly the machinery the window was built to defer. Renewal may quietly reintroduce what the window was avoiding. And the largest one: nothing stops this becoming a programme with an application form, and it dies on the day it acquires one.

There is a last question I find uncomfortable, which is whether a window should be logged at all. Logging creates a record, a record creates visibility, and visibility invites the assessment the whole thing exists to defer. That is the observation principle turning up inside the design of its own remedy, and I do not have a clean answer to it.

The Answer Guarantee

Chapter 9 established that futility does more damage than fear, lasts longer, and is harder to reverse, and that silence from a manager’s side reads as futility from the other regardless of what was actually happening. So: every idea raised gets a response within a fixed number of days. Ten working days is the starting value. The response is the deliverable rather than the decision, and it includes no.

A no with a reason attached preserves the relationship and preserves the person’s willingness to raise the next one, both of which are worth more than the idea usually was. Nothing at all teaches a lesson that lasts a career. Maria at twenty-six would have had her answer in ten days, and the answer would probably have been that the queue was not going to be resorted, and she would still be raising things at thirty-seven.

Reliability matters more than speed here, which is why I would rather see fifteen days kept than five days promised. An unkept guarantee is worse than no guarantee, because it demonstrates the thing it was built to disprove, to exactly the people who were willing to test it.

Two questions I cannot answer. Who owns the response when an idea travels upward past the first manager, which is where most of them are lost. And how to track it without building a system that becomes its own small bureaucracy.

The Reversible Router

Chapter 5’s one-way and two-way doors, turned into two questions asked before any approval process engages.

Is this reversible? Is it under the threshold?

Both yes, and it skips the process entirely. The router’s only job is to stop two-way doors receiving one-way-door treatment, and it is triage rather than evaluation — it does not ask whether the idea is good, which is the question that has no useful answer in month zero anyway.

Who sets the threshold is a real question and the level decides whether anybody believes it. And the router can defeat itself faster than either of the others: a form to fill in proving that something is reversible is a gate, and a slower one than the gate it replaced. The only version I can defend is a written standing statement rather than a check somebody performs.

Together they are a route, which is the thing part five of the instrument below is about to ask you to write down. The router decides whether a thing needs to be inside the machinery at all. The window covers the period during which it cannot defend itself. The guarantee is what happens when somebody brings you something regardless of any of this, which they will.

None of the three is new. Every good manager I have worked for has done versions of all of them, quietly, for people they knew well. What makes them a route rather than a favour is that they are written down, they have numbers against them, and they are available to somebody the manager has never had a reason to look at.

Where the evidence stops

The diagnosis in this book is better evidenced than the cure, and the gap is wide enough that I would rather open with it than have it found.

The title is Kotter’s and the argument is not. John Kotter named the dual operating system in Harvard Business Review in 2012 and expanded it the following year in Accelerate, and anybody who has read him will recognise the phrase on this chapter’s first page. His second system is a network: a volunteer coalition drawn from across the hierarchy, with a guiding structure and a strategic change agenda, running alongside the management hierarchy and working on initiatives the hierarchy is too slow to handle. What I have described is not that. It has no coalition, no volunteers, no agenda and nobody in it, because it is not a structure at all — it is a set of wiring rules about who may see what and who may spend what, applied to the hierarchy that already exists. Kotter’s answer to organisational slowness is to add a second organisation. Mine is to stop the first one destroying what its own people build. I am borrowing his name for the shape of the problem, which is two things running at once at different speeds without one consuming the other, and departing from him on the remedy. It should also be said that his framework is a practitioner model rather than a research finding, and I have not found a controlled test of it in either direction.

Everything in Parts II and III rests on documented mechanisms — capital lumpiness, attention as a zero-sum resource, promotion for visible events, programme decay, the voice and silence literature, and Bernstein’s controlled result. This chapter rests on a smaller and more contested body of work, and on an assembly of it that is mine. Read the two at the same confidence and you will be over-trusting the second one.

Ambidexterity is supported and it is not settled. The idea that an organisation can run exploration and exploitation at once, and be better off for it, has meta-analytic support: Junni and colleagues pooled sixty-six studies in 2013 and found a positive and significant relationship with firm performance. Against that, Mathias published a meta-analysis in 2014 covering a hundred and seventeen studies and more than twenty-one thousand firms, and found that ambidexterity yielded weaker effects than a focus on exploration or exploitation alone — the opposite of the received position, and from a larger sample.

It is a book chapter rather than a journal article, and the replications of its result cluster in small and early-stage firms rather than in large ones, which is not the setting this book is about. That bounds it. It does not dismiss it, and nobody has shown the positive result holds cleanly in a manufacturer of the size I have been describing either.

Psychological safety is the robust part, and its own author supplies the caveat. Frazier and colleagues pooled a hundred and thirty-six samples and more than twenty-two thousand individuals and found psychological safety related to information sharing, learning behaviour and performance, with the sharing and learning links strongest. Edmondson’s own framing is the one to keep: it is the engine, not the fuel. Necessary, and on its own insufficient, which is Chapter 9’s fear-and-futility split arriving from the literature rather than from the argument.

The four boundaries were designed for an assembly line. Bernstein set them out for zones on a production floor in a Chinese contract manufacturer, with a defined standard method and operators deviating from it. Everything in the section above is my translation of them onto knowledge work and AI tool use, and no part of that translation has been tested. The decision-rights-versus-improvement-rights distinction is the piece I am most confident in and the piece with the least behind it, and those two facts sitting together should make anybody uncomfortable, including me.

The token argument has no study behind it at all. That central control produces worse spending discipline than local ownership is an argument from the learning curve and from ordinary experience of how budgets behave. Nobody has run it. The line about approval costing more than the thing approved is an illustration, and it is flagged as one where it appears. If somebody measures this properly and finds that centralised AI procurement is cheaper per unit of value delivered, that section is wrong and the rest of the chapter is unaffected.

And channel-don’t-ban rests on survey work. The observation that organisations succeeding with AI tend to formalise what employees were already doing, rather than start from a platform decision, comes from industry survey research rather than from a controlled comparison. It is consistent with everything else here, which is a reason to find it plausible and not a reason to treat it as demonstrated.

And the three mechanisms have numbers in them that nothing supports. Six weeks. Five hundred euros. Ten working days. Each of those is research turned into something a person can grant on a Tuesday, and the research is silent about where any of the dials should sit, because nobody has run the experiment that would tell you. I have set them where they look plausible to somebody who has sat in the meetings, and that is the whole of the justification. If somebody runs a three-week window and it works as well as a six-week one, the parameter is wrong and the mechanism is not, and I would rather that were found out quickly by people running them than defended slowly by me.

Here is the study that would settle it. Take one company with more than one comparable site. In one site, change the wiring and nothing else: write down the decision-rights and improvement-rights distinction, firewall any monitoring output from anybody who writes a review, put a small owned budget in the hands of the people doing the work, and set a protected period rule. Change nothing at the other site.

Then measure, over two years, the one number that matters — not tool usage, which will move for reasons that have nothing to do with any of this, but the rate at which employee-built tools are voluntarily shown to somebody with authority, and the rate at which they survive being shown. If that rate does not separate between the two sites, the resolution in this chapter is wrong and the diagnosis in the first eleven stands on its own.

The problem with that study is the problem with every study I have asked for in this book, and by now it should be recognisable. Announcing it is an observation event. The site that knows it is the treatment arm has already been changed by knowing, and the honest version needs the two arrangements to be ordinary facts about how each site runs rather than an experiment anybody has been told about — which means a longer, duller, more expensive design than anyone is likely to fund.

Next: Chapter 13 — whether the technology that caused all of this is also the thing that ends it, and what Tuesday actually does to the choice Chapter 1 opened with.