Three of the twelve laws share a grammatical shape. Law I says capability does not imply authority. Law II says the absence of observed failure is not renewal. Law XI says success is not a license to expand. Each names something true about a system and denies that it settles something about the system’s authority. Read separately, they look like three cautions. Read together, they are one principle applied three times. The method depends on that principle more than on any single law.
The default inference
Institutions convert facts into permissions constantly, and mostly without noticing. A tool becomes reachable, so it is used. A model gets better, so its scope widens. A system has run for a year without visible incident, so the question of whether it should keep running stops being asked. A pilot goes well, so the second site is a rollout rather than a second decision. In each case a property of the system, something measured or observed, is treated as a grant. A grant is something an institution makes.
The conversion is not stupid. Capability is evidence that a wider grant might be justified. A clean year is evidence that the original grant was sound. Success is evidence that expansion could go well. The error is not in treating these as evidence. It is in treating them as the decision, so that the grant widens or renews with no moment at which anyone was responsible for widening or renewing it.
That missing moment is the whole problem. Authority that grew without a decision has no record of what justified it, no scope that anyone chose, and no one whose name is on it. When it later has to be narrowed, there is nothing to narrow it back to.
Why the refusal has to be structural
A rule that said “do not confuse capability with authority” would be true and useless, because nobody confuses them on purpose. The conversion happens in the gap between two systems of record: the one that tracks what a system can do and the one that tracks what it may do. Where those are the same system, or where the second does not exist, the conversion is automatic. The permission surface is whatever the capability surface happens to be.
So the method does not state the refusal as a rule of conduct. It states it as a boundary between objects. Capability lives in a catalog, discovered and tested. Authority lives in a grant, with a holder, a scope, a basis, and an expiry. The catalog cannot write to the grant. A capability that appears in the catalog and not in the grant is reachable and refused, and the refusal is a check a harness can run rather than a norm a reviewer has to remember.
The same construction carries the other two laws. Renewal is a transition on the grant with a recorded basis, and the grant carries an expiry, so it cannot renew by the passage of time. Expansion is a transition on the grant with its own evidence and its own check of correction capacity, so a grant cannot widen by accretion. In each case the fact that tempts the conversion is still recorded, as evidence, in the place evidence belongs. What it cannot do is cross into the authority object on its own.
Other conversions
The three laws are the cases that matter most for delegated systems. They are not the only ones.
Capacity into entitlement. The dependence essays describe a fourth conversion. An institution sees that people can compensate for its defects. It starts to assume they will. The assumption becomes a routine requirement, and the requirement becomes something operations cannot run without. The error is the step from capacity to obligation, and successful compensation keeps alive the conditions that make compensation necessary. The method refuses the step through the principle of non-expropriation of resilience: a person’s capacity to adapt to an institution’s defects does not, by itself, give the institution a claim on that adaptation. When people routinely cover a predictable, correctable defect with unrecorded effort, good outcomes do not show that the arrangement is adequate.
Reliance into direction. A fifth conversion treats a population’s reliance on an institution as license to direct it, rather than as a duty the institution owes.
Rescue into performance. The essay on absorption describes a sixth. A metric that improved because someone caught the failure is read as a metric that improved.
Model boundary into world boundary. The seventh conversion underlies the rest. It treats what a formal system cannot represent as if it did not exist, no longer mattered, or had been removed from the world.
A formal system does not eliminate what it cannot represent. It moves the burden of dealing with it. Technocratic rationalism assumes closure without remainder: if an edge case, social cost, or human context cannot be captured in the model, it is treated as settled. Leaving a variable out does not remove its consequences:
not represented ⇒ unresolved
When an institution acts on an incomplete model, the omitted reality collides with the action, and someone absorbs the mismatch. If the institution then treats the edge of its model as the edge of its accounts, every simplification becomes a cost pushed onto someone else. Refusing this conversion means holding that the boundary of a model is never the boundary of institutional responsibility. Whoever gains from the simplification may not push the leftover burden onto the people least able to refuse it.
The seven are different mistakes. Each starts from a different fact and arrives at a different permission. What they share is the direction of the refusal: nothing passes from the observed to the authorized without a decision.
Theory, drawn
The non-conversion principle: what a capability may not become
A fact about a system does not become a fact about its authority on its own. Nothing passes without an explicit, recorded decision. The drawing shows five of the seven conversions, numbered as the essay numbers them.
A principle, unlike a habit of suspicion, says when conversion is permitted. Conversion is permitted through an explicit state transition, recorded, with the fact that motivated it attached as its basis. That is a positive procedure, and it is what the authority grant and its state history exist to carry. The principle does not forbid an institution from widening a delegation because the system got better. It forbids the widening from having happened without anyone doing it.
What the principle permits
Authority does not have to be hard to get, and grants do not have to be narrow. An institution that trusts a system may grant it a great deal, and the method has nothing to say against that. The principle governs the route, not the destination. A wide grant made on purpose, with its basis written down, is exactly what the method is for. A wide grant that accumulated is what it exists to prevent.
Nor are facts about a system unreliable. Capability measurements, incident rates, and pilot results are the best evidence an institution has. Evidence is an input to a decision and not a substitute for one. The difference is only real where the two are held in different objects with a recorded transition between them.
What the laws take from this
Each law below is bound to clauses.
Law I: no increase in capability increases authorized agency, and authority expands only through an explicit state transition.
Law II: the burden of proof rises with the duration and consequence of a delegation, and the absence of observed failure is not renewal.
Law XI: expansion is not the default reward for success. It is a new authorization decision.
The other four conversions are argued here and bound nowhere. The three laws hold without them. A grant with no recorded basis cannot be audited, cannot be narrowed back to anything, and cannot be defended when someone challenges it.