How a rule is earned.
Behaviour changes by writing rows you can read, audit and delete. There are no weights, no gradients and no training run — which means there is nothing latent, and the learned state is the explanation.
Four steps, each with a gate
- An event writes a card. The bucketed situation, and the action taken. Bucketing is the only abstraction step and it is declared in one place so it can be argued with.
- Evidence accrues past a relative bar. A signature must be seen enough times, be lethal in absolute terms, and clear a 95% Wilson lower bound several times the base rate. The bound is what stops one unlucky event becoming a superstition.
- The card becomes a rule that removes the action from the admissible set — and the rule must name the hazard it answers or it is refused.
- The rule is traced. 30 rules expand to 203 canonical evidence tiles, chained parent-to-child, so one veto walks back to every event that justifies it.
An absolute gate was tried first and produced 0 rules from 268 real failures. In an environment you survive 99.5% of the time, a situation that kills you 5% of the time is ten times more lethal than normal and must be blocked — yet it never approaches an absolute threshold. The bar had to be relative to the base rate. That is a measured design decision, not a preference.
What a veto reads like
left is removed from the admissible set when bomb dx+0 drop0:
died 4 of 4 times (100.0%), 5.2× the base rate
← experience #0040
← experience #0042
← experience #0171
← experience #0203
Counts, a comparison to the base rate, and the individual events by identifier. Delete a row and the behaviour changes. There is nothing else in there.
What a confidence score cannot do
0.94 cannot tell you which events made it 0.94. You cannot delete one of them. It cannot say “I have no grounds.” It degrades silently, and after an incident there is nothing to read.
What this does instead
Names the hazard, cites the evidence, exposes the threshold it cleared, and can be edited by a human who disagrees — with the edit itself visible in the next trace.
The word we avoid
We do not call this “no ML.” It is learning — behaviour changes from experience. What it has is no weights, no gradients and no training run. The distinction matters because the claim we are making is precise and the sloppy version is easy to dismiss.
Nor is the category new. Removing unsafe actions from a choice set at runtime is shielding (Alshiekh et al., 2018) and the safe-RL work around it; learning rules from failure goes back to explanation-based learning in PRODIGY, case-based failure-driven memory in CHEF, and Ripple-Down Rules. What is ours is narrower: the shield is learned from raw experience rather than synthesised from a written specification, every veto is individually auditable, and the saturation point is measured.
Next
Chapter 5 — the artifact this produces, and how to evaluate it without deploying it →