Institutional Fallibilism 2.2.5

The Organizational Problem

Teams can revise their norms because teams are small enough for the revision protocol (2.2.4-2) to work through direct interaction. Organizations cannot. An organization of two hundred people, or two thousand, cannot steelman a dissenting view in a room. It cannot run a practice audit through consensus. It cannot revise a policy through conversation.

What an organization can do is embed the same method-over-canon principle into its structural architecture — its policies, governance mechanisms, and decision-making processes. That embedding is institutional fallibilism: the design principle that every rule, policy, and structure must include its own revision mechanism.

This is not organizational weakness. It is the only form of organizational integrity that survives contact with reality. An institution that cannot revise its own rules is an institution that has traded honesty (TO) for stability. And the stability it purchased is illusory, because an unrevisable institution cannot correct the errors that will eventually destroy it.

Phase 0 mapped Kelley's argument that certainty must be earned through method, not declared by authority (0.2.2). This unit applies that argument at organizational scale: no policy should outlive the conditions that justified it.

Sunset and Repeal

The most direct expression of institutional fallibilism is the sunset clause — a built-in expiration date for every policy, requiring active renewal rather than passive continuation.

The practice is concrete. Every significant organizational policy is accompanied by three elements: a justification (the problem the policy was created to solve, the evidence that supported its adoption), a review date (the date at which the policy will be evaluated against current evidence), and an evidence standard for renewal (what the policy must demonstrate to earn continuation). A policy that cannot demonstrate ongoing effectiveness at its review date does not automatically continue. It enters a renewal process identical in structure to the revision protocol's trial-and-confirmation step (2.2.4-2), scaled to the organizational level.

This sounds bureaucratic. In practice, it is the opposite. Organizations without sunset mechanisms accumulate policies the way buildings accumulate load — invisibly, incrementally, until the structure fails. Every policy imposes costs: compliance costs, administration costs, opportunity costs. A policy that no longer serves its purpose imposes those costs with no offsetting benefit. The sunset clause is the mechanism that prevents institutional weight from exceeding institutional capacity.

The sunset schedule is the organizational tool: a register of every standing policy, its justification, its review date, and the evidence required for renewal. The schedule is maintained by a named owner — a person or committee responsible for triggering reviews on time and ensuring that the evidence standard is applied honestly.

Policy Experimentation

Sunset clauses address existing policies. Policy experimentation addresses new ones. The principle is the same method that the individual applies through the weekly review and the team applies through the error-friendly retro: test before you commit.

Policy experimentation installs the scientific method into governance. A new policy is launched as a pilot — a bounded implementation with defined success criteria, a measurement period, and pre-committed decision rules for continuation, revision, or termination. The pilot is not a trial balloon. It is a structured experiment with three elements:

Success criteria. What must the policy demonstrate to warrant full deployment? The criteria must be specific, measurable, and agreed upon before the pilot launches. "It works" is not a success criterion. "Complaint rate decreases by 15% over six months" is.

Measurement period. How long will the pilot run before evaluation? The period must be long enough for the policy to produce measurable effects and short enough that the organization is not committed to a failing approach for years.

Decision rules. What happens at the end of the measurement period? Three options, each with pre-committed conditions: continue (the criteria were met), revise (partial success or changed conditions), terminate (the criteria were not met). The decision rules are set before the pilot begins — not negotiated afterward when sunk costs and political commitments cloud the evaluation.

Organizational Learning Cycles

Sunset clauses and policy experiments are specific mechanisms. The broader discipline is the organizational learning cycle: the recurring process by which an institution tests its assumptions, measures its outcomes, revises its practices, and deploys the revisions.

The cycle operates on the same structure as the individual fallibilist cycle (detection → attribution → repair → testing → recommitment), scaled to institutional tempo:

Test — implement a policy or practice with defined expectations.

Measure — collect evidence on whether the policy produced the expected outcomes.

Revise — if the evidence indicates a gap between expectation and outcome, diagnose the cause and modify the policy.

Redeploy — implement the revised policy, with a new measurement period and new success criteria.

The failure mode is learning theater — organizations that collect data without using it to change behavior. Learning theater is recognizable by the gap between measurement and action: the organization surveys its employees, publishes the results, and changes nothing. It runs pilot programs, declares success regardless of the data, and rolls out the policy unchanged. It creates dashboards no one reads and reports no one acts on.

The test of institutional fallibilism is concrete: Name one significant policy this organization has changed in the last year based on evidence. If the answer is "none," the institution is not fallibilist. It is stable — and stability without correction is brittleness waiting for a load case it cannot handle.

The Inheritance from Team to Organization

The team-level disciplines — disagreement-as-data, method-over-canon, the practice audit, the revision protocol, the update ledger — do not disappear at the organizational level. They are the building blocks from which institutional fallibilism is assembled. The sunset schedule is the organizational practice audit. Policy experimentation is the organizational revision protocol. The organizational learning cycle is the update ledger at governance scale.

What the organization adds is structural permanence. Team norms can change through direct interaction. Organizational policies require formal mechanisms because the people affected by a policy may never interact with the people who created it. The distance between decision-maker and decision-recipient is the structural condition that makes institutional fallibilism necessary — and the condition that makes it difficult. The next unit (2.2.6) addresses that difficulty directly: how to ensure that the people who detect errors can report them safely, and that the decisions they challenge are accompanied by reasons others can examine.