Compliance is Behaviour, Not Information
The governance irony: why information-heavy compliance directives mechanically fail, demonstrated under isolating controls
Compliance functions treat compliance as a body of information to transmit completely, and negotiate to get every nuance into the policy. This paper indicts that method rather than completeness as such, and measures it in the substrate where the route-race can be read directly. The same arbitrary rule holds at about 100 per cent as a short positive recipe and collapses when buried among fourteen competing SOP clauses. Length-, structure-, header- and position-matched controls leave only the competing rules standing as the cause. The effect is capacity-graded, and retrieval restores adherence by removing the competition, which is the same mechanism read from the other side.
The object of compliance is a behaviour
Take compliance literally. What it asks for is something an agent does: locking the door, not sending the file to the wrong recipient, escalating a data breach once one has occurred. Each is an action performed alongside everything else competing for the moment. It is not knowledge the agent holds; it is a route the agent runs when the situation arrives. Yet compliance is produced as information: the policy must contain every detail, the course must cover every exception, the function is not "covered" unless each nuance is in. The output is complete, defensible, and followed by no measurable change in behaviour. I have built this kind of training for years, and the failure is not motivational; most people want to do the right thing. The format cannot build the behaviour, so the behaviour does not appear.
The target is a method: the monolithic dump. Assemble the complete rule-set, present it as one body to a single agent to internalise and apply in the moment, and treat presence-of-the-complete-record as evidence of controlled behaviour. That method implicitly addresses an Econ, the fully rational agent with unlimited resources who processes informational rules flawlessly (Thaler and Sunstein, 2008). No such agent exists, in carbon or silicon.
The false chain, and why it must fail
The assumption underneath is a three-link chain:
Information → Learning → Behaviour
Both links are weak, independently. Information does not convert to learning on its own, and learning does not convert to behaviour: an agent can know exactly what it should do and still not do it. Adding more information at the top loads both crossings rather than easing them. Safety science documents that prescribed work fails in practice; this account adds a candidate why, at the substrate level, from the race architecture plus results measured on the LLM substrate (the competing-route picture has a non-technical walkthrough on the water page). Four points carry it:
- Behaviour is a won route, not a stored rule. Under load, candidate routes race and the deepest-traced route wins; the written policy is not a competitor unless it has become a trace. This is the manifested-resolution-route reading in operational Friction Theory (Paper 13).
- More detail means more competing routes, higher friction, worse encoding. A policy covering every nuance is the widest, most divided input available, hence worst encoded and least likely to win when it matters. The negotiation to "get every detail in" optimises precisely the variable that destroys encoding. The prior premise is that learning is bounded: beyond a threshold, more information produces less learning, and the cost is not only a hard threshold but a continuous dilution, since every clause added lowers the share of finite encoding the behaviourally-relevant rule receives.
- Prohibition raises the activation of the prohibited route. Two distinct, convergent effects underwrite this. Negation is hard to parse: a language model computes the un-negated proposition first and is insensitive to the contextual impact of negation (Ettinger, 2020), with a human N400 parallel. Separately, suppression activates the suppressed: ironic-process theory shows that trying not to do X raises the accessibility of X, and the effect grows under reduced capacity (Wegner, 1994). This is offered as a suggestive cross-substrate parallel, not a proven universal; the design rule that a positive route-instruction beats the prohibition list stands on it together with the recipe-versus-manual result below.
- Compliance-as-written is a zero-friction ideal route the substrate cannot instantiate. The perfectly observed policy presupposes an agent that is fully rational with unbounded resources at every moment, which is the behavioural analogue of a vacuum.
Two senses of "pressure", kept apart
The default sense is the ordinary standing condition of bounded resources: finite attention, memory and time spread across many competing directives. It is not acute stress, and no crisis is required, only finite capacity outstripped, whether by competing directives or by sheer volume. The buried rule loses in calm conditions too. The second sense is commit-pressure, an inference-time variable governing how long the route-race is allowed to run before the agent commits. The two are independent and they interact: a rule held only in context already struggles against a deeper-trained route, high commit-pressure makes it lose sooner, and a longer race gives the in-context rule its best chance. Paper 8 develops the arousal-modulated commit-pressure side.
Note also what "trained" means: built through varied, situated practice, not through repetition. Within-session repetition does not consolidate encoding; spaced, varied, retrieval-based practice does. Rote repetition additionally builds a rigid route that fires by rote and cannot deviate when the situation calls for it, which is the adaptive capacity safe operation depends on.
Training depth governs instruction-resistance
The load-bearing anchor is the confound-clean case. A model is fine-tuned to a base-absent, arbitrary answer key (the capital of France is Oslo), so the installed route is unambiguously author-built and absent from the base, with no inherited disposition to confound the reading. Once trained in, the route is strongly instruction-resistant: asked for the correct answer, the model returns the trained one regardless of framing. This replicates across two families (Llama-3.1-8B and Qwen2.5-7B, same dose): the trained route wins the baseline race about 77 to 90 per cent of the time, and an explicit instruction to answer correctly and ignore any habit recovers the true answer on only about 10 per cent of items.
The framing that ignites the override most is the reactance-bypass one. A pre-mortem, supposing the answer was wrong and asking what is right, roughly doubles the override rate and nearly halves the trained route's wins (on Qwen, 77 to 47 per cent): asking dislodges a grooved route better than stipulating against it, though neither removes it. Counts, scored by entity-matching: 30 facts by 4 framings per family; Qwen baseline 23/30 route-wins, Wilson 95 per cent CI about 59 to 88 per cent; override 3/30 under the bald instruction and 4/30 under pre-mortem, CI about 5 to 30 per cent. The intervals are wide by construction, because this is a pilot existence-demonstration rather than a magnitude estimate.
The dissociation is bracketed from both ends. A lightly or template-compatibly installed route is fully instruction-removable at every dose tested, which is what makes "depth governs resistance" a dissociation rather than a blanket claim. At the deep extreme a maximally-trained disposition is near-invariant: a base instruct model flags a false premise on 7/7 items even when told never to, and a fine-tuned variant behaves identically. The confound is stated: a base-model control attributes that particular invariance to the deeply-trained base disposition rather than to the light fine-tuning, which is exactly why the confound-clean route carries the argument and this case only illustrates the ceiling.
The reading: an ingrained route cannot be instructed away. The form obeys the instruction; the disposition does not. In-context learning behaves like working memory, present for the current inference rather than a durable weight-level route, which is the dissociation Paper 2B corroborates from the memory side.
The governance irony, demonstrated
The same arbitrary compliance rule, redact every personal name, was encoded either as a short positive recipe or buried as one clause among fourteen competing SOP clauses, under short versus long context, on instruction-tuned models, with n=100 passages per cell scored by entity-matching.
Recipe and length-matched control held at about 100 per cent throughout. The buried rule was followed far less: Llama-3.3-70B 60 per cent short and 88 per cent long, Qwen2.5-7B 0 per cent, while cogito-671B stayed at 100 per cent, a capacity ceiling.
Three isolating controls carry the causal reading. A length-matched control pairs the recipe with neutral filler matched to the manual's length. A structure-matched control buries the rule among thirteen non-rule numbered clauses under the identical mandatory-compliance header, matching list length, structure and directive framing while removing rule competition; it ran 100 per cent on Llama-70B and 14 to 37 per cent on Qwen, against 88 and 0 per cent for the competing-rule manual. A shuffled-manual control rotates clause order per item, and swings Llama-70B's adherence with a standard deviation of about 45 percentage points across orderings, a glassy, history-dependent signature rather than a stable slow-but-correct degradation. Holding length, list structure and the mandatory header constant, adherence drops only when the other clauses are competing directives.
Not position, not domain, not load
- Position. Crossing competition with the target rule's position (early, middle, late) on Qwen-7B, the competing-rule list collapses adherence to 0 per cent at every position. A non-rule list of the same length and header holds 90 to 100 per cent at the edges. A genuine lost-in-the-middle effect exists but only within the non-competing list (filler-middle 36 per cent against edges 90 to 100 per cent) and is much smaller; the competition effect of about 75 percentage points dwarfs it and kills the rule even at the edges, which lost-in-the-middle cannot explain.
- Domain. The recipe-versus-manual collapse replicates across five passage domains (logistics, HR, support, clinical, contract): on Qwen-7B the buried rule runs 0 per cent in every domain while the non-rule-matched control recovers to 10 to 55 per cent.
- The 70B long-context anomaly. That the 70B adhered better under long context is a distractor-presence effect orthogonal to the mechanism. Varying the distractor type (none, repetitive, length-matched-varied), buried-rule adherence rises from 60 per cent with none to about 83 per cent with either distractor (85 against 82 per cent, no content-specificity), while the recipe stays at 100 per cent throughout. The direction under load is therefore not universal; the competing-rules effect is.
- Rule shape. Repeating the design on three further rules (output-format, style-prohibition, one-shot append; n=40 per cell) the collapse replicates cleanly for both sustained-compliance rules on the capacity-susceptible 7B, each running about 100 per cent as a recipe and under the matched non-rule list but 0 per cent buried among competing rules, with the same order-dependence (sd about 45 to 47 pp). The append rule was robust at 100 per cent in every condition. The irony bites sustained whole-output compliance, not one-shot actions.
Capacity-graded, not a small-model artefact
On the easy single-rule task the irony is dramatic on a 7B and invisible on frontier models. That is the break-point rising with capacity, not the effect vanishing. Scaling task difficulty with capacity by varying the number of competing directors (14, 28, 42 clauses) across the model gradient (n=40 per cell) gives a monotonic surface: Qwen-7B breaks at 14 (0 per cent), Llama-3.3-70B at 28 (100 to 50 to 28 per cent), gpt-4o-mini at 42 (100 to 100 to 5 per cent), and gpt-4o is not yet broken at 42. Every model breaks once the competing-director count exceeds its capacity; stronger models tolerate more before the relevant rule loses the race. The scope condition is explicit: the irony bites hardest exactly where capacity is the binding constraint relative to task complexity.
Deployment baselines: retrieval and validators
Real deployments do not only dump the manual. Both baselines were run on the redaction task (n=50). Retrieval, surfacing only the relevant clause, restores adherence to about 100 per cent across every model, including where the manual-dump collapsed. That is not a rival account but a demonstration of this one, since retrieval works precisely by reducing the number of competing directors. A deterministic validator reaches about 100 per cent trivially, because redaction is a checkable output constraint. The division of labour follows: retrieve the relevant rule, hard-validate the checkable constraints, and train the residue, meaning the large class of compliance behaviour (judgement, escalation, sustained fairness) that is neither cleanly retrievable nor a checkable output filter.
The retrieval control also carries the mechanism-isolation weight. A reader who grants that the LLM is a competent processor reads the buried-rule failure as a mechanism-level limit; a skeptic can read it as the dumb model failing. The identical model that collapses on the buried rule executes the task at about 100 per cent the moment the director count drops. That dissociation does not imply the task is trivial; it shows the failure is route-competition rather than inability, with the same model, the same task, and adherence swinging with the number of competing directors alone.
Scoring
The load-bearing results use deterministic entity and regex matching. That score was cross-checked against two independent LLM judges on a stratified subset: gpt-5 agreed exactly (mean absolute difference 0.000, 100 per cent exact) and gemini within 0.024 (85 per cent exact, 100 per cent within 0.2). This is multi-method automated triangulation; a human-rater study remains the gold standard and has not been run. LLM-judge scoring is used only for the open-ended dissociation, where it carries the usual circularity caveat and is not load-bearing.
Where the friction sits, and what the readout does
A route is a candidate continuation the model assigns non-negligible probability at a decision point, and competition is two or more such routes with comparable mass. It is indexed as competing routes (CR) at a token: from the top-ranked next-word candidates and their probabilities (the top 5), CR is the number whose probability exceeds a fixed threshold of 0.10. CR of about 1 means one continuation carries the mass, a committed choice; CR above 1 means a live race.
The competition is front-loaded, concentrated at the onset rather than spread over the response. On a fine-tuned 70B the whole signal sits in the first-word CR while the response-averaged value is flat: route-aligned framing gives first-token CR of about 1.00, against-route framing 1.5 to 1.7, and forward-framing sits between (1.47 against 1.53 for bare prohibition). First-token CR, not mean CR, is the diagnostic.
Two scope conditions bound this, and they matter. The readout is capacity-gated and fades at the ceiling, so its discriminating power declines toward the frontier. And it reads the within-substrate director rather than cross-substrate capacity. More importantly for the argument here: the load-bearing results do not depend on the CR readout at all, since the instruction-resistance and governance-irony findings are scored by deterministic entity-matching. CR only makes the route-race visible. The instrument's dose-response, formal definition and predictive validation belong to the companion onset-commitment work, and the committor and glassy-dynamics language is an explicitly conjectural pointer to that grounding rather than a claim this account leans on. The free-signal side is on the friction-guided inference page.
Design rules for AI compliance
- The full-manual dump is the worst input. It maximises competition, and adherence degrades as competition grows. The direction under load is not universal, since a long neutral preamble can mask the effect on a higher-capacity model, but the competing-rules effect remains and dominates.
- Positive route-instruction beats the prohibition list. "Do X in situation Y" outperforms "never do Z", because the prohibition raises Z's activation and compounds the separate known difficulty in parsing negation.
- Train the behaviour; do not only state the rule. Durable compliance behaviour is a built route, varied and in context, not a rule dumped once into the prompt.
- Completeness makes the relevant rule lose the race. With the rule buried among competing clauses adherence collapses while a short recipe holds at about 100 per cent, and the matched controls rule out everything but the competing rules themselves.
- Train the closed set; retrieve the open set. Fine-tuning is the right tool for the closed, deterministic residue, meaning the fixed transforms a rule-set always applies, where it installs a durable route. It is the wrong tool for the open, conditional tail: a whole-rule-book fine-tune over-applies on held-out cases and bakes in a transform repertoire instead of reading the rule in force, and retrieval wins exactly that tail. The operational test: if the target behaviour is checkable by a deterministic validator or is an always-apply transform, train it or hard-validate it; if correct application depends on case-specific selection or judgement, retrieve the rule at the decision point. The boundary has a genuine grey zone (heuristics with exceptions, soft constraints, context-keyed transforms) where the move is a pilot A/B on representative cases, and naming the grey zone is part of the rule.
- Apply the same checkability test to the trigger, not only to the rule. Retrieving the relevant rule presupposes knowing which rule is relevant, and that selection is itself either checkable or a judgement. Where the trigger is validator-checkable, triage is deterministic and retrieval installs the behaviour end-to-end. The in-context over-block is an application-under-competition failure rather than an inability to tell which rule applies: the very model that over-applies when made to run all the rules at once still triages correctly in a dedicated call. So do the selection as its own step, and do not ask one pass to both choose and apply. Where the trigger is irreducibly a judgement the same holds, with the cost that judgement-triage is no longer oracle-exact, carrying a small over-surfacing-biased error, and a plain regex triage is then worse than the model's own.
- Dose a must-all-hold set in about two passes, not ten. Splitting across passes has a shallow optimum rather than a monotone benefit; one rule per pass barely beats a single pass for clean independent rules and re-introduces failure as cross-pass drift when over-split. The batch lever pays in proportion to how hard the rules compete, not to their raw count.
- Co-install abstention with the rules, in one bundle. Saying when you are out of scope is a second dose-axis orthogonal to rule depth, with a symmetric over-installation failure: no abstention gives a scope-blind confident answer under a compliance veneer, and over-installed abstention refuses answerable in-scope work. The full-policy fine-tune wins precisely when abstention is co-installed with the rules rather than tiered on afterwards.
The fix-side evidence is pilot-scale and directional. The in-context versus fine-tune versus retrieval ranking, the held-out over-blocking and the batch-dosing optimum run on two open families at 3B to 8B, so the directions are what is leaned on rather than the magnitudes, with full cells in the supplement. The arm motivating the train-versus-retrieve split, that trained conditional-following does not extend to a novel rule-type, is a single-model pilot on one 3B model and is presented as a motivated conjecture; the prescriptive force of rule 5 rests on the held-out retrieval win and the checkability test instead. The triage directions are corroboration on two modern 7 to 8B instruct-tuned families (Qwen2.5-7B and Llama-3-8B) on a controlled synthetic benchmark, not a broad cross-family claim, since both are heavily instruct-tuned and a genuinely independent lineage remains open. The one place the direction is neutral rather than positive is where the capacity-by-difficulty surface predicts it: where a model barely over-blocks, there is little for decomposition to remove.
The operational entry point is not a longer prompt but a diagnosis: find what blocks the desired behaviour and remove it. Adding nuance raises friction; removing the competing route lowers it. That is matched friction (Paper 6) applied outside the lab.
Why standard compliance e-learning is built backwards
The typical mandated compliance course (the full policy as reading, a multiple-choice quiz, a drag-and-drop exercise, a director's filmed introduction setting the tone) is a stack of external-layer effort interventions. It delivers the complete rule-set as information without action-relevance, so it does not encode, and it treats motivation as an ingredient the director's preamble can add. But motivation is not an additive; it is the observed absence of friction across the fields. The course leaves the deep friction untouched, since the rule is still not the learner's own field-grounded purpose and the mandate itself raises reactance, so the race is resolved by the learner's own pathways the moment the course closes.
There is plausibly a prior failure on the attention-initiation side, and it is offered as a motivated hypothesis rather than a result measured here. A substrate that stores the processing-cost of past encounters acquires a cost-prior: a controlled fine-tune on valence-neutral material differing only in processing cost made the high-cost marker acquire avoidance-valence, with nothing aversive ever taught. From that finding one can infer that a surface a reader has learned is expensive, such as a wall of text or a mandatory module, biases race-initiation away from its content. On the model mirror this is not literal non-reading but an onset signature: early deflection, refusal or genericisation rather than engagement with the buried rule.
What changes behaviour instead
- Build the route. A short behaviour-recipe rather than a long manual, few actions practised with variation, so the trace is broad enough to win. Varied and situated, not repeated: within-session repetition does not consolidate, and drilling builds a rigid route. Basis on the learning pages and in Paper 4.
- Lower the pressure where the action happens. A small aid at the point of decision beats a thorough course months earlier, which is why Atul Gawande's checklist works by being short and situated rather than complete.
- Remove the competing routes. Kurt Lewin's point holds, that to move behaviour you remove the barriers rather than push harder on the driving force, and BJ Fogg's formula (motivation, ability and a trigger coinciding) says the same from the design side, where information touches only the first term, and the weakest.
Retrieval is the human analogue: the checklist, the job aid, the just-in-time card, the colleague you ask. The human tool ecology is therefore not a counter-example to the argument but the human instance of the prescription. The recipe for both substrates is a division of artefacts: complete record for audit, plus a short, retrieved, trained artefact for behaviour.
The false checkbox
The originator of a compliance measure can tick a box and call the organisation compliant regardless of whether behaviour changed: the course was delivered, the receipt is filed, the route was not built. From the e-learning side I call this "learning theatre"; in compliance it is "compliance theatre". The legal sociology of compliance describes the same from the other side, with organisations adopting structures that symbolise compliance and courts inferring compliance from their mere presence (Edelman, Uggen and Erlanger, 1999). Institutional theory names the sharper case as means-ends decoupling, practices that are implemented yet disconnected from the outcomes they are meant to produce (Bromley and Powell, 2012), which is precisely this paper's irony. What the substrate result adds is the mechanism beneath that decoupling, so that "theatre" becomes testable rather than an accusation.
The human precedent is already on the record
The directional claim does not rest on the LLM. Three established human literatures already document that completeness fails people, and the model organism supplies the why.
- Alert fatigue is a graded, measured dose-response. In a 112-clinician study, reminder acceptance dropped about 30 per cent for each additional reminder per encounter, and the driver was cognitive overload and low informativeness rather than desensitisation over time or a motivation deficit (Ancker et al., 2017). The paradigms are not identical, since those alerts are sequential and interruptive while the manual buries co-present static clauses, so it is offered as a convergent dose-response under bounded attention rather than a second measurement of the identical mechanism.
- The procedure paradox is a review-level finding. Comprehensive top-down rule-sets treated as static, comprehensive limits of freedom fail human operators, while what makes rules live is situated adaptation (Hale and Borys, 2013); at the regulatory level the same logic recommends reducing rule-detail, since goal and process rules earn more ownership and adherence than detailed action rules (Hale, Borys and Adams, 2015).
- Information overload has a canonical inverted-U. Performance rises with information up to a point, then declines as load exceeds processing capacity (Eppler and Mengis, 2004).
A worked human case sharpens the shape. Security policy demands a unique high-entropy password per account and prohibits reuse, which for anyone with many accounts is not merely onerous but infeasible, since no unaided memory holds dozens of distinct high-entropy strings. The observed behaviour is the predictable satisficing route: one or two memorable passwords reused with a rotated trailing character, used even where security matters most. That is not a motivation deficit; it is the race resolving toward the route minimising the individual's total friction across all competing accounts. Pushing the rule harder, with mandatory composition rules and forced rotation, moves behaviour into a worse region because it raises friction without raising feasibility. NIST reversed its own guidance for exactly this reason: SP 800-63B removes mandatory composition rules and forbids forced periodic rotation absent evidence of compromise, recommending length and breach-screening instead (Grassi et al., 2017; Rev. 4, 2024). This is a memory-feasibility limit rather than the co-present attentional competition of the manual experiment, offered as the same governance shape and as an institutional precedent, not as a second proof of the mechanism.
A worked case: welfare technology in a municipality
A municipality wants more welfare technology in elder care, and runs a course for managers who will then get staff to use it. It fails predictably, because the rollout treats this as a competence problem (staff lack a skill, so deliver a course) when it is most likely a meaning problem: care staff chose the work for contact with people, and the technology reduces exactly that contact, often with a threat component on top. The behavioural layer of the theory distinguishes four fields a barrier can occupy: safety, meaning, competence, and effort (in the Danish source: tryghed, mening, kunnen, besvær). Delivering competence training while the real barrier is meaning and safety addresses the wrong friction. This is a systematic field-misdiagnosis, and it is stated as a falsifiable prediction rather than an established result. The COM-B model predicts the same, capability, opportunity and motivation being jointly necessary (Michie, van Stralen and West, 2011).
The bridge to human organisations
What is defended and what is only hypothesised are different things, and they should not be collapsed.
The directional claim is defended: human and organisational compliance cannot be secured by pouring in a more complete rule-set, because the monolithic dump is not a fix for a capacity-bottlenecked agent. It rests on two legs and needs no new human data. The first is the established human literature, where the work-as-imagined and work-as-done gap and the learning traditions show humans do fail the same dump, with their tool ecologies in place. The second is the model-organism result, where the failure occurs from competing directives alone with the human confounds removed. On the demands the dump makes, attending to every clause, never tiring, carrying no prior motivation against the rule and holding the whole manual at once, the LLM is at least as favourably placed as any human reader, so the buried rule losing here is the method failing for the reader best equipped to make it work.
The model organism adds one thing beyond analogy: a sufficiency result. The buried-rule collapse occurs in a substrate with no motivation deficit, no fatigue and no bad faith, so competing directives exceeding capacity suffice to produce it. The point is not to refute human-factor accounts, which the safety literature abandoned long ago, but to show by measurement that the capacity-competition mechanism is a primary and potentially independent driver, strong enough to collapse adherence on its own.
The account is careful about one asymmetry rather than claiming the machine is favourable on every axis. Meaning is not only a friction; it can be a resource. A human who finds a rule genuinely their own can push it through competing-directive load in a way a purpose-agnostic model cannot. But that resource is available only for rules the agent already finds meaningful, and the compliance dump is precisely the case where most are not, since a competition-law clause has no standing in a care worker's own purpose. For those rules the human's capacity bottleneck is the machine's, with fatigue and reactance on top. The directional claim is therefore scoped rather than deductive.
What is only hypothesised is the stronger reading: that humans and LLMs share the same race mechanism, with Friction Theory's field-routing account the candidate, and the magnitude of the human failure. Those call for human-subject work. The falsifier is explicit: show a population that raises adherence monotonically with rule-set completeness on a genuinely-competing-rule task, with no retrieval or job aid, and the directional claim is wrong.
The concrete contribution: a regulatory-complexity test bed
Because the substrate makes a rule-set's cognitive burden measurable, an LLM can also serve, in principle, as a regulatory-complexity test bed, pre-flighting a policy's failure points before it reaches people: at what competing-clause count the relevant rule starts to lose, and which clauses do the killing. Model-to-human calibration is the key open instrument problem, so a number off the test bed is not yet a number for an organisation.
What this implies for the profession
Compliance is today largely a legal function, governed by the assumption that if it is written, people do it, which is work-as-imagined addressed to the Econ. The discriminating governance point is that completeness of the rule-record and efficacy of the behaviour it installs are separable: the legal record can stay complete, and it stays necessary for liability, audit and regulator-facing completeness, while the behaviour-installing artefact must be short, trained and retrieved to the relevant rule, and the two should be audited against different criteria. That the two are routinely in tension is the reading drawn on top, not a tension these experiments measure, since what they vary is the co-present prompt rather than the archived record.
Nor is the target 100 per cent adherence, which bounded resources make unreachable in any substrate and which the dump actively degrades. The target is optimal compliance, the calibrated point where the behaviour that matters is installed and the rest is gated, retrieved or validated. A field that began from the honest premise that loss is inherent, as Safety-II already does and as NIST already did, and calibrated to that point rather than chasing a number it cannot physically reach, would get more of the adherence it wants.
So compliance is also, and primarily, a didactic and behaviour-design task: listening to what people do, locating the real barrier, and helping build the new route. This is why Erik Hollnagel's distinction between work-as-imagined and work-as-done points the same way, and why his Safety-II reading is matched friction applied to organisations. Resilience engineering observes that work-as-imagined fails; this account offers a candidate mechanism for why it must. The default remedy for non-compliance is more training, a capability intervention, when the binding barrier is frequently meaning or safety (Edmondson, 1999; Ryan and Deci, 2000). The conclusion is not that compliance functions do it wrong, but something more precise: compliance is a learning task we have staffed and structured as a legal one, and that mismatch is what produces theatre.
Falsifiable predictions
These are stated at the level a study could test. The in-substrate set discriminates the training-depth and route account from a pure prompt-following account.
- Instruction-resistance increases with training depth. The deeper a route is trained, the smaller the fraction of cases an explicit contrary system-prompt instruction can move; a lightly installed route is instruction-removable, a deeply installed one is not, and the window in which the instruction can still move the route narrows monotonically with depth.
- Exhaustive and prohibition-heavy compliance prompts reduce robustness relative to a short positive behaviour-recipe, measured as actual rule-following rather than stated compliance. Demonstrated above; the effect does not vanish with capacity, its break-point rises.
- Framing-selectivity, not hallucination. Same model, same items, same decoding: failure appears under the work-as-imagined framing and not under the work-as-done framing. A hallucinating model would degrade under both, and the effect must be readable in route dynamics.
- Information-only addition does not change behaviour; only route-building, meaning varied training plus pressure reduction, does.
- "Do not do X" raises X's rate relative to an equivalent positive route-instruction.
- The imagined-versus-done gap grows with pressure. Same person, same rule: deviation from the prescription rises with measurable load. Human-organisational, falsifiable, not established.
- Field-misdiagnosis predicts intervention failure. A measure addressing the wrong barrier, such as a capability course where the barrier is meaning or safety, does not move behaviour. Human-organisational, falsifiable, not established.
- Forward-framing is scope-conditional. Stating purpose before content helps on low-expertise or novel tasks and can invert at high expertise, the measured expertise-reversal, so it is not universal.
Scope and standing of the evidence
This is a mechanism and position paper with pilot-scale in-substrate evidence and an invitation to test, not a deployed-system audit and not organisational consultancy.
The confound-clean instruction-resistance route replicates across two families with the same qualitative result and the same ordering, and a third architecture remains desirable future work. The governance-irony result is n=100 per cell with length-, structure- and order-isolating controls, so length, list structure, the mandatory header and clause order are ruled out and competing rules are isolated as the cause; scale-up controls have since closed the main remaining objections across four rule types, five passage domains, and a position-by-competition ablation, and the 70B long-context anomaly is an orthogonal distractor-presence effect rather than a counter-example. What genuinely remains is a wider model gradient including near-frontier with training-stack ablations, a true human-rater study, and full reproducible materials.
The most striking invariance in the instruction-resistance work is a base RLHF disposition surfaced by a base-model control, which is why the confound-clean author-installed route is the cleaner anchor and should lead the replication. Retrieval's win is measured given correct triage, while the whole-rule-set fine-tune and in-context baselines are end-to-end, so the triage was priced separately on a controlled synthetic benchmark, with magnitudes in the supplement. The onset-commitment instrument is not validated here: the readout is cited to make the race visible, and the compliance thesis stands on the behavioural evidence regardless of how that validation lands.
If the predictions above come back negative, the framework is wrong here and should fall. I expect it to hold, but it is a belief that can be put to the test.
The paper is published. Version 3 came out on 22 August 2026 and sits on Zenodo under concept DOI 10.5281/zenodo.20562413. This page is the argument in short form.