The Field You Cannot Honestly Fill In
You know one true thing about a service. You have known it for two years. This morning you finally go to put it in the system.
The form has thirty-one fields. Four of them are mandatory, and you have no idea what belongs in any of them. Business criticality. Recovery tier. Data classification. Upstream owner.
You know one of those thirty-one things. You are being asked to have an opinion on all four of the ones you don’t.
So you do what everybody does. You guess, or you hedge: TBC, under review, no idea. The guess is a fabrication the record has no way to detect. The hedge feels like the honest option and does more damage in its own way — it fills the space, so the field reads as answered and nobody ever comes back to it. Either way your one true fact lands wrapped in three non-answers indistinguishable from it.
Or — the more likely outcome — you close the form and walk away. The organisation stays exactly as ignorant as it was before you tried, and it has no idea it just lost anything.
Now take the other route. You skip the form and go to the person who owns that record, because it’s really their system, not yours. Which means a conversation, which becomes a meeting, which becomes a standing meeting — because once two people have to agree, someone has to book the room. Your one true fact is now an agenda item.
Neither of these is a tooling problem. It’s the same tax collected at two different counters, and the tax is agreement.
The Cost Is the Agreement, Not the Typing
Every organisation that has watched its model go stale blames the interface. It was too clunky. Nobody had time. We’ll do a data quality drive next quarter.
The interface is not what stopped you. What stopped you is that the record is singular — there is one row for that service, and it can only say one thing at a time. Everything painful follows from that one design choice:
- Because there is one record, it needs all its fields filled — so contributing means having an opinion on things you don’t know.
- Because there is one record, it already belongs to somebody — so contributing means taking something from them.
- Because there is one record, only one answer can stand — so contributing means winning, and winning means a meeting.
Three barriers, and all three are the same shape. You are not being asked for what you know. You are being asked to first become someone who knows the whole thing, and then to negotiate with everyone else who thinks they already do.
Almost nobody clears that bar. So the knowledge doesn’t vanish — it just goes somewhere cheaper. A spreadsheet. A private note. A thing someone says out loud in incident calls that has never once been written down.
And all the while, the dashboard says this is going well. Coverage is up. Completeness is up. The population rate has climbed three quarters running — every knowledge metric on the slide pointing the right way.
Those numbers are lying, in precisely the way Measuring What Matters warned about. A completeness score counts fields that contain something, not fields that contain knowledge. The guess scores. The hedge scores. Walking away — the only fully honest option on offer — is the one thing the metric punishes. It is measuring occupancy and reporting it as understanding, and it climbs fastest exactly where people were least able to tell the truth. Credible over complete was the whole point; we built the dashboard the other way round.
The consensus requirement isn’t slowing your model down. It’s why your model is empty.
Partial Knowledge Is the Normal Case
Here is the assumption buried under the singular record: that somewhere there exists a person who knows the whole thing, and our job is to find them and give them the form.
There is no such person.
The network engineer knows how traffic reaches that service and has no idea what it costs. Finance knows exactly what it costs and could not tell you what it does. The architect knows what should happen — the intended design and the reasoning behind it — and almost never sees what actually does. The service desk lead knows exactly what does happen, what breaks and in what order, and has never seen the architecture diagram. Each of them is genuinely authoritative about one facet and genuinely ignorant of the rest.
That ignorance is not a gap to be closed. It is correct. It is what specialisation looks like from the inside, and the fact that your finance analyst has no view on recovery tiering is a sign the organisation is working, not failing.
We built systems that treat a partial answer as an incomplete one. It isn’t incomplete. It’s precise — and we made precision impossible to submit.
That precision is exactly what makes it credible — and credibility here has two sides that need each other. On the inside, it is how far the contributor actually trusts their own information: not whether it holds true for the whole model, only whether it holds in their own context. On the outside, it is that the edge of that context is visible, so anyone reading it knows how far to carry it. The network engineer is entirely right about routing and says nothing whatever about cost — and because you can see exactly where that frame ends, you know exactly how far to trust it.
Credibility isn’t certainty and it isn’t coverage. It is a bounded claim that somebody is willing to stand behind. Confidence with no stated limits is just assertion; a limit with no confidence behind it is noise.
A completed record has no such property. Filled end to end, it cannot tell you which fields were known and which were guessed, which is why the coverage number climbs while your confidence in it falls. Knowledge Isn’t a Story argued that what we need is knowledge we trust enough to act on now. This is the mechanism underneath it: bounded precision beats unbounded assertion, and credibility — not completeness — is the only measure of a model worth reporting.
Silence Is an Answer
Let people say only what they actually trust their own information on, and nothing at all about the rest.
Not unknown. Not a blank. Not a sensible default. Nothing.
The distinction sounds like pedantry and it is the whole mechanism. “I don’t know” is still a claim — it’s a claim about the state of your knowledge, and it lands in the record as a value that occupies the space. A blank field is worse: it overwrites what was there with emptiness, and now the organisation knows less than it did before you helpfully filled the form in.
Silence isn’t a value. It’s the absence of a claim. And in a composed model — where the answer to any question is assembled on demand from whatever layers have something to say — a layer that stays silent about a facet simply lets a lower layer show through, untouched.
That’s what makes contributing safe. You cannot damage what you don’t speak to.
A Worked Example: Two People Who Never Met
Take a payments service. Sanitised, generic, but you’ll recognise both halves.
The security analyst knows exactly one thing about it: it touches regulated data, so it falls inside a particular control regime. That’s it. The analyst has no view on who runs it, what it costs, how many people depend on it, or whether it’s healthy this morning.
The service desk lead knows something entirely different and equally true: when this service starts to fail, the first sign is never monitoring. It’s a specific, oddly-worded complaint that shows up two or three hours before anything goes red.
Today, neither fact reaches the model.
The analyst can’t record that one fact without owning — and therefore fabricating — the other thirty, so the route is a ticket raised against whoever owns the record: a wait, and then a checkbox landing three weeks later with the reasoning stripped off. The desk lead’s fact is worse off still, because there is no field for it at all. Creating one is a governance change, which is a working group, which is next quarter. So it stays in one person’s head, in a chat thread, and in the goodwill of whoever happens to be on shift that night.
Now let each of them contribute a layer that speaks only for itself.
Each adds one thing and stops. They have never met. They have not agreed on anything, because there was nothing to agree about — neither one said a word about the other’s facet. Nobody reviewed anything. Nobody was overwritten.
And the composed view of that service now carries a regulatory boundary and an early-warning signal that the organisation has always possessed and never once been able to write down.
Nobody Is Overwritten, So Nobody Resists
It’s worth being honest about why the review gates exist. They aren’t bureaucracy for its own sake. When there’s one record, your fact landing means someone else’s fact leaving — so the gate is protection against loss, and the people defending it are defending something real.
But the fear runs in both directions, and this is the half nobody says out loud. Contributing doesn’t only risk taking someone else’s answer away. It exposes yours. The moment your fact is visible, anyone with more confidence, more seniority or a different lens can correct it to their own assumed truth — and in a singular record, correcting means replacing. Yours is simply gone, with nothing left to show you ever said otherwise.
So contributing carries a personal risk and no personal upside. You put your name against something you actually know, and then wait to be quietly overruled by someone who was never as close to it as you were. People learn this exactly once. The engineer who watched their assessment flattened by an architect’s assumption does not make that mistake twice — and the organisation has just trained its best-informed people into silence, then gone looking for a better form.
Take the loss away and you take the fight away with it. A contribution adds a layer; it removes nothing. If it turns out to be wrong, or thin, or less authoritative than something else, it loses on precedence and sits harmlessly underneath — and it is still there, still attributable, still available to anyone who later wants to know what you said and when you said it. Nothing in this model is ever destroyed, which is a bigger idea than this piece can hold and gets one of its own.
The correction you were bracing for stops being a deletion, too. Someone else’s claim doesn’t edit yours; it lands in its own layer beside it, both attributed, both readable. If theirs wins on precedence, yours is still on the record saying exactly what you said — and the fact that the two of you disagreed is now visible information rather than an argument settled by whoever spoke last.
The gate was never really about quality. It was about scarcity — one record, one winner. Composition ends the scarcity.
A Disagreement Is a Finding
And then the fear turns inside out. The contradiction you dreaded attracting is the most useful thing you could have handed the organisation.
A gap tells you nobody knows something. A conflict tells you something worse and far more useful: two people who are each genuinely authoritative both believe they know, and their answers don’t match. That happens for only a few reasons — the design was never implemented the way it was drawn, or it drifted and nobody noticed, or the two of them are answering different questions using the same word. Every one of those is a finding, and none of them surfaces anywhere else.
So when the architect says traffic reaches that service one way and the network engineer says it reaches it another, the valuable output is not a ruling about who to believe. It is the discovery that the intended service and the running service have come apart — and that nobody spotted it, because the record only ever had room for one of them.
Reconciliation doesn’t settle a disconnect. It deletes it — along with the only evidence that it existed.
More Contributors, Not More Meetings
Watch what this does to the arithmetic.
Under consensus, every person you add is another person who has to agree. Coordination cost rises with each one, and the knowledge your organisation can hold is capped — not by what people know, but by how many of them you can get to sign the same sentence.
Under composition, every person you add contributes what they know at no coordination cost at all. They didn’t have to convince anyone, or be right about anything except their own patch.
Under consensus, every extra contributor makes the model slower. Under composition, every extra contributor makes it richer.
That is the difference between a model that decays the moment the programme ends and one that gets better on its own — because contributing to it is finally cheaper than keeping your own spreadsheet.
Why This Falls Out of Composition
The Myth of the Single Source of Truth answered the case where two layers disagree: don’t negotiate, set a precedence rule once and let the answer show its work.
But disagreement is the rare case — rare in how often it happens, and, as we just saw, disproportionate in what it tells you when it does. Most of the time two layers aren’t fighting over the same facet at all; they have nothing to do with each other. Precedence handles the overlap. Silence handles everything else, which is nearly all of it.
Between them there is no point left in the system that requires anybody to agree with anybody up front. That’s the second half of the machine: the first half made truth composable, and this half makes it contributable.
And it is what turns credible knowledge from a principle into something an organisation can actually accumulate. You will never hold knowledge you trust enough to act on while the people who have it can’t get it in the door.
The Challenge
Go and find someone who knows one true, useful thing about a service and has never put it anywhere. You will not have to look hard — ask anyone who has worked a service desk for more than a year.
Then ask them why not. You’ll get one of two answers: “there’s no field for it”, or “that’s not my system to change.”
They sound like different problems. They’re the same one, and neither of them is about the person, and neither of them is about the tool.
Then look at the end of a project, where the loss is easiest to see. A delivery team spends months finding out how the thing really behaves under pressure, and almost none of it has anywhere to go. The clearest case is the risks still open on the day the project closes. They were real enough to review every week while there was a project to review them in. Then the project ends, the register is archived, and they simply stop existing — not accepted, not mitigated, not handed to anyone. Nobody made a decision. There was just no layer left standing that could hold them.
What does your organisation know that it has never been able to write down?
If this landed, I’d love to hear it — comment, follow, or share it with whoever owns the form that nobody can finish.