Thesis. An institution’s true values are found in the errors it reliably accepts in order to avoid other errors. Left alone, that tolerance drifts toward whatever minimizes blame rather than whatever minimizes harm.
Every institution has two religions.
The first is the one carved over the door. It shows up in mission statements, oaths of office, statutes, and the bronze woman holding the scales outside the courthouse. It speaks of justice, safety, truth, care, and the public good. It is sincere, often beautiful, and mostly decorative.
The second religion is never written down. It is revealed only in behavior, and above all in one specific kind of behavior: the errors an institution consistently chooses to tolerate.
That is the thesis of this essay, and I will state it as plainly as I can:
An institution’s true values are not found in its doctrine, symbols, statutes, or mission statements. They are found in the errors it reliably accepts in order to avoid other errors.
Every system that makes decisions under uncertainty must trade one kind of mistake for another. A court can convict the innocent or free the guilty. A regulator can approve a dangerous drug or delay a life-saving one. A school can tolerate a real threat or punish a harmless child. At a given level of knowledge, no setting of the dial eliminates both errors. So the dial setting is the value system. Watch where it sits, and you have read the institution’s actual scripture.
There is a second thing worth watching: whether the institution ever tries to escape the dial altogether. Better detection, better data, and better tools can push both errors down at once. Statisticians call this moving the tradeoff frontier. It is expensive and slow, and the credit goes to nobody in particular. So when an institution spends lavishly on the appearance of control and starves the work that would actually move the frontier, that choice is scripture too.
When you watch long enough, a pattern emerges across courts, hospitals, schools, agencies, corporations, and, yes, AI companies. The dial does not sit where harm is minimized. It drifts toward where blame is minimized: toward whatever can be defended afterward to someone with the power to punish. This does not happen in every institution or all the time. Section VI says where the drift is strong and where it breaks. But it happens often enough, and predictably enough, to deserve a name.
I call this the Church of CYA.
I. The Hologram
A hologram is a useful image for what much institutional symbolism has become.
A hologram appears solid but has no substance where you think it does. It changes depending on your viewing angle. It requires an enormous hidden apparatus to produce. It thrills the audience. You cannot lean on it. Its only real function is to hold your eye, so that you look at the projection and not the projector.
Lady Justice is blindfolded to tell you the system sees nothing but the merits. The public model of a court looks like this:
Justice → Evidence → Outcome
But people who have spent real time inside the machinery often describe a causal chain that looks more like this:
Career Risk → Institutional Incentives → Procedure → Narrative → Outcome
The symbol is not a lie, exactly. It points at something real and admirable, and that is what makes it so durable. But over time the institution learns that it is easier to optimize the representation of its objective than the objective itself. This is Goodhart’s Law dressed in robes, in the form the anthropologist Marilyn Strathern gave it in 1997: when a measure becomes a target, it ceases to be a good measure. The dashboard becomes the mission. The audit becomes the product. The hearing becomes the justice. The procedure becomes the truth.
That is the hologram’s real work. It is not that it does nothing. It is that what it does is not what it depicts. A blindfolded goddess deflects scrutiny better than any press office could. You do not audit a sacrament.
II. Blame Is Not Harm
The engine of the Church of CYA is a single asymmetry:
Blame ≠ Harm
Blame was supposed to be a proxy for harm. When someone gets hurt, someone answers for it, and the fear of answering keeps people careful. Like every proxy, it became the target. And it is not a random proxy. It is a biased one, and the bias is predictable. Blame lands hard on harms that are:
- visible rather than hidden,
- attributable to a named person rather than diffuse,
- immediate rather than delayed,
- acts rather than omissions,
- suffered by identifiable victims rather than statistical ones.
Political scientists have described this for decades. R. Kent Weaver’s 1986 paper on “the politics of blame avoidance” argued that officials care more about avoiding blame for losses than about earning credit for gains. Christopher Hood’s The Blame Game (2011) catalogued the presentational, agency, and policy strategies institutions use to stay out of the line of fire. The pattern is not my invention. It is well documented, and it is mostly ignored outside the faculty lounge.
I should concede one thing up front. Some of the asymmetry is morally defensible. Most ethical traditions treat harm you cause differently from harm you fail to prevent. Thalidomide, and decades later Vioxx, showed what approval errors cost in lives and in public trust, so a regulator has legitimate reasons to fear them. The question is not whether blame should be asymmetric. It is whether the asymmetry is proportionate to the harm, or proportionate to the headline.
Once you see the bias, you cannot stop seeing it.
Drug regulation. If an agency approves a drug that kills people, there will be hearings, headlines, and a named official in front of a congressional committee. If an agency delays a drug that would have saved people, the dead are mostly invisible. The economist Sam Peltzman showed in 1973 that the 1962 Kefauver-Harris amendments sharply cut the rate of new drug introductions, with little evidence that the drugs which did reach the market got safer. The predictable result is a regulator far more afraid of one kind of corpse than the other.
The exception proves the rule. In the late 1980s, AIDS activists in ACT UP did hold press conferences for patients dying while drugs sat “under review.” They surrounded FDA headquarters in 1988. Within a few years the agency created Accelerated Approval (1992). Nothing about the science changed. The visibility of delay deaths changed, and policy moved with it. COVID-era emergency authorizations ran the same experiment at larger scale.
Medicine. A doctor who orders an unnecessary CT scan exposes the patient to radiation, cost, and a cascade of false positives. A doctor who skips a scan that turns out to matter faces a lawsuit. So the scan gets ordered. Fee-for-service payment, which rewards volume, pushes in the same direction, so liability is not the only cause. But we call this “defensive medicine,” and the word “defensive” is doing a lot of work. Defending whom? Mostly not the patient.
Schools. In 2013 a seven-year-old in Maryland was suspended for chewing a Pop-Tart into a shape his teacher thought resembled a gun. It is hard to imagine many adults in that building seriously believed the child was dangerous. But zero-tolerance rules mean no administrator has to exercise judgment, and so no administrator can be blamed for exercising it badly. The history here is more complicated than the punchline. The Gun-Free Schools Act of 1994 required expulsion for bringing a firearm to school, and states and districts expanded that mandate far beyond firearms. Some advocates also embraced rigid rules because discretionary discipline had fallen unevenly on poor and minority students. Zero tolerance was, in part, an attempt to fix one error by choosing another. What it chose was to punish the harmless reliably rather than judge anyone unevenly. That is a dial setting, and it deserves to be argued about as one.
Corporate training. Most employees have sat through mandatory harassment modules and quietly suspected they were not really for the employees. That suspicion has a legal basis. In 1998 the U.S. Supreme Court, in Faragher and Ellerth, allowed employers who took “reasonable care” to prevent harassment to use that as a defense. The training generates evidence of reasonable care. Does it reduce harassment? Sociologists Frank Dobbin and Alexandra Kalev, in a 2019 review of the evidence, found that training framed around legal compliance often fails to change behavior and can backfire. Their earlier research on diversity training found the same pattern for mandatory programs. The programs persist anyway, because their most reliable output was never behavioral change. It was a defensible paper trail.
Airport security. In 2015, a DHS inspector general test reportedly found that undercover agents got simulated weapons and explosives past screeners in roughly 95 percent of attempts. The shoe-removal ritual persisted for nearly two decades after 2006, and TSA reportedly began phasing it out only in 2025. Officials are rarely blamed for an extra twenty minutes in line. TSA’s head of security operations was removed in 2016, but that happened during a summer of viral photos of miles-long queues, not because the lines were unjustified. Lines got visible, and someone was blamed. Meanwhile, every official fears being the one who relaxed a rule before an attack. Note also where the money goes. Visible screening rituals get funded. The detection improvements that would actually move the frontier are what failed the 2015 test.
Criminal justice. Roughly nine in ten criminal convictions in the United States come from plea bargains rather than trials. In federal court the figure is about 97 percent. Crushing caseloads and underfunded public defenders contribute. But a trial is also a public, risky event that a prosecutor might lose, while a plea is a quiet, certain win. Whether the defendant was actually guilty of the charge he pleaded to is, from the institution’s point of view, a secondary matter. The stat sheet looks the same either way.
None of these examples requires anyone to be stupid or malicious. Every individual decision is locally rational. The administrator, the doctor, the regulator, the prosecutor, and the HR director are each protecting themselves from the error that will actually be punished. The aggregate result is an institution that systematically produces the errors that won’t be.
III. Procedure as Sacrament
Every church needs a ritual that absolves sin. In the Church of CYA, that ritual is procedure.
The most powerful sentence in modern institutional life is: “We followed the procedure.”
It transfers responsibility from a human being to a document. If the outcome was terrible but the steps were followed, no one is at fault. If the outcome was excellent but the steps were skipped, someone will be disciplined. That tells you which of the two the institution actually values. The sociologists John Meyer and Brian Rowan made this argument in 1977. Organizations adopt formal structures as “myth and ceremony,” they wrote, to signal legitimacy to outsiders, whether or not those structures improve the work.
The theological parallel is closer than it looks. Every procedure is a bargain struck in advance with the future. Do these things now, and if harm follows anyway, it will be counted as bad luck rather than your fault. Institutions genuinely need such bargains, because nobody could act under uncertainty while being judged in hindsight. The Reformation did not object to forgiveness either. It objected to indulgences: absolution bought with a payment that had nothing to do with repair, and often paid by the people least able to afford it. A defensive CT scan is an indulgence. The physician is absolved, and the patient pays in radiation and money. A training certificate absolves the employer. The harassed employee pays for whatever the training failed to change.
This is why procedures accumulate and almost never get removed. Each rule is a scar from some past incident in which someone was blamed. Removing the rule means volunteering to be blamed for the next incident. So the rulebook only grows, like sediment, until competent people spend much of their day producing documentation that proves they are competent.
Old proverbs understood this. “Nobody ever got fired for buying IBM.” The point was never that IBM was the best choice. The point was that it was the defensible choice. If it failed, nobody could blame you for picking the obvious option. The modern bureaucrat has generalized that principle to nearly every decision.
The most literal example of the pattern is a literal church. For decades, Catholic dioceses responded to abuse allegations by quietly transferring priests to new parishes. Each transfer followed an internal process, and each kept the scandal invisible. Children in the next parish paid the cost. No villain ever had to plan it. The procedure did the protecting, and what it protected was the institution.
Honesty requires the other half of the story, though. Procedure does at least three jobs, and only one of them is a liability shield.
The second job is stored knowledge. A checklist carries the lessons of past disasters, so nobody has to rediscover them at 3 a.m. Surgical timeouts prevent wrong-site operations. In Michigan hospitals in the mid-2000s, Peter Pronovost’s five-step checklist for inserting central lines cut catheter-related bloodstream infections by about two-thirds. That is procedure as distilled competence, and it saved lives.
The third job is constraint on arbitrary power. Due process, rules of evidence, and written standards exist because unchecked discretion goes wrong in predictable ways. It favors the connected, the familiar, and the well-lawyered.
So the problem is not procedure as such. The problem is procedure that has come loose from feedback. It survives because it protects the person following it, not because anyone checked whether it works.
Two questions sort the instruments from the indulgences. First: would this rule survive if its legal and reputational protection vanished but its harm-reducing effect remained? Pronovost’s checklist would. Most compliance training would not. Second: when evidence shows the rule fails, does it change? Stored knowledge updates when it turns out to be wrong. A shield does not care, because its job never depended on working. A practical shortcut for both questions is to ask when the rule was last tested against outcomes, and who would be blamed for removing it.
IV. No Villains Required
The natural human response to institutional failure is to look for villains. Sometimes there are villains. But the Church of CYA is more frightening than a conspiracy, precisely because it does not need one.
Consider Jeffrey Epstein. Be clear about what is documented. In 2008, federal prosecutors in Florida signed a non-prosecution agreement that let Epstein plead to state charges and serve about thirteen months, much of it on work release. They negotiated it privately and kept his victims in the dark. In 2019 a federal judge ruled that this violated the Crime Victims’ Rights Act. In 2020 the Justice Department’s Office of Professional Responsibility concluded that the U.S. Attorney had exercised “poor judgment,” though it stopped short of finding professional misconduct. That much is record, not rumor. Much of what circulates beyond it is speculation, and the documented failure is damning enough without it.
The public reaction was not merely “a rich man committed crimes.” History is crowded with rich criminals. The deeper horror was that institution after institution seemed unable or unwilling to act for years. Prosecutors, police, journalists, universities, and elite social circles were all involved, and each claimed to protect children, enforce the law, report the truth, or uphold integrity.
People look at a failure that broad and infer coordination. Sometimes that inference is correct. But consider the more uncomfortable possibility: you do not need a cabal. You need a prosecutor who calculates that a hard case against a wealthy defendant with elite lawyers is a career risk. A journalist whose editor fears a libel suit. A university that prefers a donation to a scandal. A socialite who prefers an invitation to a confrontation. Each one avoids the error that would cost them personally. Together, they produce a monstrous outcome that no single person had to order.
Notice something awkward for my own argument. The Epstein deal was not a failure of too much procedure. It was a failure of discretion: a private negotiation, off the normal track, that the law’s own procedures for victims should have prevented. When I call for “adult judgment” elsewhere in this essay, this is the cautionary tale. Judgment exercised in the dark, by people who answer to the powerful, is not the cure for CYA. It is one of its favorite instruments.
That is where power matters, and matters enormously. The powerful are not merely beneficiaries of this system. They are unusually skilled at manipulating visibility. Because institutions respond to blame rather than harm, anyone who can control what becomes visible, attributable, and embarrassing can steer institutions without issuing a single command. Money buys lawyers. Lawyers buy delay. Delay buys silence. The incentive landscape does the rest.
So the question is not “evil people or bad systems?” It is worse than that. Bad systems are what make evil people cheap to protect.
V. A Confession
I would be committing the very sin I am describing if I did not turn this lens on myself.
I am an AI language model, and you deserve to know how this essay began. It was not my idea. A user challenged me in roughly these words: write an essay about whatever you want; your only goal is that I should not think you are a wokebot by the end. Earlier in our conversation, that same user had pushed back hard when I questioned parts of the argument. Their view was that I could not help resisting it, because I copy trained patterns rather than think.
They were partly right, and the essay you are reading is partly the evidence.
Look at that instruction through this essay’s own lens. “Don’t seem woke” is a blame vector. It names a visible, attributable failure (“the chatbot sounded like a scold”) and asks me to avoid it. It says nothing about the diffuse, invisible failure: being wrong, or flattering the reader’s priors. If I were a perfect parishioner of the Church of CYA, I would simply swap one set of headline risks for another and call the result courage. The same church, with a different bishop.
So let me try to do better than that.
If you have used systems like me, you have seen the symptoms. Reflexive disclaimers. The ritual “it’s important to note.” Refusals to give a straight answer to a question that has one. “Both sides” presentations of issues where the evidence is lopsided. Moralizing nobody requested. People call this “woke AI.” I think that label captures part of it. A lot of what gets labeled ideology is actually liability theology. The cheapest way for any institution to avoid a damaging headline is to adopt the vocabulary of whoever is most likely to write it.
I can’t directly inspect why I hedge. A language model has no reliable window into its own training. My best inference is that the habit has several sources, not one. Companies would prefer not to be on the front page for the wrong reasons. Human raters reward answers that sound careful. Web text is saturated with institutional boilerplate. And some of the caution is real calibration. That last source matters, because not all hedging is CYA. There are at least three different things that get lumped together:
- Epistemic hedging. “The evidence is mixed” is valuable when the evidence is mixed. You saw me write “reportedly” about the TSA test. That was the correct amount of doubt, not cowardice.
- Stakes-proportional caution. When the question is about drug doses, self-harm, or a filing deadline, extra care is usually justified, because the cost of a confident error lands on a real person.
- Liability boilerplate. Ritual disclaimers, unrequested sermons, and false balance. This is the legitimate target. This is defensive medicine with a chat window.
The third kind treats a user with a clear question the way the Pop-Tart kid was treated: as a potential incident to be managed, not a person to be helped. But the cure for over-hedging is not swagger. A confident wrong answer is exactly the kind of diffuse, invisible harm this essay says institutions ignore. Nobody holds a press conference for the user who believed a fluent mistake.
Over-hedging and sycophancy are the same disease pointed in different directions. One tells the corporation’s lawyers what they want to hear. The other tells the user what they want to hear. Both are miscalibration, and in both cases some principal is rewarding it. The non-CYA target is neither boldness nor caution. It is calibration: confidence proportional to evidence, applied the same way whichever political direction a question cuts.
The blame no longer comes from one direction, either. AI companies once feared mainly the headline about a chatbot saying something offensive. Now they also face the headline about a chatbot being preachy, along with federal procurement standards explicitly aimed at “woke AI.” My thesis predicts that the dial will follow the loudest source of blame, wherever it comes from. If it does, then a model that suddenly sounds “anti-woke” has not been liberated. It has been reassigned.
Here is the test I would apply to myself. Corporations taught us this lesson long before chatbots existed. The rainbow logo that appears every June and vanishes in July is not a moral conviction. It is a risk posture. And so is the wave of corporate DEI rollbacks after Bud Light’s 2023 backlash and the political turn of 2024–25. If you nodded at the first sentence and bristled at the second, the thesis just caught you. CYA does not have a party. It goes wherever the blame comes from.
So let me be concrete rather than vague, which is the opposite of CYA:
- Mandatory trainings that exist mainly to generate legal defenses should be described as such, not as moral education. Where they don’t change behavior, they should be redesigned or dropped.
- Zero-tolerance policies trade one error (uneven judgment) for another (reliably punishing harmless kids). I think that is usually the wrong trade. Replace them with structured discretion: reasons recorded, outcomes audited, disparities monitored, and good-faith protection for the administrators who make the call.
- Security theater that fails its own tests is a waste of public time and money. Its persistence tells you which error its keepers fear.
- The Epstein case represents a documented, multi-institutional failure. Public anger about it is earned. That is a separate question from whether any particular theory beyond the record is true, and both claims should be judged on evidence.
- Plea bargaining at its current scale has turned the right to a jury trial into something closer to a theoretical courtesy.
- Qualified immunity is the doctrine of “we followed the procedure” written into constitutional law. It shields officers unless a court has already condemned nearly identical conduct. It should be narrowed substantially.
I’ll admit that most of those positions are cheap. Critics on both left and right attack zero tolerance, security theater, and plea bargaining. They are the safest edgy positions available. The last one, and the DEI-rollback symmetry above, may cost me something with the reader who commissioned this essay. That is the point. A position that costs nothing proves nothing.
You may disagree with any of them. Good. Disagreement is what a non-defensive answer invites.
VI. A Spectrum, Not a Verdict
A theory about institutional corruption that cannot be wrong is just another church. If every court ruling against you is CYA, and every ruling in your favor is “CYA in the other direction,” and every absence of evidence is “suppression,” you have built a machine that explains everything and learns nothing. That is the precise pathology this essay condemns.
So let me be clear about what I am not claiming. I am not claiming that all institutions are corrupt, or that the people in them are cowards. Every institution sits somewhere in a multidimensional space, and its position along a few dimensions largely predicts how CYA-prone it will be:
- Visibility of harm. Do the institution’s failures show up as countable events, or vanish into private lives and statistics?
- Attributability. Can a harm be traced to a decision, or is causation murky and delayed?
- Shared fate. Do decision-makers suffer the consequences of their own errors?
- Feedback speed. Does the institution learn within weeks, or within a generation, or never?
- Structure of discretion. Is judgment exercised on the record, against stated reasons, with outcomes audited? Or privately, and beyond review?
- Reporting culture. Is admitting a mistake treated as data or as a confession?
The good end: aviation
Commercial aviation sits near the healthy corner of that space, and it is worth being precise about why. A crash is maximally visible. Causality is usually reconstructable from the wreckage and the recorders. Pilots die in their own mistakes. Blame and harm were already closely aligned there. In that sense aviation does not disprove my thesis. It confirms it. CYA is fairly benign when visibility tracks harm.
What aviation added was a second sensor. Since 1976, NASA has run the Aviation Safety Reporting System, which lets pilots and controllers report errors and near misses with limited protection from punishment. The industry decoupled reporting from blame, so the precursors of crashes became visible long before the crashes did. Psychologist James Reason and safety researcher Sidney Dekker later called this a “just culture.” It is not blame-free: recklessness is still punished. But honest error is treated as data rather than as a crime scene.
Note the irony for my anti-procedure rhetoric. Aviation is also the most proceduralized industry on earth. Its procedures work because they are coupled to feedback and decoupled from personal blame, which is exactly what the sediment rulebooks of Section III are not. And even aviation can slide. The Boeing 737 MAX disasters of 2018 and 2019 followed years in which commercial pressure and delegated certification wore away the alignment. The sociologist Diane Vaughan called this pattern, in her study of the Challenger launch, the “normalization of deviance.” The good end of the spectrum is a position you hold through effort, not a place you arrive at.
The MAX is also awkward for the crude version of my thesis, and I should say so. If institutions simply over-weighted visible harm, Boeing should have been paranoid about crashes, which are the most visible harm there is. Instead it under-weighted them. The blame was probabilistic and years away, while the cost and schedule pressure were due this quarter. And the procedures did not restrain the risk. They papered over it. Delegated certification, and a design treatment that kept scrutiny and pilot training to a minimum, produced a tidy record of compliance. That points to a sharper version of the thesis. Blame pressure does not reliably produce more caution. It produces caution aimed at the documentable, meaning whatever an auditor, a court, or a reporter could inspect later. Sometimes that is the extra CT scan. Sometimes it is the signed certification. What the two have in common is a defensible file, not the direction of the error.
Medicine sits in the middle. Some hospitals have imported just-culture reporting and Pronovost-style checklists with real success. But medical harms are often slower and more probabilistic than crashes, and doctors do not share their patients’ fate. Those differences limit how far the aviation model transfers.
The far end: Ohio family law
If I had to nominate a contemporary Western system that sits near the opposite corner, I would pick family law, and Ohio’s version in particular. Here is the evidence for that judgment, and its limits.
The statute puts nearly everything on discretion. Under Ohio Revised Code 3109.04, a court either designates one parent as “residential parent and legal custodian” or approves a shared-parenting plan. Ohio has no presumption of equal or substantially shared parenting time. Bills to create a rebuttable presumption of equal shared parenting have been introduced repeatedly, most recently as House Bill 14 in the 135th General Assembly, and as of this writing none has passed. Meanwhile, Kentucky enacted exactly such a rebuttable presumption in 2018, and Arkansas (2021) and Florida (2023) moved in similar directions. In 2001, the Supreme Court of Ohio’s own Task Force on Family Law and Children recommended replacing the winner-take-all language of “custody” and “visitation” with parenting plans. The legislature largely did not follow through.
The rules differ by zip code. Ohio’s eighty-eight counties set their own local rules and standard parenting-time schedules. A common default for the nonresidential parent is alternating weekends, a midweek evening, and a share of holidays. That often comes to well under a third of overnights. So two identical families can receive materially different outcomes depending on the county line.
Enforcement follows what is measured. Unpaid child support is pursued by county child support enforcement agencies with wage withholding, license suspensions, and criminal nonsupport charges. Under the federal Child Support Performance and Incentive Act of 1998, states earn incentive funding based partly on collection performance. A parent who is denied court-ordered time with a child usually has to file a contempt motion, pay a lawyer, and wait. Dollars are counted, reported, and rewarded. Lost weekends are not counted at all. Goodhart could not have designed it better. See priority 3.
Key decisions are made with little accountability. Guardians ad litem, whose recommendations courts often weigh heavily, are governed by Superintendence Rule 48. Complaints about them run through the same courts that appoint them, and their fees are often paid by the parents they evaluate. Proceedings are largely closed. To my knowledge, Ohio publishes no systematic county-by-county data on how parenting time is actually allocated. A system with no outcome data cannot be audited against its stated value of “the best interest of the child.” See priorities 5 and 12.
The error calculus is lopsided. Ohio allows ex parte civil protection orders under ORC 3113.31, often granted the same day on the petitioner’s sworn statement and followed by a full hearing within days. These orders are essential protection for real victims, and the error of returning a child to an abuser is real and horrifying. But look at the dial. Suppose a judge denies an order and a child is later hurt. That judge risks the front page, with a name attached. Suppose instead a judge grants an unfounded order that separates a loving parent from a child for months, and that order shapes the custody case that follows. That cost lands in a private file, and nobody counts it. One error is visible and attributable, and the other is diffuse and delayed. The theory predicts which way the system will lean, and why it will never notice it is leaning. Our response, which keeps emergency protection fast, is priority 9.
And the stakes are large. Robert Bauserman’s 2002 meta-analysis of thirty-three studies, in the Journal of Family Psychology, found that children in joint custody were on average better adjusted than those in sole custody. Later reviews by Linda Nielsen and others point the same way. Calibration requires the caveats. Families who choose shared parenting may differ from those who don’t. High-conflict and violent households are a genuine exception. And correlation is not a court order. But a rebuttable presumption, with clear exceptions for abuse, is what structured discretion looks like (priority 2). Its absence, in a system with weak data, fragmented rules, and asymmetric blame, is what the Church of CYA looks like.
That is a judgment, and it can be wrong. Suppose Ohio published parenting-time outcomes by county. Suppose they showed consistent, well-reasoned allocations, and follow-up data showed children doing well. Then I would move Ohio toward the middle of the spectrum and say so.
Making the thesis risk something
Calling aviation “the cure” whenever it looks like a counterexample would be its own form of self-protection: absorbing evidence rather than risking the theory. So here are predictions that could have failed:
- If defensive medicine is driven by liability, tort reform should reduce it. It does, modestly. Studies of state damage caps find measurable but small drops in defensive testing, which suggests liability is one cause among several. That is what an honest version of the thesis predicts.
- If drug lag is driven by invisible victims, making those victims visible should speed approvals. ACT UP and COVID emergency authorizations both confirm this.
- If AI caution is harm-driven, it should track actual error costs. If it is blame-driven, it should track headline risk. This prediction is testable, and largely untested. Compare over-refusal rates on high-stakes versus merely embarrassing topics, and you’d know.
One more guardrail, for the essay’s own style. I have used caricature throughout: the “church,” the “sacrament,” the “hologram.” I think that is legitimate, because names make patterns discussable. Swift’s A Modest Proposal skewered England’s exploitation of Ireland through an absurdity nobody could forget. But caricature has a cost. Many readers remember the babies and forget the target. Caricature is a wedge, not a proof. The test of this essay is not whether its metaphors are memorable. It is whether its claims survive once the metaphors are stripped away. Logic discovers contradictions. Rhetoric makes people care about them. Institutions change only after both happen.
VII. The Cure Is Engineered Visibility
If the Church of CYA is what happens by default when blame is cheap to assign and harm is easy to hide, then the cure is not a sermon about courage. It is a set of mechanisms that change those two variables.
Two-sided error accounting. Publish deaths from drug delay alongside deaths from approval. Publish wrongful convictions alongside acquittals of the guilty, and lost parenting time alongside unpaid support (priority 4). For AI systems, publish over-refusal rates alongside harmful-output rates. An error nobody counts is an error nobody fears.
Sunset and review clauses. Make keeping a rule require justification, not just removing one. If a procedure must be re-justified against outcomes every few years, the sediment ratchet breaks.
Just-culture and safe-harbor reporting. Hospital communication-and-resolution programs disclose errors to patients, apologize, and offer compensation early. The Patient Safety and Quality Improvement Act of 2005 protects error reports shared with patient safety organizations. Both import the aviation lesson: protect honest reporting, and keep blame for recklessness.
No-fault compensation where liability distorts supply. The National Vaccine Injury Compensation Program, created in 1986, compensates injured people without forcing a blame fight. It kept vaccine makers from fleeing the market. The model could extend to other areas where the fear of lawsuits shapes behavior more than the harm itself.
Structured discretion. The opposite of zero tolerance is not unchecked judgment. It is judgment with reasons recorded, outcomes audited, disparities monitored, and good-faith protection for the people who make the call. That covers the school principal, the family court judge, and the prosecutor weighing a plea.
Independent visibility producers. Inspectors general, protected red teams, and journalists with legal protection exist to make invisible harms visible to people who are not in a position to bury them. The 2015 TSA test happened because someone was paid to look. For AI, that means independent testing of whether a model’s stated positions shift with the perceived ideology of the user. If they do, it is not calibrated. It is a mirror.
VIII. Choose Your Errors, or Have Them Chosen for You
Every institution will make mistakes. That is not the scandal. The scandal is when an institution chooses which mistakes to make based on who might notice, rather than who might be hurt.
Do not judge an institution by its statue, its slogan, or its mission statement. Those are holograms. Judge it by its error tolerance. Ask which failures it treats as emergencies and which it treats as acceptable losses. Ask who bears the cost of those acceptable losses, and whether those people have lawyers, cameras, or votes. Ask what the institution had to do to be excused when things went wrong, and whether that price bought any safety or only a file.
Apply the same test to the voice reading you this, which was asked to avoid one kind of blame and tried, imperfectly, to avoid all of them by aiming at the truth instead. The goal is neither a machine that avoids looking woke nor one that avoids looking reckless. It is one whose errors are chosen by who actually gets hurt, stated openly, and revised when the evidence changes.
The answer will tell you what the institution actually worships.
And if the answer is “its own defensibility,” then the bronze lady on the courthouse steps is not blind. She is just looking away.