Rules are instruments for making organized life possible

Rules are often explained as tools for maintaining order. That description is correct but incomplete. Rules also make cooperation possible, reduce uncertainty, protect rights, preserve commitments, constrain authority, distribute responsibility, create consistent expectations, and allow institutions to act beyond the memory or judgment of any one person.

A rule is justified when it addresses a recurring need that cannot be handled reliably through information, design, discretion, incentives, culture, or another less restrictive mechanism. The existence of a problem does not automatically justify a rule, and the existence of a rule does not prove that the problem has been solved.

This chapter examines the principal reasons societies and organizations create rules. It also examines the burdens rules create, the dangers of excessive or symbolic rulemaking, and the questions that should be answered before a new rule is added to an already complex system.

Rules convert collective purpose into repeatable expectations

Institutions have purposes that cannot be achieved by isolated decisions alone. A hospital must protect patients across thousands of encounters. A bank must preserve assets, meet legal obligations, and treat transactions consistently. A government must exercise authority through processes that remain legitimate when individual officeholders change. A manufacturer must produce reliable outcomes even when personnel, shifts, suppliers, and conditions vary.

Rules help convert those broad purposes into expectations that can be understood, applied, reviewed, and repeated. They answer questions such as:

  • Who is responsible?
  • What must, may, or must not be done?
  • Under which conditions?
  • Which interests or outcomes are being protected?
  • How will decisions be reviewed?
  • What happens when the ordinary rule cannot be followed?

Rules therefore connect institutional purpose to individual action. The connection is never perfect. A broad purpose such as fairness, safety, privacy, quality, or financial stability cannot be reduced to one rule. It must be expressed through a system of responsibilities, thresholds, procedures, permissions, prohibitions, definitions, and exceptions.

From purpose to institutional result

A sound rule is not merely a command. It is an institutional design choice. It determines which values receive priority, which risks are tolerated, who may exercise discretion, and what evidence must exist after a decision is made.

Rules allow people to act together without renegotiating every decision

Coordination is one of the oldest and most practical reasons for rules. When multiple actors depend upon one another, each needs some basis for anticipating what others will do. Traffic rules, accounting periods, filing conventions, meeting protocols, technical standards, and approval sequences all reduce the number of decisions that must be improvised.

Predictability does not require that every outcome be identical. It requires that similarly situated actors can reasonably understand the process, the relevant factors, the authority involved, and the range of possible results. A procurement team may select different vendors in different circumstances, but a stable bidding rule allows vendors and employees to understand how the choice will be made.

The World Bank's work on governance identifies coordination, cooperation, and credible commitment as core institutional functions that support effective policy.2 The point extends beyond government. Organizations work when people can coordinate their behavior around shared expectations without constantly reconstructing the institution from first principles.

Coordination rules are especially important when:

  • many actors must perform complementary tasks;
  • sequence and timing matter;
  • actors possess different information;
  • the cost of misunderstanding is high;
  • the same decision occurs repeatedly;
  • work crosses departments, organizations, or technologies.

Without coordination rules, each actor may behave rationally from a local perspective while the system fails. A department that delays reporting to improve the accuracy of its own figures may prevent another department from meeting a regulatory deadline. A system team that changes a data field without a shared change rule may break dependent processes. Rules provide the common timing, definitions, and handoffs required for collective action.

Rules preserve commitments beyond the moment they are made

Institutions must often make promises that remain credible after leadership, personnel, budgets, or circumstances change. Contracts, service standards, employment policies, constitutional limits, records obligations, and financial controls all preserve commitments across time.

A commitment is weak when it depends entirely upon the present preference of the person in authority. A rule strengthens commitment by making the expectation visible, durable, and reviewable. It tells affected actors that the decision is not supposed to change merely because a different manager, official, or reviewer is involved.

This does not mean that rules should never change. It means that change should occur through a recognized process rather than hidden departure. A rule can preserve continuity while still allowing amendment, emergency suspension, or exception when justified.

Across people

Personnel continuity

Rules prevent essential expectations from disappearing when experienced individuals leave.

Across time

Temporal continuity

Rules maintain obligations and protections after the circumstances of adoption are forgotten.

Across institutions

Relational continuity

Rules help multiple organizations rely upon shared commitments, definitions, and processes.

Commitment rules also limit opportunism. An organization may find it convenient to ignore a promise when compliance becomes expensive. A visible rule makes that departure easier to detect and challenge. In this sense, rules support trust by making institutional promises more than expressions of present intent.

Rules can protect people from arbitrary authority

Rules do not merely constrain those who are governed. They also constrain those who govern. Due process requirements, conflict-of-interest rules, appeal rights, approval limits, disclosure duties, equal-treatment standards, and records requirements establish boundaries around institutional power.

The United Nations describes the rule of law as a principle under which public and private actors, including the state itself, are accountable to publicly promulgated, equally enforced, and independently adjudicated laws that are consistent with human-rights norms.1 Although an internal corporate rule is not equivalent to public law, the institutional lesson is important: legitimate rule systems should make authority visible, bounded, and reviewable.

Fairness depends upon more than identical treatment. Different circumstances may justify different outcomes. Rules support fairness when they identify the relevant distinctions, prevent irrelevant favoritism, and create a defensible basis for explaining why one case differed from another.

A fair rule system should therefore address:

  • who has authority to decide;
  • which factors may be considered;
  • which factors must not be considered;
  • what notice affected people receive;
  • whether exceptions are available;
  • how decisions may be reviewed or challenged;
  • whether the rule is applied consistently across comparable cases.

Rules can also create unfairness when they encode biased assumptions, ignore unequal circumstances, impose inaccessible procedures, or grant discretion without review. The existence of a formal rule is therefore not evidence of fairness. Rules Integrity examines both the constraint and the distribution of its burdens, protections, and opportunities.

Rules make protective lessons repeatable before harm occurs again

Many rules are created because the consequences of error are too serious to leave entirely to memory or individual judgment. Safety checks, access restrictions, separation-of-duty requirements, clinical protocols, maintenance intervals, approval thresholds, and emergency procedures attempt to reduce the likelihood or impact of harm.

Preventive rules often encode accumulated experience. A lockout procedure may reflect prior injuries. A dual-approval requirement may reflect fraud losses. A retention rule may preserve evidence needed for legal rights or regulatory review. The rule transforms a lesson from one event into an expectation that applies to future events.

Risk rules must still be proportionate. A rule that eliminates one risk may create another. Requiring excessive approvals may delay emergency action. Restricting all data access may impair care, investigation, or service. A safety rule that is impossible to follow may produce concealed noncompliance rather than safety.

The preventive function of a rule

A mature rule system does not treat safety rules as permanent merely because they were created after harm. It preserves the reason for the rule, measures whether the rule works, and revisits the design when technology, evidence, or operations change.

Rules make decisions explainable after the fact

Accountability requires more than identifying who made a decision. It requires a basis for evaluating whether the decision was authorized, procedurally sound, consistent with applicable expectations, and supported by evidence.

Rules create reference points for review. Auditors compare conduct with controls. Courts compare action with legal duties. Boards compare management decisions with delegated authority. Regulators compare institutional practice with governing obligations. Employees compare disciplinary decisions with published policies.

A rule supports accountability when it produces or preserves evidence such as:

  • the source and version of the rule;
  • the facts known at the time of decision;
  • the actor and authority involved;
  • the criteria applied;
  • the approvals or exceptions granted;
  • the resulting action and outcome;
  • the later review, correction, or appeal.

Accountability rules also protect decision-makers. A professional who follows an authorized, well-designed process should be able to demonstrate that the decision was reasonable even when the result is unfavorable. Conversely, a vague rule may allow an institution to blame individuals for failing to meet expectations that were never made operationally clear.

Rules allow institutions to act through many people and systems

Large organizations cannot route every decision to the highest authority. They must delegate. Rules define the boundaries within which employees, officials, contractors, automated systems, and local units may act without seeking fresh permission each time.

Delegation rules may specify:

  • which roles may approve particular transactions;
  • financial or risk thresholds;
  • matters reserved to senior authority;
  • conditions requiring escalation;
  • documentation and reporting duties;
  • permissions that may or may not be redelegated;
  • temporary authority during absence or emergency.

Without clear delegation, organizations suffer from two opposite failures. Decisions may become centralized and slow because no one is confident that they possess authority. Or decisions may become uncontrolled because local actors assume powers that were never granted.

Technology increases the importance of delegation rules. A workflow may approve a transaction automatically, an algorithm may assign a risk category, or a system administrator may exercise broad technical power. The rule system should identify not only the human authority but also the authority embedded in systems, data models, configuration, and code.

Rules create common methods and shared meanings

Standardization rules establish common units, definitions, formats, tolerances, classifications, and procedures. They reduce variation where variation would create error, incompatibility, unfairness, or unnecessary cost.

In manufacturing, a specification allows parts from different sources to fit. In finance, accounting rules allow transactions to be recorded and compared. In healthcare, coding conventions support communication and analysis. In software, protocols allow systems developed by different organizations to exchange information.

Consistency is not the same as uniformity in every circumstance. A good standardization rule identifies where variation is harmful and where adaptation is legitimate. Excessive standardization can suppress innovation, professional judgment, local knowledge, and responsiveness to exceptional cases.

Rules that support interoperability must be particularly precise about definitions and versioning. Two systems may both claim to use the same category while assigning different meanings. Two departments may use the same threshold but calculate it from different data. Shared words without shared semantics create the appearance of consistency rather than consistency itself.

Rules preserve knowledge that would otherwise disappear

Institutions outlive individual memory. The reasons behind a decision may become obscure as experienced employees retire, records are dispersed, and circumstances change. Rules can preserve lessons, commitments, and boundaries so later actors do not unknowingly repeat earlier mistakes.

But a rule preserves institutional memory only when its provenance is maintained. A sentence without its rationale may survive while the knowledge that justified it disappears. Future reviewers may continue the rule blindly, remove it carelessly, or reinterpret it for a different purpose.

Useful rule memory therefore includes:

  • the problem or obligation that led to the rule;
  • the authority under which it was adopted;
  • alternatives considered;
  • major assumptions and dependencies;
  • the expected outcome;
  • known tradeoffs and exceptions;
  • significant amendments and reasons for change;
  • evidence concerning effectiveness.

Institutional memory is one reason traceability matters. A rule should be more than its current wording. It should remain connected to the history and purpose needed to evaluate whether it still belongs in the system.

Every rule consumes attention, time, discretion, and trust

Rules are not free. They impose direct costs such as training, documentation, systems, approvals, monitoring, enforcement, reporting, and review. They also impose less visible costs by limiting discretion, slowing action, increasing complexity, and shifting attention from judgment to formal compliance.

The OECD's regulatory-policy work emphasizes that rules should be based on sound information, assessed for impact, and reviewed for effectiveness rather than assumed to remain useful indefinitely.3 4 This principle applies inside organizations as well as governments.

Common costs and dangers include:

Administrative burden

Time and resources are diverted to approvals, forms, records, and reviews.

Decision delay

Rules designed for ordinary cases obstruct urgent or unusual situations.

False assurance

Formal compliance is mistaken for actual safety, quality, legality, or effectiveness.

Loss of judgment

Professionals defer to the rule even when facts indicate that a different response is needed.

Complexity accumulation

New rules are added without removing obsolete, duplicate, or conflicting rules.

Adversarial compliance

Actors satisfy the literal wording while defeating the purpose.

Unequal burden

A facially neutral rule imposes disproportionate difficulty on particular groups or operations.

Rule avoidance

Unrealistic requirements drive work into informal, undocumented, or concealed channels.

A rule that protects one value can weaken another. Documentation supports accountability but can consume time needed for service. Central approval supports control but may impair local responsiveness. Strict consistency supports fairness but may produce unfair outcomes when relevant circumstances differ.

The existence of tradeoffs does not mean rules are undesirable. It means rulemaking is a responsibility that requires evidence, proportionality, and continuing review.

Some problems are better solved by design, information, culture, or judgment

Organizations often respond to failure by adding a rule. A mistake occurs, a complaint is received, or an audit finding is issued, and the immediate remedy is another mandatory statement. This reaction can be understandable and still be wrong.

A rule may be unnecessary when:

  • the event is rare and cannot be generalized responsibly;
  • the problem resulted from lack of information rather than lack of obligation;
  • the desired behavior can be made easier through better process or system design;
  • professional judgment is essential and cannot be reduced to stable criteria;
  • an existing rule already addresses the issue but is poorly communicated or implemented;
  • the rule cannot be enforced fairly or consistently;
  • the expected benefit is smaller than the burden and unintended consequences;
  • the surrounding facts are changing too quickly for a fixed rule to remain reliable.
Should the problem become a rule?
Question 1 Is the problem recurring, material, and sufficiently understood?
No

Investigate, gather evidence, or handle the isolated case directly.

Yes

Continue to alternatives analysis.

Question 2 Can information, training, incentives, process design, or technology solve it with less restriction?
Yes

Use the less burdensome mechanism and monitor the result.

No

Design a proportionate rule with scope, authority, exceptions, and review.

A decision not to create a rule should itself be reasoned and reviewable when the issue is significant. The alternative may still require ownership, monitoring, evidence, and a future trigger for reconsideration.

Rules often fail because their reason for existing was never made clear

Failure case 1

The rule created after one unusual event

A rare mistake produces a universal approval requirement. Thousands of routine decisions now require review, but the original event would not have been prevented because its cause was missing information rather than lack of approval.

Failure case 2

The symbolic rule

Leadership issues a strong policy statement to demonstrate concern, but no responsibilities, resources, procedures, or evidence are defined. The rule communicates values without changing institutional capability.

Failure case 3

The rule that duplicates an existing obligation

A department creates a new local rule instead of implementing the existing enterprise rule. The wording differs slightly, creating uncertainty about which threshold, exception, or approval path controls.

Failure case 4

The rule designed for audit appearance

The organization requires a form because the form is easy to show during an audit. Employees complete it after the decision, producing evidence of a control that did not actually influence the decision.

Failure case 5

The permanent emergency rule

A temporary restriction is adopted during a crisis. The emergency ends, but the rule remains because no expiration date, review owner, or retirement condition was established.

Twelve questions before creating a new rule

The following questions help determine whether a proposed rule is justified and whether rulemaking is the right response.

  1. 01

    Problem

    What recurring problem, obligation, risk, right, or coordination need requires attention?

  2. 02

    Evidence

    What evidence shows that the problem is real, material, and understood well enough to regulate?

  3. 03

    Purpose

    What outcome should the rule produce or protect, and how will success be recognized?

  4. 04

    Existing system

    Does an existing rule already address the issue, and is the true failure communication, implementation, enforcement, or design?

  5. 05

    Alternatives

    Could information, training, incentives, process redesign, technology, supervision, or professional judgment solve the problem with less burden?

  6. 06

    Authority

    Who has legitimate authority to create the rule, and what process must be followed?

  7. 07

    Scope

    Which actors, situations, locations, systems, and time periods genuinely require the rule?

  8. 08

    Tradeoffs

    Which values, rights, risks, costs, delays, and discretionary judgments will be affected?

  9. 09

    Feasibility

    Can affected actors comply with the available authority, information, resources, systems, and time?

  10. 10

    Behavioral effects

    What incentives, workarounds, avoidance strategies, or unintended consequences might the rule create?

  11. 11

    Evidence and review

    How will application, compliance, outcomes, exceptions, and side effects be observed?

  12. 12

    Lifecycle

    Who will own the rule, and what event, date, evidence, or change will trigger amendment or retirement?

Choosing the right institutional response

Observed problem

Employees repeatedly send confidential reports to the wrong internal distribution list.

Immediate rule response

“Employees must verify every recipient before sending confidential reports.”

The statement is reasonable, but it places the entire burden on attention and may duplicate an existing confidentiality obligation.

Broader response

Remove ambiguous distribution lists, require named groups for restricted reports, display the classification before sending, and retain a focused rule for exceptional manual distribution.

The better response combines design and rulemaking. Technology reduces the likelihood of error, while the remaining rule addresses situations the design cannot control. This is often more reliable than adding another general reminder.

Coordination need

Three departments must provide information before a regulatory submission can be filed, but each uses a different internal deadline.

Appropriate rule function

A shared timetable and escalation rule is justified because the decision is recurring, interdependent, time-sensitive, and vulnerable to local optimization. The rule should define ownership, sequence, evidence, and exception handling.

Judgment-intensive decision

Senior clinicians must determine whether unusual patient circumstances justify departure from the ordinary protocol.

Appropriate restraint

A rigid outcome rule may be unsafe. The stronger design may define authority, documentation, consultation, and review while preserving professional judgment over the substantive decision.

Rules should exist for reasons that can be stated and examined

Rules exist to coordinate action, create predictability, preserve commitments, protect rights, limit power, reduce risk, support accountability, delegate authority, standardize essential practices, and preserve institutional memory. These functions make complex organizations and societies possible.

But rules also create burden, delay, rigidity, complexity, and opportunities for formal compliance without substantive success. The responsible question is not simply whether a problem deserves attention. It is whether a rule is the most justified, proportionate, and maintainable response.

The reason for a rule should remain connected to the rule throughout its lifecycle. When the purpose disappears, the evidence changes, a better mechanism becomes available, or the rule begins to produce greater harm than benefit, the institution should be able to revise or retire it deliberately.

Foundational principle: No rule should be created merely because an institution wants a visible response. A rule should exist because a recurring need has been understood, alternatives have been considered, and a defined constraint is the most responsible way to protect or achieve a legitimate outcome.

Sources informing this chapter

  1. United Nations. “What Is the Rule of Law?” The UN formulation emphasizes public accountability, equal enforcement, independent adjudication, and consistency with human-rights norms.
  2. World Bank. World Development Report 2017: Governance and the Law. The report identifies credible commitment, coordination, and cooperation as central institutional functions.
  3. Organisation for Economic Co-operation and Development. Recommendation of the Council on Regulatory Policy and Governance.
  4. Organisation for Economic Co-operation and Development. OECD Regulatory Policy Outlook 2025. Evidence-based rulemaking, impact assessment, review, and regulation focused on effective outcomes.
  5. Stanford Encyclopedia of Philosophy. “Social Norms.” Background on informal rules governing behavior within groups and societies.
  6. Stanford Encyclopedia of Philosophy. “Authority.” Philosophical analysis of authority, legitimacy, and reasons for compliance.
  7. U.S. Office of Management and Budget. Circular A-4: Regulatory Analysis. Analysis of need, alternatives, benefits, costs, uncertainty, and distributional effects.
  8. European Commission. Better Regulation Guidelines and Toolbox. Guidance on evidence, consultation, impact assessment, monitoring, and evaluation.

These sources provide established perspectives on governance, authority, coordination, rights, and regulatory quality. The Rules Integrity framework in this chapter extends those perspectives to rule systems across public, private, professional, contractual, and technical environments.