Field definition

From the documentation of the field

Decisional Integrity is the property a decision structure has when it possesses the six primitives of Ismail's Primitives whose absence provably guarantees unbounded loss.

In a complex environment, a decision structure that lacks one of the six primitives of Ismail's Primitives incurs linear regret (the necessity result, proved in SixPrimitives/Phase3.lean): its loss grows in proportion to time.

Each term in the definition has a precise meaning, and the sections below take them in turn.

The object: a decision structure

A decision structure is the standing arrangement by which a person, an institution or a machine takes in information, chooses, commits to a course, holds limits and revises its picture of the world, repeatedly, as time passes. Decisional Integrity is a property of that arrangement. A single decision can turn out well or badly under any structure. The guarantees in the definition concern what happens as decisions accumulate, because the loss they describe grows with time. The model behind this is a partially observable Markov decision process, and why a POMDP explains the choice.

The six primitives

The research behind this field identifies six situations a structure may face and, for each, the capability it then needs. The capabilities are the six primitives of Ismail's Primitives, written X₁ to X₆.

These are plain readings. The authoritative definitions are formal, and they are in the paper and in SixPrimitives/Phase0.lean. Audit it yourself shows how to read each formal definition against its plain reading.

When absence guarantees loss: Class C

A structure belongs to Class C when its environment exhibits at least one of the six situations. It does not need all six. The necessity results are conditional on membership. For a process that faces situation Pᵢ, lacking the matching capability Xᵢ forces linear regret: the gap between what the process achieves and the best it could have achieved grows in proportion to time.

Two consequences follow. Membership needs only one situation, so a structure is placed in Class C by facing any one of them. Once it is in Class C, the theory asks for all six primitives of Ismail's Primitives: each is necessary in the environment that exhibits its situation, none can stand in for another, and the six form a cycle in which a missing primitive weakens the cycle itself. Necessity and sufficiency sets this out. And which situations a structure faces is a question of fact. It is answered by assessment, and it can be answered wrongly in either direction. Error theory covers how.

A structure that faces none of the six sits outside Class C and is not bound by any of the necessity results. The paper treats that as possible in principle but exceptional in practice. The Class C page sets out what lies inside and outside, and how the boundary can be tested. Resemblance is not membership. The paper's own boundary cases are these:

• A loss that sits within ordinary variance around a strategy the evidence still supports is not a trap.
• A choice left open because material evidence is still arriving is not a failure to commit.
• A preference that trades off smoothly against other goals is not a hard constraint.
• A single surprising outcome that is consistent with an unchanged process is not a change of regime.
• An improvement that costs nothing is not a local optimum.
• A choice between options, where one is already known to dominate, is not ambiguity, provided that knowledge is current.

The reverse also holds. Renaming a situation does not remove it. A committee that calls its failure to commit "strategic flexibility" is still describing a commitment failure.

How the proofs relate to the theory

The proofs are the smallest, most modular environments that show the theory is true. For each primitive, the paper builds the minimal environment that exhibits just its situation and proves, machine-verified in Lean 4, that an algorithm lacking the primitive incurs linear regret there. A minimal environment is where an impossibility result is cleanest and strongest: if a failure is forced there, it is forced wherever the difficulty appears. Any larger environment that contains the difficulty contains the minimal one, and the result carries to it by a reduction that is standard throughout the regret lower-bound literature: an algorithm gains nothing against a hard case embedded in a larger environment that it could not already gain against in isolation.

The minimal environments are the simplest case of the theory (Ismail's Primitives). The theory applies to any environment, however complex, in which the difficulty occurs. Verification tiers sets out what the formal check establishes.

The kind of verdict

The verdict this field supports is a conformance verdict on necessity. It says whether a structure possesses a mechanism that performs each function the situations it faces make necessary. It says this about the structure, at a point in time, against published criteria, and only a mechanism that performs the function counts; a document that resembles one does not.

It is not a prediction. The theorem is conditional: if a process faces a situation and lacks the matching capability, loss grows with time. A verdict addresses those conditions. It forecasts neither success nor failure for any organisation and makes no claim of sufficiency. Sufficiency for one organisation needs two things: that organisation's own definition of success, and case-specific mathematical work establishing the Implementation Obligations for it. Part III of the paper, a formally-verified bridge towards sufficiency, is where that question is taken up. See necessity and sufficiency.

Integrity and assurance

You can have Decisional Integrity without Decisional Assurance: a structure that has the primitives of Ismail's Primitives but that nobody has verified. You cannot have Decisional Assurance without Decisional Integrity: you cannot verify a property that is not there.

Here "assurance" carries its generic sense of verifying. Decisional Assurance names the act of verifying whether a structure has Decisional Integrity. The act is not tied to any firm. The criteria are published so that a qualified person can read them and carry out an assessment, and the competence page says what qualified means and how it is shown. See also the standard and three-party verification.

The engineer and the architect

A bridge has structural integrity if it can bear its design load. That is a binary, verifiable property. The engineer certifies it. The engineer does not certify that the bridge is beautiful, that it leads somewhere worth going, or that it fulfils the architect's vision. The engineer certifies that it will not collapse. The architect defines the purpose, and that work is subjective. Once the purpose is defined, the engineer can verify whether the structure bears it.

Decisional Integrity belongs on the engineer's side of that division. Whether a structure's purpose is worth pursuing is a separate question, and the field leaves it to whoever sets the purpose.

Where the field stops

• Defining success, purpose and strategy belongs to whoever sets the purpose, and to strategy and governance practice.
• Choosing well inside a structure, including how people weigh options, estimate probabilities and resist bias, belongs to decision analysis and decision-quality work.
• Enterprise risk management, assurance engagements, and safety and assurance cases have their own standards and practices. Adjacent fields states how each relates to the six primitives of Ismail's Primitives.
• Sufficiency for a particular organisation needs case-specific mathematical work, described in necessity and sufficiency.
• Evaluating the machine verification is open to anyone who can read Lean 4 and the paper, and audit it yourself shows how.