Optimal compliance, not perfect

• Why the complete rulebook is what makes the most important rule lose
• Why more information gives less learning, not more
• Why it does not help to repeat the information one more time
• Why a security organisation has realised that going for optimal, not perfect, compliance gives more compliance

The most common reaction to a rule nobody follows is to make the rulebook more complete. Give more information. More tests. More e-learning. More compulsion. But what if it actually does more harm than good? And what can you do instead?

The premise it all rests on

I believe people actually want to do the right thing. When they do not, it is rarely about unwillingness. It is about friction: everything that makes it hard, unsafe or meaningless to act rightly. I have written quite a lot about that in Behavior Design.

But try proving it on a person. Your colleague did not follow the rule — why not? Was he busy? Could he not be bothered? Was he tired, did he disagree, or had he not understood it at all? Five explanations are in play at once, and you cannot separate them. That is why the discussion about compliance goes round in circles and the standard solutions get repeated. It can always be explained as someone who did not pull themselves together or did not know enough. In other words, a lack of knowledge or motivation.

So I did something else. I used a language model the way biologists use a fruit fly. Not because the fly is a human, but because you can see the mechanism working in it.

It is not about the machine resembling us. It is about this: on precisely the demands a rulebook makes — read every single rule, never get tired, have no resistance to the rule, hold the whole manual in your head at once — a language model is better placed than any human. It does not skim. It is not offended at being sent on a course. It is not busy with its real work. If the method were going to work anywhere, it should work there.

What happened

The task was one rule, chosen at random and easy to check: redact all personal names in a text. Two conditions.

In the first, the rule stood alone, as a short, positive recipe: do this. The models solved it around 100% of the time.

In the second, exactly the same rule was buried among fourteen other rules — a realistic extract from a manual, where the other rules were just as valid and just as mandatory. The rule was still there, and every word of it was there.

The weakest model dropped from 100% to 0. A mid-sized one landed at 60 to 88%. The strongest of those tested held 100% — it had enough capacity for fourteen.

What the measurement shows, and what it does not

Does that mean people fail the same way? No. The measurements were made on language models, and that is not the same as having measured people.

What the measurement shows is something narrower and, in my view, more useful: you do not need a person’s tiredness, busyness or unwillingness to make a rulebook fail. The collapse happened in a substrate where none of the three exist. A structural cause — too many demands on too little capacity — is therefore enough on its own. And then “the employee should just have pulled themselves together” stops being a sufficient diagnosis.

That people also fail when faced with complete rulebooks is not my discovery. Erik Hollnagel’s distinction between work-as-imagined and work-as-done says it directly (Hollnagel, 2014). In clinical decision support, alert fatigue has been measured as a dose-response: the more reminders at the point of decision, the lower the acceptance of each, driven by overload and not by lack of will (Ancker et al., 2017). Safety research has its own name for it: complete top-down rulebooks fail when they meet real operators (Hale & Borys, 2013). And the general shape — performance rises with information up to a point and then falls — has been described for forty years (Eppler & Mengis, 2004).

What my measurement adds is not that it happens, but a suggestion of why, and a place where the mechanism can be counted.

Whether people and machines fail through the same mechanism is a hypothesis. I have written it so you can shoot it down: find a group whose compliance rises steadily the more complete the rulebook becomes, on a task with real competing rules and no way of looking things up. Then the claim is wrong. I do not think that group exists, but it is a proposal and not a result.

Perhaps you are thinking that there is something the machine does not have, and that objection is the one I like best myself. On one point the machine is actually worse placed than we are: it has no meaning in anything. A person who experiences a rule as their own — think of a surgeon and sterile technique — can push it through an overload that the machine cannot. That is true. But that resource only exists for the rules you already feel are your own, and a rulebook consists mostly of the others. A clause on competition law has no place in a social and healthcare assistant’s own purpose. For exactly those rules there is no meaning to draw on, and the person has tiredness and unwillingness on top.

The error happens one step earlier

Before a rule can lose a race in a pressured situation, it first has to be learned. And learning is not free. Beyond a limit, more information gives less learning, not more. That is cognitive load and the redundancy effect, measured on people almost thirty years ago (Sweller, van Merriënboer & Paas, 1998), and the limit itself is even older (Miller, 1956).

That turns the reflex on its head. We have treated compliance as a quantity: get every single rule in front of each person. But the more you send, the less gets learned — and the behaviour depends on what was learned. The complete rulebook is the one with the worst chance of sticking.

So should you just say it more often? No, and that is worth dwelling on. Drilling the same message does not build the route. Spaced, varied practice does, and so does retrieving the answer yourself, and that is among the most replicated findings there are (Cepeda et al., 2006; Roediger & Karpicke, 2006). Drilling even has a price people rarely count on: it builds a rigid route that fires mechanically but cannot deviate when the situation demands it. It looks better in the measurement right after the course and worse on the day it matters (Soderstrom & Bjork, 2015). If you want to see that difference in a concrete example, it is in Knowledge is not skill.

That is why the goal is not one hundred per cent

What the reflex is really chasing is perfect compliance. Completeness is only the means.

But perfect compliance is impossible in principle, and not just hard. And the irony is that the harder you push for it, the less compliant behaviour you get.

The curve turns. The x-axis is how complete the rulebook is. The y-axis is how much of the behaviour actually gets installed. On the left there is too little: the rule is written nowhere, and then there is nothing to comply with. Then it rises, as you would expect. And then there is a point where it stops rising — and where what you add to be covered starts taking away from what was supposed to be installed.

Optimal is at the top. Perfect is too far to the right.

This is not only a point about compliance. I have built the same distinction into an architecture for rule-governed advisory systems, where it carries the title directly: Optimal, Not Perfect.

So where is the top for your employees and colleagues? It depends on who has to use the rules. A specialist who knows their field has a top further out than someone who reads the rule alongside their real work. The top moves. It does not disappear.

Documentation and behaviour are two different things

Here is the point I think is the most important in the whole paper, and it is not about documenting less.

Your complete rulebook has to be complete. The auditor must be able to see that the requirement is described, when it was updated, and who has signed it off. That is a real requirement, and it has to be met.

But what you can put on the table and what people actually do are two different things — and we use the same document for both. The assumption is that the better something is described, the better it gets done. The measurement says that holds part of the way and then turns round. That is where it becomes a paradox and not just an irritation: aim for perfect compliance, and you get suboptimal behaviour. One hundred per cent completion is easiest to achieve by making the course easy to click through — and then there is no behaviour left to measure.

Notice that these are two different questions. What must the auditor be able to see? And what must your colleague actually do on Tuesday at ten o’clock? The first is a documentation question, the second is a behaviour question, and only the first can be answered by a complete rulebook.

So split the two things up, and review them against separate yardsticks:

• The archive — what you can put on the table if anyone asks — carries the completeness. The policy, the whole rulebook, the versions, the sign-offs. It must be complete, and it must be possible to look things up in it.
• The behaviour product – the course, the diagram and the like – carries the compliance. Short. Positively worded. It is about the few things people actually have to do differently, and it is practised, not just shown.
• For the rest, use performance support, e.g. checklists or cues that fit the specific situation. At each decision point: bring up the one relevant rule.

You could read this as a proposal to relax the requirements. But it is actually the opposite: it is to stop using one document for two jobs, when it can only do one of them.

It has happened before, and it worked

If you are now thinking that no authority would go along with it, let me tell you about one that did.

Password policies used to require capital letters, numbers, symbols and a new password every quarter. For most people that requirement is impossible. So what did people do? The only thing that could be done — reused passwords they could remember, which were changed when they were asked to. Typically a “junk password” used for all sorts of sites, e.g. MyPassword1!, MyPassword2! and so on, and a more secure password used both at work and in other places where more security is required (MoreSecur3Password1!, MoreSecur3Password2!). It is not down to lack of will, because people do want to be secure.

And the point is that pushing the rule harder pushed the behaviour into a worse state, not towards the ideal: more predictable variants, more reuse.

NIST reversed its own guidance and stopped requiring capital letters, numbers and symbols, and stopped requiring a new password every quarter when there is no sign that anyone has broken in. Instead: make them longer, and check them against the lists of passwords that have already been leaked (Grassi, Garcia & Fenton, 2017; continued in Revision 4). In other words, a security standard stopped maximising the rule, because maximising gave less of the behaviour it wanted.

It is the same figure as above. They found the top instead of going for the extreme.

What you can do on Monday

Not rebuild everything. One thing.

Take the rulebook you last sent out, and write down what you want people to do differently. Not know. Do. How many things are on your list? Probably between three and five — and if there are thirty, you have the answer to why it does not get done.

Then you separate the three from the rest. The three become what you communicate. What gets practised, preferably as a situation where people have to choose for themselves, and not as a walkthrough. The rest becomes something you can look up, where the decision is made, and the documentation in the archive.

And let me give you one detail that is cheaper than it looks: write what people should do rather than what they must not. A prohibition makes the forbidden action more present, not less, and that applies to a language model too. A positive recipe beats the list of prohibitions.

The question I always end up asking is this: does this make it easier to act rightly — or harder to act wrongly? If the answer is not clear, it should be cut.

Where it is, if you want to see it for yourself

The measurements, the controls, the capacity staircase and the full account of what has been measured and what is only hypothesis are in the paper: Governance Irony: Why Information-Heavy Compliance Directives Mechanically Fail in Large Language Models (Lund, 2026, CC BY 4.0).

The theory the mechanism comes from is at frictiontheory.org.