HOW TO THINK ABOUT IMPLEMENTING THEM
The adoption sequence
Laws that arrive as announcements get ignored. These arrive as an order of operations, a price tag, and a set of questions wired into review.
1
Adopt Law 2 firstHonest state is the cheapest visible win: enumerate the real states, write the copy beside the code, ban the catch-alls. Users and Exco feel it in weeks.WHY THIS ORDER · it needs no new infrastructure and builds the habit the other laws depend on
2
Lay Law 1 as substrateThe read ledger ships with the object store (Build Book stage 1), then extends to the write ledger for obligations: assignments and submissions as recorded events.WHY THIS ORDER · retrofitting provenance is archaeology; it must ride the first schema
3
Rehearse Law 3 into existenceName every automated path's lawful fallback, build it, drill it quarterly. An unexercised fallback is a Law 2 violation waiting to happen.WHY THIS ORDER · a fallback becomes real the first time it runs with real users, not when it is documented
4
Wire the questions into reviewThe altitude questions below go into the design-review and PR templates verbatim. Compliance stops being a meeting and becomes a checkbox with teeth.WHY THIS ORDER · enforcement at the point of decision, exactly as grants enforce at the endpoint
THE LAWS, BY ALTITUDE
The laws, stated by altitude
LAW 1 · THE READ LEDGER
Every access is an event on the record it accessed
Enforcement lives at the endpoint, never in the UI or in policy; a grant not checked at the point of service is a wish. The ledger is symmetric: platform and insider reads land beside external ones.
ENDPOINTNo valid grant, no bytes; reads write. Ask: show the code path where an unauthorised read is refused, and the event the refusal writes.
PRODUCT"Who has seen my data" is a user-facing query. Ask: where does the user see their read ledger?
ORGANISATIONObligations are ledgered writes; ownership is never a memory dispute. Ask: when this was assigned, what recorded it?
GROUPOne convention, one answer to every auditor. Ask: is this build adopting the convention or inventing a private one?
LAW 2 · HONEST STATE
Degraded is allowed; lying about it is not
No false errors, no optimistic countdowns, no dead ends dressed as waiting screens. Every blocked state names its reason and next action.
ENDPOINTThe real state machine exists in code with versioned copy. Ask: enumerate the states; show the copy for the worst one.
PRODUCTReal queue times; stale reads stamped stale. Ask: when this number is wrong, how does the user know?
ORGANISATIONStatus is glanceable: owner, blocker, next action, on the record. Ask: could a third party reconstruct this workstream without interviewing anyone?
GROUPIncidents disclosed in the product's own honest voice. Ask: does the comms plan survive being screenshotted?
LAW 3 · LAWFUL FALLBACK
Under stress, shed speed, never legality
The degraded mode is the slower lawful path, never the faster unlawful one. The epistemic governor compiled into architecture: permission contracts as conditions degrade.
ENDPOINTEvery automated path has a named, built, drilled fallback. Ask: when did we last run it with real users?
PRODUCTDegraded flows say they are slower and why. Ask: what does the user see the day the fast path is off?
ORGANISATIONNo metric tempts anyone to bend a rule. Ask: which target would, and what protects the person who refuses?
GROUPWork with the regulator's grain; request changes openly. Ask: is this design with the grain or against it?
MODELS
The laws applied to AI
INFERENCE UNDER LAW
A model is a very fast colleague with no memory and no licence
LAW 1Every inference is a read of the features it consumed and a write of the score it produced, with model version and threshold, on the same ledger. Explainability is provenance for decisions: "why was I held" is a query. Ask: show the ledger event for this model decision.
LAW 2Automated holds and offers show honest state: what held it, what review path exists, what the number would need to change. Ask: what does the user see when the model says no?
LAW 3Every model has a deterministic lawful fallback (static conservative LTV, rule-based pre-trade limits). Model degraded means stricter, never skipped. Ask: what ran the day the model was down, and was it more conservative?
WHERE IT RUNSHot path in-jurisdiction and close to the data (order flow and BVN-linked features do not leave the building); warm path near-real-time; cold path in the warehouse. Provider decided openly with related-party terms papered. Tiering: Gate Series 01.
THREE-TEAM GOVERNANCE
How the laws police the boundaries
Interface changes get both boundary owners plus the four law questions. Each layer answers the altitude questions for its own builds; the weekly layer-owner sync reviews register movement in honest-state form (owner, blocker, next action, on the record). Deviations are argued in writing against the interlock, not waved through.
CONSTRAINTS
Interlock and price
INTERLOCK
All three or none
Law 3 is only safe because Law 2 tells the truth about the slower path; Law 2 is only auditable because Law 1 recorded what happened. Keep two and the gap leaks through the one you dropped.
PRICE
Priced at adoption, not discovered in sprint three
LAW 1Write amplification on every access; bounded by batching and tiering ledger-worthy reads. Never free.
LAW 2The real state machine plus copy maintained as code.
LAW 3The lawful slow path built and rehearsed, on the calendar.
One breath: record every touch, tell the truth about every state, and when things break, get slower, never get illegal.
NASD Next Gate Series · prepared with VFD Group (GTPP) · 22 Jul 2026 · series: 00 Build Strategy · 01 Launch Plan · 02 Build Book · 03 Run Book · 04 Resolutions · 05 The Laws
FEEDBACK · VOLUME 05
{{ composingTitle }}
remembered for next time · visible to the committee
Cancel
Save feedback
NASD PLC · 9TH FLOOR, UBA HOUSE, 57 MARINA, LAGOS · REGULATED BY THE SEC, NIGERIA
PREPARED WITH VFD GROUP · GTPP · THE OBJECT IS THE PRODUCT; THE APP IS A LENS OVER IT