The Workaround Is a Governance Signal

The gap the workaround sits in

Every organization runs two processes: the one that is documented and the one that happens. Brown and Duguid called these canonical and non-canonical practice, and found that the second is where the work actually gets done and where learning actually accumulates. Lucy Suchman made the underlying point earlier: a plan is a resource for action rather than a determinant of it, because no plan contains the situation it will meet.

A workaround lives in the gap between the two. It is not a failure of discipline; it is what filling that gap looks like when the person filling it has no authority to change the documented version. And the people who build them are not the least compliant members of an organization. They are usually among the most capable, because building one requires understanding the work well enough to see what the process missed.

Why removing it does not work

Tucker and Edmondson studied nurses solving problems in hospitals and drew the distinction that governs this whole subject. First-order problem solving patches the immediate obstacle so the work can continue: the missing supply is borrowed from another ward, the shift proceeds, nobody hears about it. Second-order problem solving surfaces the cause and changes it. Their finding was that organizations overwhelmingly get the first, that it looks like competence and resilience, and that it is precisely why nothing improves.

Prohibition converts a first-order response into a hidden one. The visible instance stops, the unmet decision remains, and the next accommodation is built by someone who now knows not to mention it. The organization has not reduced its risk. It has removed its own visibility into it, and it will call that compliance.

Reckless bypass or adaptive local control

The distinction matters because the responses are opposite, and three tests separate them. Could the person articulate the risk they were accepting? Is the workaround visible to anyone who would want to know? Does it degrade safely, stalling rather than producing a silent wrong answer?

Adaptive local control passes all three. A reckless bypass fails at least one, and most often the second, because concealment is the reliable marker. James Reason drew a related line between errors and violations, and noted that many violations are what he called necessary: the rule as written cannot be followed and the work still has to be done. A necessary violation is a defect in the rule.

The danger is what Diane Vaughan documented at NASA as normalization of deviance. A workaround that succeeds becomes the way it is done, its original justification is forgotten, and the risk it accepted is quietly inherited by people who never evaluated it. This is why containment needs an owner and an expiry rather than tolerance: an unexamined workaround does not stay a decision, it becomes a condition.

Four responses, and only one of them is prohibition

The Workaround Protocol

Run it on a recurring workaround before deciding anything about it. The second and fourth rows are the ones that produce the design change.

The investigation has a precondition, and it is not procedural. Nobody will describe a workaround accurately to someone who might punish them for it. Whatever the protocol says, what determines the quality of the answers is whether the person believes the conversation is diagnostic. That is the same condition that governs every other kind of honest reporting.

What AI changed

The mechanism is unchanged and the physics are not. A workaround that used to be a spreadsheet maintained by one person, bounded by how much of it they could keep up by hand, can now be an automated flow that runs continuously and was built in an afternoon by someone with no engineering support. Scale and persistence both increase, the containment window shrinks, and the signal value stays exactly what it was.

Shadow AI takes up the adoption side of this directly, and reaches the same conclusion by a different route: ungoverned adoption is an authority vacuum before it is a security failure.

The Four A's reading

This is Authority, read backwards. Most authority diagnostics ask where decision rights sit. A workaround answers a sharper question without being asked: where the rights sit is wrong, here, specifically, and someone was willing to take a personal risk to prove it. Treated as evidence, a catalogue of recurring workarounds is one of the highest-quality authority datasets an organization already possesses and almost never reads.

It depends on Alignment to be readable at all, because the information only surfaces where reporting one is safe, and it tests Adaptability, because absorbing a workaround means conceding that the documented process was wrong, which is the specific concession organizations find hardest to make.