Previously in this series
Issue #001 — Layer 1 · Purpose — Coutts. NHS triage. What happens when institutions deploy systems without encoding what they actually exist to do. The gap accumulates silently. Until it doesn’t.
Issue #002 — Layer 2 · Strategy — Credit Suisse. NHS England. Eight years of drift between Purpose and what Strategy was actually serving. Nobody asked whether the two were still compatible.
Issue #003 — Layer 3 · Intent — Wells Fargo. Kaiser Permanente. A mandate issued without a boundary. The mandate was real. The outcome was not intended. The gap was never closed.
Issue #004 — Layer 4 · Rules — Wirecard AG. Orpea Group. The rules were followed precisely. The outcome was catastrophic anyway. Not misconduct within the rules. Rules that had become the architecture of the harm.
Issue #005 — Layer 5 · Judgment — Apple Card / Goldman Sachs. UnitedHealth / nH Predict. The model decided. The institution was accountable. Nobody had defined where one ended and the other began.
This issue: Layer 6 — Decision. The moment judgment becomes a recorded act. Or doesn’t. Where replayability is either built into the architecture — or permanently foreclosed.
The institutions referenced in this issue are cited on the basis of publicly documented regulatory findings, official investigations, court filings, and other published reports. All analysis is educational. Nothing here constitutes legal, regulatory, financial, or investment advice.
00 · This Issue
The decision was issued. Nobody could prove what authorised it.
Every layer before this one is preparation. Purpose sets the mandate. Strategy allocates resources. Intent defines the objective. Rules create the constraints. Judgment exercises discretion within those constraints. None of it matters if the moment of decision — the actual act of choosing and committing — leaves no verifiable record.
Layer 6 is where judgment becomes a decision. The point at which the institution commits. An action taken. A transaction executed. A patient’s care pathway altered. A customer’s credit access closed. The decision is issued.
The Layer 6 question is not whether the decision was right. It is whether the institution can prove what it decided, when it decided, under what authority, with what information in front of it. Not reconstruct. Not approximate. Prove.
Explainability produces a narrative about the decision after the fact. Replayability reconstructs the decision from a record built at the moment it was made. The distance between those two things is the governance gap this issue is about. In both cases below, the decision was issued. The record that would have made it auditable — and the institution accountable — was never built.
Decision Integrity Chain™ · Where Layer 6 Sits
›
L2
Strategy
How we allocate
›
›
›
›
L6
Decision
The recorded act
THIS ISSUE
›
›
L1–L5 are preparation. L6 is commitment. The moment judgment becomes a recorded act — or doesn’t. Everything before Layer 6 can be revisited. After Layer 6, the institution has either built the record or permanently foreclosed the ability to prove what it decided.
01 · Signals
Two institutions. Two sectors. The decision was issued. The record was not.
Knight Capital was one of the largest market makers in US equities. August 2012. The firm deployed a software update across its trading infrastructure. Seven of eight production servers received it. The eighth didn’t.
When live traffic hit that single un-updated server, SMARS woke up. Smart Market Access Routing System. Dormant for years. A repurposed configuration flag pulled it back into production.
Markets opened at 9:30am. The legacy logic ran. It read a new NYSE Retail Liquidity Program flag wrong and started firing — buying and selling across multiple stocks, accumulating positions nobody had authorised. The controls didn’t catch it.
Forty-five minutes. Millions of trades across 154 stocks. Roughly $7 billion in unintended positions. Pre-tax loss when trading was finally halted manually: $440 million. By then the institution wasn’t preventing anything. It was watching. Knight Capital did not survive the quarter and was acquired by Getco LLC later that year.
The SEC’s subsequent investigation was precise. Knight lacked adequate written supervisory procedures for the deployment. There was no effective process to verify that all production servers had received the correct software update before live trading began. The firm’s controls failed. Erroneous orders entered at scale. Nothing could stop the malfunction quickly enough once it started.
Knight Capital is often described as a software failure. It was more accurately a governance failure inside a high-speed decision system. The decision to deploy was made and executed. But the institution could not reliably verify what had been authorised, tested, updated, or actively running at the exact moment decisions entered the market.
Knight Capital · 1 August 2012 · Decision Timeline
Pre-market
Deployment decision made
Software update deployed to eight production servers. Seventh server missed. No verification record captured.
09:30:00
NYSE market open
Live traffic hits un-updated server. SMARS reactivates via repurposed configuration flag. Unintended orders begin.
09:30–10:15
No governance record exists — 45 minutes
~4 million trades across 154 stocks. $7 billion in unintended positions accumulating. No kill switch reachable. No record of what was authorised.
~10:15
Trading halted manually
Pre-tax loss: $440 million. The institution could no longer prevent consequences. It could only observe them.
Dec 2012
Firm acquired by Getco LLC
SEC fine: $12 million · 2013. No replay record was ever produced.
What was decided
Deploy the software update to production trading infrastructure on the morning of 1 August 2012, ahead of NYSE market open.
→
What was never recorded
Verification that all eight servers received the update. The authority under which deployment to live markets was approved. A defined kill switch procedure reachable within the loss tolerance of the firm.
The gap
The decision to deploy was made and executed. No contemporaneous record captured what had been authorised, verified, or bounded. Forty-five minutes. $440 million. The institution could not prove what it had sanctioned.
The algorithm did not malfunction. It did exactly what the legacy code was written to do. The failure was not in the execution. It was in the absence of a deployment decision record — a verifiable trail of what had been authorised, verified, and bounded before a single order was sent.
Theranos was built around one claim. The Edison — a proprietary device — could run a wide range of diagnostic tests from a single finger-stick of blood. Accurately. Fast. At a fraction of conventional laboratory cost.
The company launched consumer testing through Walgreens in 2013. Arizona followed as volumes grew. Patients received results. Clinicians acted on them.
The Edison had not been independently validated at the level medical testing at scale requires. The record that should have established what it was authorised to test, under what conditions, with what known accuracy ranges — that record either didn’t exist in a clinically reliable form or wasn’t disclosed. To regulators. To partners. To physicians. To patients.
In practice, Theranos ran many tests on conventional third-party laboratory equipment. Modified commercial analysers. Diluted blood samples. Not the Edison. The results went out as proprietary breakthrough capability.
CMS inspected the Newark, California laboratory in 2015. What it found: quality control deficient. Testing practices creating immediate patient safety risks. Federal standards for high-complexity clinical testing not met. Certification revoked in 2016. By that point the question had shifted. Not whether the deployment decision was sound. Whether any record existed that could have made it defensible.
The Department of Justice charged founder Elizabeth Holmes and former president Ramesh Balwani with wire fraud and conspiracy. Holmes convicted January 2022. Four counts. Balwani convicted July 2022. All twelve.
Theranos is often remembered as a fraud case. It was also a governance failure inside a clinical decision system. Diagnostic results were produced. Clinical decisions were made. But the institution lacked an authoritative, validated, and auditable decision record capable of proving what the technology had actually been approved to do, under which conditions, and on what evidentiary basis — at the moment the first patient result was issued.
Theranos · 2013–2022 · Deployment to Consequence
2013
Patient-facing deployment — Walgreens
Edison deployed at scale. No independent validation record. No traceable link between result and machine. Decision to deploy made and executed.
2013–2015
No governance record exists
Patients receive results. Clinicians make treatment decisions. Modified third-party analysers substituted silently. No contemporaneous record of what was authorised.
2015
CMS inspection — Newark, California
Quality control deficient. Testing practices created immediate patient safety risks. Federal standards for high-complexity testing not met.
2016
Laboratory certification revoked
By that point, the question was no longer whether the deployment decision had been sound. It was whether any record existed that could have made it defensible.
2022
Criminal convictions
Holmes: 4 counts · January 2022. Balwani: 12 counts · July 2022. The deployment decision was made in 2013. The record that would have made it defensible was never built.
What was decided
Deploy the Edison for patient-facing diagnostic testing at scale through Walgreens, producing clinical results used by physicians for treatment decisions.
→
What was never recorded
Independent validation of the Edison’s accuracy across the test range offered to patients. The authority under which deployment was approved as clinically safe. A traceable link between each result and the specific machine that produced it — the absence of which allowed the silent, systemic substitution of modified third-party commercial analysers to go undetected at the point of result.
The gap
Patients received diagnostic results. Clinicians made treatment decisions. No contemporaneous record established what had been authorised, validated, or bounded before a single result was issued. The deployment decision had already passed the point at which it could be contained.
The clinical decision to deploy at scale preceded any validated record of what the device could accurately do. That is not a product failure. It is a decision architecture failure. The institution issued consequential clinical decisions without the record that would have made those decisions auditable — or the harm stoppable once the accuracy gap became visible to regulators.
02 · Diagnosis
The decision was made. The record that would have made it replayable was not.
Both failures carry the same structural signature. Different sectors. Different scales. Different consequences. The same underlying absence.
This is the Layer 6 failure. Not a wrong decision. An unrecorded one. The absence of what the DIC™ calls a replay-ready decision record — the contemporaneous capture of authority, scope, verification status, and the information set present at the moment a consequential decision was committed.
Knight Capital’s operators could tell the SEC what they believed the deployment decision had encompassed. They could not show it. Theranos could assert the Edison had been validated for clinical use. It could not prove it from a contemporaneous record. Explanation is not proof.
The gap between what an institution decided and what it can prove it decided is not a compliance gap. It is a decision architecture gap. Compliance asks what happened. Replayability asks what was recorded as happening — at the moment it happened. Only one of those is recoverable after the fact.
In both cases, the act could not be defended from a record. It could only be explained from memory. And explanation is not proof.
02B · The Distinction
What each produces. What each requires. Why only one is governance.
Path A
Explainability
Reconstructed after the fact
Path B
Replayability
Captured at the moment of commitment
The question it asks
What happened?
The question it asks
What was recorded as happening — at the moment it happened?
What it produces
A coherent narrative. Assembled from memory, surviving documentation, and the most defensible account available.
What it produces
A verifiable record. Authority, scope, verification status, and information set — captured at the moment of commitment.
Knight Capital Group · 1 August 2012
What it produced
Knight could tell the SEC what the deployment had been intended to encompass. The account was coherent. It was the best account available from memory.
What it would have required
Confirmation — recorded before market open — that all eight servers received the correct update, and that a named individual held authority to halt trading within a defined loss threshold.
The gap
The institution could explain the intent. It could not prove the verification. Forty-five minutes. The gap was not recoverable once trading began.
What it produced
Theranos could assert the Edison had been developed and deployed in good faith. The account held together until regulators examined the underlying evidence.
What it would have required
Independent validation of the Edison’s accuracy, captured at the moment the first patient result was issued — with a traceable link between each result and the specific machine that produced it.
The gap
The institution could explain the intent. It could not prove the authorisation. Every patient result issued between 2013 and 2016. The gap was not visible until CMS arrived.
The structural difference
Explainability
Available to every institution after every failure. Requires only memory and counsel. Produces a narrative.
Replayability
Available only to institutions that built the record before the failure occurred. Requires architecture. Produces proof.
That is why Layer 6 is the governance layer. Not because decisions happen here — decisions happen at every layer. Layer 6 is where the decision becomes a recorded act. Or doesn’t. And that distinction — between a decision that was made and a decision that can be proved — is the difference between an institution that is accountable and one that is merely explainable.
03 · Engineering Note
What Layer 6 governance actually requires.
Three mechanisms every institution needs at Layer 6.
// L6 Governance Mechanisms
Not post-hoc documentation. A contemporaneous capture — built at the moment the decision is committed — of the authority, scope, verification status, and information set present at commitment. If not built at that moment, it is reconstruction. Reconstruction is not a decision record. It is a narrative.
Knight Capital
A deployment decision record: confirmation that all eight production servers received the update, the authority under which live-market deployment was approved, and the defined loss tolerance and kill switch procedure reachable within that tolerance — all captured before market open.
Theranos
A clinical deployment record: the validated accuracy range of the Edison across each test offered to patients, the authority under which patient-facing deployment was approved as clinically safe, and the protocol linking each result to the device version and validation data that governed it.
A defined set of conditions confirmed — and recorded as confirmed — before the decision is committed. Not audited after. Confirmed before. Not a checklist. A logical precondition. If unmet, the decision cannot be issued. The gate is what makes the record verifiable rather than asserted.
Knight Capital
Deployment to live markets requires recorded confirmation that all production servers received the update, that a kill switch procedure was tested and available, and that a named individual held authority to halt trading if pre-defined loss thresholds were breached. If any condition is unmet, deployment does not proceed.
Theranos
Patient-facing deployment requires recorded independent validation of device accuracy across each offered test, confirmation of laboratory director qualifications against federal requirements, and a defined protocol for result-level traceability linking each result to the device and validation data that governed it.
Not built in response to an investigation. Built as a precondition of consequential operation. The record exists before it is needed — because the moment it is needed is always after the decision has been made. The difference between a replayable institution and an irrecoverable one is not effort. It is architecture.
Knight Capital
A live trading system with no reachable kill switch and no server-level deployment verification is not a replayable system. It is an operable one. The distinction matters at 9:31am on 1 August 2012, when it is already too late to build the record.
Theranos
A clinical testing system that cannot link each patient result to a specific device version and contemporaneous validation record is not a replayable system. By the time CMS arrived, the records that would have made the deployment defensible no longer existed in a form that could be verified.
Layer 6 · Three Required Mechanisms · In Sequence
01
Decision Record
Built at the moment of commitment. Authority. Scope. Verification status. Information set. Contemporaneous — not reconstructed.
Knight: absent
Theranos: absent
→
02
Verification Gate
Confirmed before commitment. Not audited after. A logical precondition — if unmet and unrecorded, the decision cannot be issued.
Knight: no server check
Theranos: no validation
→
03
Replayability Infrastructure
Built before it is needed. The audit trail exists as a precondition of operation — not assembled after the fact in response to investigation.
Knight: no kill switch log
Theranos: no result trace
→
Output
A Replayable Institution
Can prove what it decided. Can prove when. Can prove under what authority. Accountable — not merely explainable.
FUSE™ · STAGE™ · DIC™+L8
All three mechanisms must be present. A decision record without a verification gate is assertion. A verification gate without replayability infrastructure cannot be reconstructed. Replayability infrastructure without a decision record has nothing to replay.
04 · The Board Question
Your institution made consequential decisions last week. Trades executed. Credit issued or denied. Clinical pathways altered. Policies deployed to production systems.
For each one: is there a contemporaneous record — built at the moment of commitment — of the authority under which it was made, the scope of what was authorised, and the verification status at time of decision?
If that record does not exist, the decision is not replayable.
You can explain what happened. You cannot prove what was decided.
When those two things diverge — under regulatory scrutiny, in litigation, in a crisis — explanation is not a defence. The record is.
Decision Engineering™ Series · Paper 3
If this issue raised a question about what happens at network scale —
Issue 006 examined the Layer 6 failure at the single institution level. One decision. One deployment. One record that was never built.
Paper 3 goes further. What happens when multiple programmable institutions interact across jurisdictions — and the decision chain runs in seven seconds across three regulatory regimes before any governance gap can be detected?
When the Protocol Decides — Replay-Ready Infrastructure for Programmable Financial Institutions
SSRN Author ID 9450612
Decision Integrity Chain™ · Layer 6 of 8
Decision
Decision — the act of committing to a course of action. The moment judgment becomes a recorded institutional choice.
A decision is not an output. It is a contemporaneous record: the authority under which it was made, the scope of what was authorised, the verification status at commitment, the information set present when it was issued.
Without that record, the institution has not decided. It has acted.
That distinction — between a replayable institution and an irrecoverable one — is what Layer 6 is about.
Issue #007 — Layer 7 · Outcome. Where the decision meets reality. Where the gap between what was intended and what was produced becomes visible. Where the institution either has a feedback loop capable of detecting that gap — or discovers it when the regulator does.