Six questions we ask

Six questions about any infrastructure. One condition beneath all of them.

When we look at a system, a service or an institutional function with a partner, we return to the same six questions. They are not a checklist or a scoring model. They are the angles from which we have learned that infrastructure most often turns out to be weaker than it looks.

Each question corresponds to a property we think infrastructure needs if it is to function independently, durably and at scale. Together, they are our working definition of what makes something infrastructure rather than a project, a product or a promise.

1. Can you see where it is fragile?

Most failures do not arrive without warning. The signals are usually there, spread across different systems, different teams and different domains, and nobody is looking at them together. A communications anomaly, a supplier problem and a staffing gap may each be routine on its own. Around the same function, at the same time, they are not.

The property here is visibility: the ability to see where fragility is building up before it becomes a crisis. It is the first discipline of our work.

This is what we mean by Early warning.

2. Can you change it when you need to?

A system can be owned, hosted in the right place and covered by the right contracts, and still be impossible to change when a dependency has to move. The property is control: knowing where dependency sits, who governs it, and whether the institution can act when it must.

This is what we mean by Sovereignty.

3. What still works when something fails?

Backups, second sites and continuity plans are easy to count. What matters is whether an essential function continues when a specific dependency is lost, at what level, for how long, and how it returns to normal. The property is durability, and it is only meaningful when the function and the failure are named.

This is what we mean by Resilience.

4. Has it worked outside the lab?

A capability that performs well in a controlled environment has not yet shown that it works in the conditions it was built for. Between a successful pilot and a deployed capability there is a gap that many initiatives never cross. The property is proof: evidence gathered under the conditions that matter, with the limits of that evidence stated.

This is what we mean by Verification.

5. Does the capability stay with you?

When the external team leaves, does the institution still know how to operate, maintain, change and judge what it was given? Or does every change require bringing someone back? The property is retention: capability that remains inside the institution rather than leaving with the people who built it.

This is what we mean by Capability transfer.

6. Can machines read it the way you intend?

Public information is now read by machines as routinely as by people. If a machine has to guess which document is current, which translation is equivalent or what the publisher intends, the institution has lost part of its publishing boundary. The property is legibility: information that machines can identify and interpret without reconstructing it.

This is what we mean by AI-readiness.

The condition beneath all six

Each of these questions ends in the same place.

Seeing fragility requires someone able to tell a signal from noise. Control requires someone able to evaluate what a supplier claims. Durability requires someone able to tell whether a test proves what it says. Proof requires someone able to recognise the limits of evidence. Retention requires people able to judge work done on their behalf. Legibility requires systems that can tell a declaration from a verified fact.

That common condition is judgement: the state in which a person, an institution or a system can evaluate what others produce and reach a defensible decision on its own.

Judgement is not a document that can be handed over. It is a state that has to be reached and kept, through practice. Bringing every participant in a process to that state, people, institutions and the systems they rely on, is in the end what our work is for. Without it, each of the six properties depends on trusting someone else.

How we use the questions

We do not use these questions to grade anyone. We use them to find where the conversation should start. Most institutions are strong on some and exposed on others, and the exposed ones are rarely where people expect.

In practice, one or two of the questions usually matter most for a given function. That is where the work begins. See Where the work begins.

Related: The sequence · How to read our claims · Glossary