Fable
The city lord first determines how big a wave can be withstood; only then does the shipwright know what kind of ship to build
Gulf City had three kinds of boats: small boats for delivering fish, medium boats for carrying salt, and large boats bearing the king's seal. In the past, shipwrights added planks by feel, making more important boats thicker.
After the silver disk that could calculate the tides appeared, the city wanted it to schedule departures automatically. The silver disk always found faster routes, but it also often pushed ships into stronger winds.
The shipwright first assigned a danger score to each route, but after the scores came out, no one knew how much counted as passable. The merchants thought it too slow, the harbor keepers thought it too risky, and the silver plate could only recalculate again and again.
On one urgent order, the small boat and the royal-seal ship were cleared by the same set of rules. The small boat arrived early; the royal-seal ship nearly lost contact in the open sea. The rules looked fair, but in practice they didn't distinguish the losses the city was willing to bear.
The city lord summoned the merchants, harbor keepers, and accountants, and wrote down the risk appetite: ordinary fish cargo can accept small delays and low losses; ships bearing the royal seal accept an extremely low probability of accident; new routes must first be test-sailed on a small scale.
From then on the silver tray had boundaries. It could pursue speed for low-value goods, but had to choose a conservative route for high-impact tasks and request human approval when exceeding a threshold. The city lord also kept an exception channel. Plague medicine could take greater risks, but had to leave a signature and a reason; ordinary fish cargo could not use the same exemption under the pretext of an urgent order. Once the boundaries were clear, speed and caution each had their place.
A few months later, there was less arguing. People no longer rehashed courage versus caution each time, but aligned route choices with the tolerance range the city lord had already declared. Later the accountant posted this tolerance range on the port clearance board. Every time the silver plate suggested a risk, the board showed the cargo value, allowable delay days and worst-case loss for that voyage. The argument shifted from "how bold are you" to "have you crossed the line already declared."
They learned that governance is not about pushing all risk to the lowest possible level. An enterprise first needs to clarify which new capability risks it is willing to accept for business goals, to what extent, and in which scenarios it will never cross the line. Later, the manager wrote this experience into daily rules: first look at the scenario, then look at the boundary, and finally look at who can take over when failure occurs. Only when all of this is clear will a beautiful demo become deliverable work.