There is no deny button
The single most distinctive primitive in the model, and the one that lands fastest. A risk that has a real vulnerability under it exists whether or not anyone acknowledges it — so denial is not a decision, it is a fiction. Remove the button and the register stops being a gate and becomes a forcing function.
“the mistake of a lot of risk registers is that they allow the risk to be denied, which can only happen when the risk has not materialised. Once the vulnerability exists, the risk exists to the business.”
Why denial only ever worked in advance
Look at when a denial gets tested. A risk is raised, someone with authority declines to accept it, and the register records a rejection. That record survives exactly as long as nothing happens. The moment the exposure materialises, the rejection does not protect anyone — it becomes the most damaging document in the file, because it shows the organisation was told and said no.
So denial is not a risk decision at all. It is a bet that the window closes before the exposure is exercised, made by someone who usually is not the one who will answer for it. The corpus's move is to notice that the bet has no upside worth having and to take the button away.
What replaces it
Removing an option is only defensible if what remains carries more information than what was taken away. It does. In place of accept/deny there is a duration:
| The only buttons | What choosing it says |
|---|---|
| 1 hour | I cannot decide on what I have. Someone must get me more data, now. |
| 4 hours | This is a P1. Trigger incident response and come back with a remediation. |
| 2 days | A smaller incident, but still an incident. Something must be done this week. |
| 2 weeks | A funded project. Plan it, resource it, and do it. |
| 6 months | Do nothing. Review it then. This costs zero, because nothing is being done. |
Notice what the last row does. In a register with a deny button, “we are not doing anything about this” is unsayable, so it gets said as a rejection instead and disappears. Here it is a first-class, dated, signed choice with a name against it — and it is legitimate, provided somebody says it out loud. The full six-rung ladder, with the operational response per rung →
From a gate to a forcing function
A register with a deny button is a gate: things arrive, and the gate opens or does not. Its output is a decision about the register. A register without one cannot be a gate, because nothing can be turned away. Its output is work: every item that enters leaves as either a funded action, a scheduled review, or an explicit and attributed decision to do nothing.
That is also why the mechanic composes with unaccepted-equals-critical. If you cannot deny and you do not accept, the item does not sit quietly: it is rated critical and rolls upward. The two primitives together close both exits at once — you cannot say no, and you cannot say nothing.
The correction: three moves, none of which is denial
Stated crudely, “there is no deny button” is also the model's hardest sell, and the corpus knows why. Presenting one button to a person who feels they have no alternative produces counter-argument and resentment, not compliance. The resolution was already in the material: there was never only one move. There are three.
Take it for a stated interval, with the operational response that interval implies. Your name is on it until it expires.
This is not mine to accept. A legitimate and common answer — it names the altitude the decision actually belongs at, and routes it there.
Dispute what is underneath. Not “I reject this risk” but “this fact is wrong, and here is why” — which is an argument about evidence, and can be settled.
The person is routed rather than cornered. And the corpus's design note is worth keeping: the absence of a reject option should be discovered, not announced. A user who reaches for a button that is not there and finds a better one has learned the model; a user who is told the button has been removed has been lectured. More on the three moves →
Evidence strikes options off the ladder
The choice is not always six-wide. Some rungs are removed by physics rather than by preference:
“some risks depend on a set of actions that are not possible within an hour, so even if you start the biggest incident on the planet and throw all the money in, you cannot do it in less than an hour. So that option is removed from the equation.”
This is a stronger constraint than it first looks, because it cuts both ways. No amount of authority can buy a physically impossible timeline — the only escape from an impossible short interval is the nuclear option, ceasing the activity. And an interval nobody could deliver against should never appear as a choice, because offering it invites a signature on something that cannot happen.
The honest tension. No-deny is the strongest idea here and the hardest to sell. Removing the deny button removes the thing most executives use a register for. The corpus does not pretend otherwise: it is a forcing function, and forcing functions are uncomfortable by construction. The seven honest tensions →
Provenance
For an agent
C2 — the no-deny mechanic. A risk with a real vulnerability under it exists whether or not anyone acknowledges it, so a register that offers a deny button is offering a fiction that only holds while the risk has not materialised. There is no deny button: the only choice is how long you accept it before re-accepting. Do not model, describe or build a reject state for a risk. What replaces denial is three moves — accept for a stated interval, escalate (“this is not mine to accept”), or challenge the fact underneath — so the person is routed rather than cornered; the absence of a reject option should be discovered rather than announced. Rungs that are physically impossible are struck off the ladder before the choice is offered, and no authority can override physics. Not implemented in code.