HERO CASEBOOK

The Casebook applies the Manifesto, the Foundation, and the Constitution to real events. It uses Hero to identify governance and accountability conditions that allowed harm to develop, made intervention fail, or prevented a failure from becoming worse.

Hero diagnosis does not replace an engineering investigation, legal judgment, or official probable-cause finding. Official findings remain the factual anchor. Hero then makes a separate causal claim about Value Commitment, Authority, Capability, Evidence, Consequence, Accountability, challenge, and Organizational Memory. That claim must remain traceable to the reported record and open to challenge.

Each case opens with a short fictional scenario that frames the question. The scenario is illustrative and non-normative. It is followed by a sourced real case, a Hero root-cause diagnosis, and conditions intended to reduce the risk of recurrence.

Hero uses the following diagnostic proposition:

A material failure becomes more likely when a Value Commitment is pursued through Capabilities whose Authority, Evidence, challenge paths, Accountability, or learning obligations are missing, unusable, or misaligned with the possible Consequence.

The proposition is analytical and testable. It is not a substitute for physical, technical, medical, legal, or regulatory causation. A Hero diagnosis asks five questions:

1. What Value Commitment and material Consequence governed the decision?
2. Which Capabilities acted, and did practical Authority match the accepted scope?
3. What Evidence, uncertainty, dissent, and failure boundaries were available at the decision point?
4. Where did Accountability remain clear, and where did it become nominal, fragmented, or displaced?
5. What must change in judgment, governance, Capability, or Organizational Memory before a comparable commitment is accepted again?

1. Opening scenario: a fictional, non-normative situation that makes the question easier to see.
2. Background: what happened and who was involved.
3. Official findings: what the responsible investigation, inquiry, or regulator formally concluded.
4. Reported facts: what the cited record establishes beyond the formal conclusion.
5. Hero root-cause diagnosis: the governance and accountability failure, or protective condition, identified through Hero.
6. Constitutional boundary: which right, duty, limit, challenge, or Remedy is engaged.
7. Prevention conditions: the minimum changes needed before a comparable commitment should be accepted again.
8. Countercase: what the case does not prove, or what a weaker reading would miss.
9. Learning question: what should change in future judgment or Organizational Memory.

A payment platform activates an old release path during a routine deployment and begins issuing duplicate transfers. The on-call engineer can see the abnormal flow but cannot suspend the gateway without executive approval. The question is whether the organization created a real intervention path before assigning responsibility for the release.

Background

On August 1, 2012, Knight Capital Americas LLC experienced a trading incident that disrupted the markets. In an October 16, 2013 release, the U.S. Securities and Exchange Commission (SEC) stated that Knight had agreed to pay $12 million to settle charges under the market access rule. S1

The SEC release is reproduced in a public legal archive because the SEC page may restrict automated retrieval. The linked SEC page remains the primary citation; the reproduction is listed in the research register. S2

Official regulatory findings

The SEC investigation found that Knight lacked adequate safeguards to limit the risks created by its market access and therefore failed to prevent millions of erroneous orders. The SEC also found inadequate review of control effectiveness, inadequate code-deployment and testing controls, and insufficient written procedures for significant technology and compliance incidents.

Reported facts

• The incident involved market access, software deployment, risk controls, and supervisory procedures.
• The cited record describes both the immediate erroneous orders and weaknesses in the surrounding control system.
• The enforcement action addressed the firm, not an imaginary autonomous accountability center inside the software.

Hero root-cause diagnosis

Under Hero, the root cause was not software speed by itself. Knight allowed a high-speed Capability Unit to act on a material Value Commitment without effective deployment evidence, tested control boundaries, or a reliable intervention structure. The system could place orders faster than the institution could detect, govern, and stop the resulting Consequence.

Accountability remained with the firm and its human decision structure. The failure occurred because that Accountability was not matched by operational Authority and Evidence at the point of deployment.

Constitutional boundary

The case engages the right to sufficient Authority and a credible refusal, intervention, or escalation path. A team cannot be assigned a consequential commitment while the controls needed to govern the capability remain nominal or untested.

Prevention conditions

• Every active deployment path must be identified, reviewed, and either qualified or removed.
• Pre-release Evidence must cover the actual production configuration, not only the intended code change.
• Real-time limits and a tested stop mechanism must operate faster than the failure can propagate.
• A named human and institutional accountable center must have Authority to pause market access without waiting for the incident to become undeniable.

Countercase

This case does not prove that every software failure is a constitutional violation. The narrower claim is that consequential automated execution requires a bounded human and institutional accountability structure, with evidence that the controls are usable before the commitment is accepted.

Learning question

What evidence must exist before a human Hero accepts responsibility for a high-speed Capability Unit whose failure can propagate faster than ordinary review?

A safety-critical device passes separate component tests, but no reviewer can explain its behavior when two sensors disagree. Certification work is divided among several teams. The final approver receives compliance records without the disputed system assumptions.

Background

After two fatal Boeing 737 MAX accidents, the U.S. Federal Aviation Administration (FAA) chartered the Boeing 737 MAX Flight Control System Joint Authorities Technical Review (JATR) on June 1, 2019. The multinational review examined the certification work for the flight-control system, with particular attention to the Maneuvering Characteristics Augmentation System (MCAS). Its October 11, 2019 report examined certification, system integration, human factors, delegation, communication, and post-certification activity. S3 S4

Official review findings

JATR did not issue an accident probable-cause determination. Its certification review found that compliance with all applicable regulations and standards does not necessarily ensure safety when complex systems interact in ways the rules do not fully address. It recommended stronger fail-safe design, visible and challenged assumptions, better communication, greater human-factors integration, and examination of pressures affecting delegated certification work.

Reported facts

• The review concerned a complex integrated flight-control system, not an isolated software component.
• The report identified gaps involving system integration, assumptions, human factors, communication, and delegated certification.
• The report recommended modernization of the certification process and stronger attention to safety, not compliance alone.

Hero root-cause diagnosis

Under Hero, the root cause was an accountability and evidence failure at the level of the composed flight-control system. Certification work was distributed, but the Value Commitment was indivisible: safe transport under actual system behavior. System assumptions, human response, delegated review, and interacting failure modes did not remain visible enough to support that commitment.

Formal compliance became a partial substitute for accountable system judgment. Delegation distributed work and Authority without preserving a sufficiently clear center answerable for the safety of the composition.

Constitutional boundary

The case engages independent review, evidence visibility, and the prohibition on treating formal compliance as a substitute for accountable judgment about material Consequence. Where a delegated process creates pressure or hides uncertainty, the right response is escalation, review, redesign, or suspension, not silent acceptance.

Prevention conditions

• The integrated safety commitment must have an identifiable accountable center across delegated certification boundaries.
• Material assumptions and human-factors claims must remain visible, traceable, and open to disconfirming Evidence.
• Independent reviewers must be able to suspend acceptance when system-level behavior remains unresolved.
• Compliance evidence must be supplemented by evidence about the composed system under credible failure conditions.

Countercase

The JATR report does not establish that every delegated certification arrangement is invalid. It supports a narrower proposition: delegation remains legitimate only when assumptions, evidence, independence, and escalation remain visible and usable at the level of the actual consequence.

Learning question

When a capability is assembled across organizations, who can still explain the system's material failure modes, and who has the Authority to stop acceptance when that explanation is incomplete?

A payroll system reports a serious discrepancy and an employee is suspended before transaction logs are examined. The appeal channel accepts documents but cannot pause the sanction or reach anyone with Authority to review the system output.

Background

The Post Office Horizon IT Inquiry is an independent public statutory inquiry into the implementation and failures of the Horizon IT system at the Post Office. It records 226 hearing days, 298 witnesses, and around 274,604 disclosed documents. The inquiry examines system development and rollout, technical errors, reported discrepancies, prosecutions, human impact, and compensation schemes. S5 S6

The inquiry's redress material treats compensation, appeals, and the effect on affected families as part of the continuing public response. The case therefore remains open in the sense that institutional learning and remedy are still part of the record.

Official inquiry findings

The Inquiry's official Rapid Read describes hundreds of postmasters, managers, and assistants as having been wrongly accused of theft and fraud because of faults in the Horizon IT system. It identifies technical errors, the handling of reported discrepancies, prosecution practices, institutional culture, government oversight, human impact, and the adequacy of redress as matters examined by the Inquiry.

Reported facts

• The dispute involved an automated accounting system and repeated shortfall allegations.
• The inquiry examines how reported discrepancies were handled and how system evidence was used in legal proceedings.
• The official Rapid Read identifies human impact and redress as distinct parts of the inquiry's work.

Hero root-cause diagnosis

Under Hero, the root cause was the institution's conversion of a system output into an accusation without preserving the distinction between output, Evidence, judgment, and Consequence. Horizon became the default explanation, while affected people lacked an equally effective path to challenge the system, pause adverse action, or reach an independent accountable center.

The institution displaced its own burden of judgment onto the people accused by its Capability. That inversion allowed uncertain technical records to produce severe human Consequences.

Constitutional boundary

The case engages the rights to understand a Value Commitment, challenge a consequential decision, refuse unsupported acceptance, receive independent review, and obtain Remedy. It also illustrates why delayed correction does not erase the original duty to preserve uncertainty and protect affected people.

Prevention conditions

• No material adverse judgment should rest on an automated record without provenance, limitation, and independent verification.
• A challenge must reach someone with Authority to pause the Consequence, not merely receive documents.
• The institution must preserve system logs, contradictory Evidence, and uncertainty before prosecution or equivalent irreversible action.
• Appeal, record correction, compensation, and prevention of continuing harm must remain part of the original Accountability structure.

Countercase

The case does not prove that automated accounting is inherently illegitimate. It shows that automation cannot convert an uncertain signal into a final accusation without preserving provenance, challenge, independent review, and a real path to correction.

Learning question

When an automated record conflicts with a person's account, what evidence, challenge path, and Remedy must exist before the institution may impose a material consequence?

Engineers reviewing a public-infrastructure launch identify a weather condition outside prior operating experience. Management treats the concern as a scheduling objection because the engineers cannot prove that failure will occur. No independent reviewer can intervene before the launch window closes.

Background

The Space Shuttle Challenger accident occurred during mission 51-L on January 28, 1986. The Presidential Commission on the Space Shuttle Challenger Accident, commonly called the Rogers Commission, reviewed the accident, the events leading to launch, the technical cause, contributing causes, organizational pressures, and safety arrangements. NASA's technical report record identifies the Commission's work and its findings and recommendations; the Commission report is also available through a public reproduction. S7 S8

The Commission record describes a launch decision made in unusually cold conditions, prior engineering concern about temperature effects, and organizational pressures surrounding the launch schedule.

Official investigation findings

The Commission concluded that Challenger was lost because the seals failed in the joint between the two lower segments of the right Solid Rocket Motor. It also concluded that the launch decision was flawed. Decision makers lacked important information about prior O-ring problems, the contractor's initial recommendation against launch below 53 degrees Fahrenheit, continuing engineering opposition, and concern about ice. The Commission found communication failures, incomplete or misleading information, conflict between engineering data and management judgment, and a management structure that allowed flight-safety problems to bypass key managers.

Reported facts

• The mission was launched after discussion of low-temperature conditions and their possible effects.
• The investigation examined both the physical failure and the organizational conditions in which the decision was made.
• The report included recommendations about the Shuttle program, safety, communication, and decision authority.

Hero root-cause diagnosis

Under Hero, the root cause was a decision structure that converted unresolved safety uncertainty into a scheduling judgment. Engineering dissent existed, but it did not retain protected access to the people and Authority capable of stopping launch. The institution therefore accepted an irreversible Consequence while material Evidence remained contested and incomplete.

The formal launch decision did not cure the failure. Accountability requires a decision process in which material dissent can still change the outcome.

Constitutional boundary

The case engages the rights to understand material uncertainty, challenge a Value Commitment, use an independent escalation path, and refuse acceptance when necessary authority or evidence is missing. Proportionality cannot turn an irreversible consequence into an ordinary scheduling decision.

Prevention conditions

• Material safety dissent must be recorded in its strongest form and carried to an independent decision path.
• Under irreversible risk, lack of complete proof of failure must not be treated as proof of safety.
• Schedule pressure and management incentives must be disclosed as part of the decision Evidence.
• Launch or equivalent acceptance must pause until the accountable center can explain why the contested condition is within an accepted boundary.

Countercase

The case does not show that every disagreement requires a launch cancellation. It shows that disagreement about a material safety condition must remain visible, reviewable, and capable of changing the decision before the consequence becomes irreversible.

Learning question

Can the person with the most relevant safety concern stop or escalate the commitment without having to win an argument against the institution's schedule?

One operator is assigned to supervise several autonomous warehouse vehicles. Alerts arrive late, the stop control is shared across screens, and the operator is still described as the safety backstop. The title assigns responsibility, but the operating design may not provide a usable Capability to intervene.

Background

On March 18, 2018, a developmental automated driving system installed by Uber's Advanced Technologies Group was active in a modified Volvo vehicle in Tempe, Arizona. The vehicle struck and fatally injured a pedestrian crossing outside a crosswalk. The operator had been operating the vehicle for about 19 minutes before the crash. The National Transportation Safety Board (NTSB) investigated the event. S9 S10

The report treats the automated driving system, the operator, the test program, and the surrounding safety management as one operational system. It does not reduce the event to a single last-second human action.

Official investigation findings

The NTSB determined that the probable cause was the operator's failure to monitor the driving environment and automated system because she was visually distracted by her phone. It identified Uber Advanced Technologies Group's inadequate risk-assessment procedures, ineffective operator oversight, and inadequate mechanisms for addressing automation complacency as contributing factors arising from an inadequate safety culture. It also identified the pedestrian's actions and insufficient state oversight as contributing factors.

Reported facts

• The automated system was developmental and active on a public road.
• The NTSB examined system behavior, operator monitoring, safety culture, and risk management together.
• The investigation produced recommendations for public agencies, safety organizations, and Uber's Advanced Technologies Group.

Hero root-cause diagnosis

Under Hero, the root cause was the assignment of safety Accountability to an operator without proving that the operator possessed a usable intervention Capability under the actual test conditions. The label "safety operator" described an expected responsibility. It did not establish adequate attention, information, reaction time, controls, training, or Authority.

The organization treated a nominal human-in-the-loop arrangement as a substitute for system-level risk governance. This shifted attention toward the final human action while leaving the operating design and safety culture insufficiently governed.

Constitutional boundary

The case engages the right to sufficient Authority, known failure boundaries, meaningful intervention, and independent review. It also tests the proportionality of assigning a person responsibility for a system whose speed and uncertainty exceed the person's realistic ability to respond.

Prevention conditions

• The test program must demonstrate that a human can detect, understand, and interrupt the relevant failure within the available time.
• Operator workload, alert design, stop controls, training, and oversight must be qualified as part of the Capability Composition.
• Developmental automation on public roads requires an accountable risk decision independent of the operator's last-second response.
• When realistic intervention cannot be demonstrated, the operating boundary must change before testing continues.

Countercase

The NTSB report does not establish that a human operator can never supervise an automated vehicle. It supports the narrower claim that a human-in-the-loop label is insufficient when the operational design does not give the human a realistic chance to detect and correct failure.

Learning question

Before assigning a human to supervise a Capability Unit, what evidence shows that the human can actually intervene within the time, information, and Authority available?

A hospital loses part of its electrical supply while the designated facilities director is unreachable. The nearest qualified engineer disconnects non-essential loads and transfers critical care equipment to limited backup power. The action protects life, but it does not authorize a permanent redesign or create general Authority over hospital operations.

Background

Apollo 13 launched on April 11, 1970 as a lunar-landing mission. At about 56 hours, a service-module cryogenic oxygen tank abruptly lost pressure after an abnormal pressure rise. The loss of oxygen and primary power required an immediate abort. The crew powered up the lunar module, which supplied power and life support during the return to Earth. S11 S12

The mission report states that consumables were extremely limited in the emergency configuration. The crew and ground teams used the lunar module's propulsion and support systems to restore a free-return path, shorten the return, and preserve the command module for entry.

Official mission report findings

The National Aeronautics and Space Administration (NASA) mission report records that the mission was aborted because of the loss of service-module cryogenic oxygen associated with a tank fire. It states that the lunar module sustained the minimum operating conditions needed for a safe return and supplied power and life support until the crew transferred back to the command module shortly before entry.

Reported facts

• Material harm was immediate: oxygen and primary power were being lost in flight.
• Ordinary mission objectives were abandoned, and the response was directed to crew survival and safe return.
• The emergency configuration used limited consumables and systems for purposes narrower than the original lunar-landing mission.
• The mission report preserved the anomaly, decisions, system use, remaining constraints, and return sequence for later review.

Hero root-cause diagnosis

Apollo 13 shows the protective side of the Hero proposition. The technical failure created an immediate threat, but it did not become an accountability collapse. The original lunar-landing Value Commitment was explicitly abandoned. A narrower commitment, crew survival and safe return, governed the recomposition of available Capability.

The emergency response worked because judgment, Authority, Evidence, and Consequence remained connected. Temporary action stayed bounded to protection, scarce resources were governed against the new commitment, and the decision record returned to institutional review.

Constitutional boundary

The case directly engages Article IV. Credible material harm was occurring, delay would have increased it, the protective purpose was clear, and the actions were limited to what survival and return required. It also illustrates the duty to preserve the judgment, uncertainty, action, and remaining risk for review.

Prevention conditions

• Emergency doctrine must authorize the nearest capable person to take the minimum protective action when ordinary Authority cannot arrive in time.
• The protective purpose, uncertainty, action, and remaining risk must be recorded as conditions permit.
• Emergency Authority must expire when immediate protection no longer requires it.
• The institution must review the event, restore deferred protections, and incorporate the Evidence into future Capability and planning.

Countercase

Apollo 13 does not establish that any urgent problem permits ordinary governance to be bypassed. The constitutional reading depends on immediacy, a narrower protective purpose, the absence of a timely less restrictive alternative, and prompt restoration of accountable review.

Learning question

When ordinary Authority cannot be reached, can the nearest capable person identify the minimum protective action, preserve the decision record, and return the commitment to legitimate review once the danger has passed?

A chemical process startup is interrupted at shift change. The outgoing operator records only "startup in progress" and leaves without stating which valves were closed, which alarms had failed, or which steps were complete. The incoming operator receives custody of the console, but not enough Context to make a new acceptance judgment.

Background

On March 23, 2005, explosions and fires at BP's Texas City refinery killed 15 people and injured 180. The incident occurred during startup of the isomerization unit's raffinate splitter. The U.S. Chemical Safety and Hazard Investigation Board (CSB) investigated the event and published its final report in 2007. S13 S14

The startup had begun on the night shift, stopped, and then resumed on the next shift. The procedure covered a continuous startup, not this interrupted sequence.

Official investigation findings

The CSB found that supervisors and operators poorly communicated critical startup information during shift turnover and that BP had no shift-turnover communication requirement for operations staff. It also identified weak supervision, inadequate training, outdated procedures, equipment and alarm problems, fatigue, and serious deficiencies in process-safety management and safety culture.

Reported facts

• The Night Lead Operator did not use the startup procedure or record the steps completed while filling the raffinate section equipment.
• The next shift therefore lacked a reliable record of the startup state.
• The Day Board Operator received little information and misunderstood how much equipment had already been filled.
• The experienced day supervisor arrived more than an hour late and did not conduct a turnover with night-shift personnel.
• Administrative custody of the unit changed, but material Context, known limitations, and unresolved conditions did not transfer effectively.

Hero root-cause diagnosis

Under Hero, the root cause was a failed transfer of Accountability during a hazardous, interrupted startup. Console custody moved to the next shift, but the current process state, completed steps, known control failures, and unresolved risk did not move with it. The receiving operators therefore could not make a valid acceptance judgment.

The failure was structural as well as individual. BP controlled staffing, procedures, alarm design, supervision, training, fatigue exposure, and the handover system. Those institutional conditions remained part of the causal chain.

Constitutional boundary

The case directly engages Article V's requirements for effective transfer and failed transfer. It also supports institutional residual Accountability under Article VII. A handover that omits material state, known limitations, unresolved challenges, and transition risk cannot establish a new accountable center merely because the next shift has arrived.

Prevention conditions

• An interrupted hazardous operation must not transfer through schedule or console custody alone.
• The handover must state current process condition, completed and incomplete steps, failed alarms or controls, unresolved instructions, and immediate risk.
• The receiving Hero must explicitly accept, pause, or escalate the operation after reviewing that Context.
• The institution must provide staffing, supervision, procedures, and fatigue controls adequate for both startup and transfer.

Countercase

The case does not mean that every handover requires complete information or a lengthy ceremony. A valid transfer can occur under uncertainty. The material uncertainty, incomplete steps, failed controls, and immediate risks must remain visible, and the receiving Hero must have a real chance to judge them.

Learning question

What minimum Evidence and Context must cross a shift, role, vendor, or leadership boundary before the institution may say that Accountability has transferred?

Sources are linked at the point of use. The working research register records source status, retrieval notes, and the distinction between primary records and public reproductions.