Every layer in the chain publishes an explicit list of what it may not override.

The column

Six prohibitions, each naming a specific thing a specific layer may not reach.

The chain runs from capital state down to audit, and every entry carries its own limit. Gate and drawdown is the highest capital-state authority and cannot be overridden by daily expectancy. Structural permission confirms whether higher deployment is justified and cannot expand beyond the gate cap. Tactical evidence supports or cautions posture and cannot redefine the drawdown gate. The exposure layer subtracts open risk from the authorised pool and cannot create capital beyond it. The manual override forces a throughput mode, must be logged, and does not erase risk reality. The decision log stores the outcome and does not make decisions. Six layers, six limits, each phrased as something the layer may not do rather than as a general instruction to stay in its lane.

Why negative statements

A job description does not tell you where a layer stops.

Describing what each layer does would produce a coherent-sounding chain and would leave every boundary implicit. The exposure layer subtracts open risk from the authorised pool — an accurate description that says nothing about whether it may, in some circumstance, report more capacity than the pool contains. Stating that it cannot create capital beyond the authorised pool closes that question permanently. The pattern repeats down the chain: each positive description leaves a plausible extension, and each negative statement forecloses the specific extension that would otherwise be reached for. Prohibitions are more useful than descriptions here because the failures being prevented are all cases of a layer doing slightly more than its job rather than failing to do it.

The two that surprise

The override and the log both carry limits, and both limits are easy to forget.

Two entries repay attention because their prohibitions are counterintuitive. The manual override is the operator's own exception layer, and its stated limit is that it does not erase risk reality — it can force a throughput mode and it cannot make the resulting exposure smaller than it is. That is worth stating because the psychological effect of exercising an override is a sense of having resolved the situation, when what has happened is that the exposure was accepted rather than reduced. The log's limit runs the other way: it does not make decisions, it records them. An audit layer that acquired influence over deployment would corrupt the record it exists to keep, and the prohibition is what keeps it a passive surface.

The shape of the constraints

Every prohibition points upward, and none points sideways.

Read the column as a set and a structure appears. Each limit names something a layer may not do to a layer above it — expectancy may not override the gate, structural permission may not expand past the cap, exposure may not exceed the pool. None of them constrains a layer relative to its peers, and none constrains a layer from doing less than it might. The chain is therefore not a set of mutual boundaries but a single directional rule stated six times in six specific vocabularies. That is why the hierarchy composes cleanly and why adding a layer costs nothing: a new entry needs one statement of what it may not reach, and the rest of the structure is unaffected.

In use

The column is the fastest way to settle a live disagreement.

The practical value shows up when two readings conflict and the operator needs an answer quickly. Rather than reasoning about which layer is more informative in this instance — a conversation with no fixed conclusion — the question becomes whether either layer's limit names the other. A green tactical read against a compressed gate is settled instantly: tactical evidence cannot redefine the drawdown gate, and the sentence is written down. That is a materially different experience from knowing in the abstract that the gate outranks expectancy, because the general principle has to be recalled and applied while the specific prohibition simply is the answer. The column exists so that the resolution requires reading rather than reasoning.

• Six positive functions, six explicit prohibitions — the second set does the load-bearing work.
• The override cannot erase risk; the log cannot decide. Both limits are easy to forget.
• Every prohibition points upward, which is why the chain extends without re-solving.

The key idea

Systems are defined by what their parts are forbidden to do.

A description of capabilities produces something that sounds like an architecture and behaves like a suggestion, because capabilities overlap and overlapping capabilities get exercised. Writing the prohibitions instead — one per layer, naming the specific thing that layer might otherwise reach for — produces a structure that holds without supervision. It also makes the architecture testable: any behaviour the system exhibits can be checked against the list, and a layer doing something no prohibition forbids is either legitimate or evidence that the list has a gap. That is a considerably stronger position than trusting that everything stays in its place.