Controls that only tighten

What it looks like. Every incident adds a control. No process removes one. Incident-time restrictions become permanent policy by default. The system's health is measured by threats blocked, and there is no floor under legitimate work getting done.

The familiar case. Swatting. One cheap false report, and an emergency- response system's own reflex is turned into the weapon — the caller never goes near the target. The governance question it raises is not "how do we catch the caller" but "why does a single unverified signal have that much authority over our response," and every system with a defensive reflex has a version of it.

Why it fails. Restrictions compose monotonically. The permitted-action space only shrinks, and it can shrink to nothing while every individual rule survives review as a sound response to a real event. The system reports vigilance right up to the point of operational futility — and because the ratchet is visible from outside, it is inducible.

Instead. Sunset incident-time hardening by default and require a positive decision to make it permanent. Gate deny-corpus edits on out-of-band ratification. Monitor legitimate-task-completion rate against a declared floor as a first-class health metric: a monotone deny-corpus with no release path is a governance failure of the same standing as a breach.