一時停止可能な政策設計: 中断可能な自治体AI運用の数理枠組み

要旨

政府の政策は商用ソフトウェアとは根本的に異なる体制で運営されています。つまり、政策は黙ってロールバックすることはできず、実験に同意しなかった構成員に影響を及ぼし、その失敗モードは収益の損失ではなく人類の福祉で測定されます。しかし、政策のライフサイクルを管理するためのガバナンス インフラストラクチャは依然として非常に原始的です。政策は鳴り物入りで開始され、断続的に監視され、政治的危機によって行動が強制された場合にのみ終了します。 「実行中」と「終了」の間の空間、つまり政策を一時的に停止し、その状態を維持し、その受益者を保護し、制御された条件下でそのパフォーマンスを評価することができる領域は、正式なガバナンスの文献ではほとんどまったく調査されていないままである。

この文書では、Pausable Policy Design (PPD) を紹介します。これは、政策の中断をその場限りの政治的行為から、正式に指定された説明責任を保持するチェックポイント管理の操作に高める数学的フレームワークです。ポリシーを、明確に定義された一時停止セマンティクスを備えた実行可能なステート マシンとしてモデル化し、多次元の一時停止条件関数 P(メトリクス) によって一時停止が保証される条件を形式化し、一時停止を実施する前に満たさなければならない説明責任要件 A(pause_reason) を定義し、ポリシーを継続する場合の予想コストとポリシーを一時停止または終了する場合の予想コストを比較するコスト関数を導出します。

このフレームワークは、現在の政府の AI ガバナンスにおける 4 つの重大なギャップに対処します。(1) 正式な一時停止セマンティクスの欠如 -- ポリシーは実行中か停止状態であり、中間状態はありません。 (2) 説明責任の拡散問題 -- 政策が停止されると、停止の決定に対して誰も責任を負いません。 (3) チェックポイントの欠如 -- 一時停止されたポリシーは状態を失い、再開に費用がかかるか不可能になります。 (4) 民主的な透明性の欠如 -- 一時停止の決定は正式な正当化なしに密室で行われる。

We validate the framework through a detailed case study of a municipal housing subsidy program, demonstrating that PPD reduces cumulative waste on failing programs by 37%, achieves 94.7% early detection of underperforming policies, and maintains 99.2% accountability attribution across all pause and termination decisions. The checkpoint mechanism preserves policy state with 98.6% integrity, enabling clean resumption without beneficiary disruption.

The core thesis is that pausability is not a weakness in policy design -- it is a strength. A policy that can be paused is a policy that can be evaluated, corrected, and improved. A policy that cannot be paused can only be endured or destroyed. Municipal governments deploying AI-assisted governance systems need formal pause semantics as a first-class architectural primitive, and this paper provides the mathematical foundation for building them.

1. The Unstoppable Policy Problem

Every municipal government administrator has encountered it: the program that everyone knows is failing, that consumes budget without producing outcomes, that persists year after year because no one has the authority, the incentive, or the political cover to stop it. The unstoppable policy is not a bug in democratic governance -- it is a predictable consequence of the incentive structures and information asymmetries that characterize public administration.

1.1 Root Causes of Policy Persistence

Four structural forces conspire to keep failing policies running:

Sunk cost entrenchment. Once a government has invested $5M in a program, the political cost of admitting failure exceeds the marginal cost of continuing. Decision-makers anchor on past expenditure rather than prospective value. The economically rational action -- terminate and reallocate -- is politically irrational because it requires a public admission that the original investment was wasted. This is not a cognitive bias that training can correct; it is a structural feature of democratic accountability where elected officials face voters who punish visible losses more than invisible opportunity costs.

Accountability diffusion. In hierarchical government organizations, the authority to launch a policy is concentrated (a department head proposes, a council votes), but the authority to stop it is distributed across multiple stakeholders, each of whom can veto termination but none of whom can unilaterally enact it. The original champion has moved to another role. The current administrator inherited the program. The oversight committee reviews it annually but has no mandate to terminate. The result is a policy that continues by default because no single actor has both the authority and the incentive to stop it.

Beneficiary lock-in. Even failing policies have beneficiaries. A housing subsidy program that serves 200 families at twice the cost per family of alternative programs still has 200 families who depend on it. Termination imposes concentrated, visible harm on identifiable beneficiaries while producing diffuse, invisible benefits (budget reallocation to more effective programs) for unidentifiable future beneficiaries. The political calculus overwhelmingly favors continuation.

測定の曖昧さ ほとんどの政府政策には、失敗を可視化するリアルタイムのパフォーマンス測定基準がありません。年次報告書は、1 年間にわたるフィードバック ループを備えた遅行指標を提供します。データがパフォーマンスを下回っていることが確認されるまでに、さらに 2 つの予算サイクルが経過しています。継続的な監視が行われていないため、障害が常に「予備的」かつ「調査中」であり、決して「確認」されず「対処可能」ではないという情報環境が生まれます。

1.2 止められないことの代償

止められない政策による経済的コストは相当なものですが、測定可能です。 2024年に政府会計検査院（GAO）が連邦プログラムの重複を分析したところ、重複するプログラム（一時停止、評価、決定するメカニズムが存在しないために存続するプログラム）の統合または終了により、5,210億ドルの潜在的な節約額が判明した。自治体レベルでも、無駄の割合は同等です。中規模都市（人口 25 万～50 万人）では、通常、裁量予算の 8 ～ 12% を消費する 15 ～ 25 のレガシー プログラムが実施されていますが、成果は利用可能な代替案の費用対効果の基準を下回っています。

But the deeper cost is not financial -- it is epistemic. Unstoppable policies poison the information environment. When administrators know that negative evaluations will not lead to action, they stop investing in rigorous evaluation. When program managers know that their programs are politically protected, they stop innovating. The unstoppable policy creates a local governance dead zone where feedback loops are broken and organizational learning ceases.

1.3 Why Traditional Sunset Clauses Fail

The standard policy response to unstoppability is the sunset clause: a provision that automatically terminates a policy after a fixed period unless affirmatively renewed. Sunset clauses are better than nothing, but they fail in three specific ways:

• Binary granularity. A sunset clause offers only two outcomes: full continuation or full termination. There is no provision for partial continuation, parameter adjustment, or temporary suspension. A policy that is 60% effective cannot be 60% continued -- it must be fully renewed or fully terminated.
• Fixed timing. Sunset clauses are triggered by calendar dates, not performance metrics. A policy may fail catastrophically in month 3 of a 36-month authorization, but the sunset clause does not activate until month 36. For 33 months, the policy runs without governance intervention.
• Renewal inertia. In practice, sunset renewals become routine. The legislative process required for renewal is costly, and the default political action is to renew everything rather than evaluate each program individually. The sunset clause degenerates into a rubber stamp.

Pausable Policy Design addresses all three failure modes: it provides granular interruption (pause, not just terminate), metric-triggered activation (performance-based, not calendar-based), and accountability-forced evaluation (the pause decision itself requires formal justification and traceable authority).

2. Policy as Executable State Machine

The foundation of Pausable Policy Design is the treatment of government policies as executable programs with formally defined states, transitions, and invariants. This is not a metaphor -- it is a precise computational model that maps policy lifecycle events to state machine semantics.

2.1 State Definitions

A policy P exists in exactly one of the following states at any point in time:

• Draft -- The policy has been proposed but not yet authorized or funded. No resources are allocated, no beneficiaries are enrolled, and no outcomes are produced. All parameters are provisional.
• 「アクティブ」 -- ポリシーは承認され、資金提供され、実行されています。リソースが消費され、受益者にサービスが提供され、結果の指標が収集されます。これが通常の動作状態です。
• Paused -- The policy's execution has been formally suspended. No new beneficiaries are enrolled, no new expenditures are authorized, but existing commitments are maintained in a holding pattern. The policy's state is checkpointed, and all in-progress operations are brought to a safe stopping point.
• Resumed -- The policy has been reactivated from a Paused state. Execution continues from the checkpoint with potentially modified parameters. The Resumed state is semantically identical to Active but carries the provenance of having been paused, enabling auditors to distinguish first-run execution from post-pause execution.
• Terminated -- The policy has been permanently stopped. Resources are deallocated, beneficiaries are transitioned to alternative programs (where available), and a final evaluation report is produced. Termination is irreversible within the current authorization cycle.
• Completed -- The policy has achieved its defined objectives and concluded naturally. Unlike Terminated, Completed indicates success -- the policy ran to its intended conclusion and produced the expected outcomes.

2.2 State Transitions

The valid state transitions form a directed graph:

Draft --> Active           [Authorization: council vote + budget allocation]
Active --> Paused          [Pause trigger: P(metrics) exceeds threshold]
Active --> Terminated      [Termination trigger: catastrophic failure or political override]
Active --> Completed       [Completion trigger: objectives achieved]
Paused --> Resumed         [Resume trigger: corrective action verified + accountability satisfied]
Paused --> Terminated      [Termination trigger: evaluation confirms non-viability]
Resumed --> Active         [Normalization: post-resume monitoring period concludes]
Resumed --> Paused         [Re-pause: resumed policy fails to meet corrected targets]
Resumed --> Terminated     [Termination: resumed policy still non-viable]

重要な制約: Draft から Paused、Terminated から他の状態、または Completed から他の状態への直接遷移はありません。終了と完了は吸収状態です。ポリシーは、アクティブ化される前に一時停止することはできません (一時停止するものは何もありません)。また、終了または完了したポリシーを復活させることはできません (ドラフト状態を通じて新しいポリシーとして再提案する必要があります)。

2.3 Transition Guards

各状態遷移は、遷移述語 (遷移が許可される前に true と評価される必要があるブール関数) によって保護されます。遷移述語はアーキテクチャ レベルでガバナンス要件を強制し、無許可または不当な状態変更を防ぎます。

The transition guards for the critical transitions are:

• G(Active, Paused) requires: (a) the pause condition P(metrics) exceeds the configured threshold, OR a qualified authority issues a manual pause directive with documented justification; (b) a checkpoint can be created within the allowed checkpoint window; (c) the accountability requirement A(pause_reason) is satisfied.
• G(Paused, Resumed) requires: (a) the corrective actions specified in the pause report have been implemented and verified; (b) a responsible authority has signed the resume directive; (c) modified parameters (if any) have been reviewed and approved.
• G(Paused, Terminated) requires: (a) the evaluation report concludes non-viability; (b) a beneficiary transition plan has been filed; (c) a responsible authority has signed the termination directive with documented justification.

2.4 State Invariants

Each state maintains invariants that the system must preserve:

• Active invariant: Budget allocation is positive, at least one beneficiary is enrolled or eligible, and the monitoring system is collecting metrics at the configured frequency.
• Paused invariant: No new expenditures are authorized (except maintenance costs), no new beneficiaries are enrolled, existing beneficiaries retain their current status, and the checkpoint is valid and restorable.
• Terminated invariant: All resources are deallocated within the wind-down period, all beneficiaries have been notified and transitioned, and the final evaluation report is filed within 90 days.

Invariant violations trigger automatic alerts and may escalate to the governance layer for human review -- a direct application of the fail-closed principle from MARIA OS's gate architecture.

2.5 正式なステートマシン仕様

Combining the above, the policy state machine is fully specified as:

ここで、S = {ドラフト、アクティブ、一時停止、再開、終了、完了} は状態セット、シグマは遷移イベントのセット (承認、一時停止、再開、終了、完了、正規化、再一時停止)、デルタ: S x シグマ -> S は保護された遷移関数 (部分的 -- すべてのイベントがすべての状態で有効であるわけではありません)、s_0 = ドラフトは初期状態、F = {終了、完了} は最終（吸収）状態のセット。

この正式な仕様により、ポリシーのライフサイクル プロパティの自動検証が可能になります。たとえば、認可期間ごとの一時停止と再開の繰り返しの最大回数を制限することで、すべてのポリシーが最終的に最終状態 (一時停止と再開のサイクルで無限ループがない) に到達することを証明できます。

3. Pause Condition Formalization

The pause condition is the trigger mechanism that moves a policy from Active to Paused. In traditional governance, pause decisions are ad-hoc political judgments. In Pausable Policy Design, they are formalized as mathematical functions of observable metrics, with clear thresholds and documented sensitivity.

3.1 The Pause Condition Function

where m = (m_1, m_2, ..., m_k) is the vector of k performance metrics collected during policy execution. P_pause(m) returns a value in [0,1] representing the urgency of pausing: P_pause = 0 means the policy is performing as expected and no pause is warranted; P_pause = 1 means the policy is in critical failure and immediate pause is required.

The pause condition fires when P_pause(m) exceeds a configured threshold tau_pause:

The threshold tau_pause is a governance parameter that reflects the municipality's risk tolerance. A low threshold (e.g., tau_pause = 0.3) makes the policy sensitive to early warning signs. A high threshold (e.g., tau_pause = 0.7) allows the policy to absorb more variance before triggering a pause. The default recommendation for municipal programs is tau_pause = 0.5, balancing sensitivity against false-positive pauses.

3.2 Metric Dimensions

メトリック ベクトル m は 4 つの主要な次元で構成され、それぞれがポリシー パフォーマンスの異なる側面を捉えます。

有効性指標 (m_E): 政策の成果は、定められた目標と一致していますか?住宅補助プログラムの場合、有効性の指標には、住宅に入居している家族の数、入居までの平均期間、住宅安定率（12 か月後も住宅に入居している受益者の割合）、目標と比較した入居成功あたりの費用が含まれます。

効率指標 (m_F): ポリシーは予想された速度でリソースを消費していますか?効率性の指標には、バーンレート (実際の支出と予算上の支出)、管理経費率 (プログラムの総コストに占める管理コストの割合)、および単位コストの軌道 (成果あたりのコストは改善しているか、安定しているか、それとも悪化しているか?) が含まれます。

Equity metrics (m_Q): Is the policy reaching its intended beneficiaries equitably? Equity metrics include the demographic distribution of beneficiaries compared to the eligible population, the geographic coverage, the wait time distribution across demographic groups, and the benefit amount distribution.

Compliance metrics (m_C): Is the policy operating within its legal and regulatory constraints? Compliance metrics include the number of regulatory violations, the audit finding rate, the grievance filing rate, and the data privacy incident rate.

3.3 Weighted Composite Function

The pause condition function combines the four metric dimensions into a single urgency score via a weighted composite:

where w_E + w_F + w_Q + w_C = 1 are the dimension weights, and f_E, f_F, f_Q, f_C are the per-dimension scoring functions that map raw metrics to [0,1] urgency scores.

The default weights for municipal programs are:

• w_E = 0.35 (effectiveness is the primary performance indicator)
• w_F = 0.25 (efficiency determines sustainability)
• w_Q = 0.25 (equity is a non-negotiable governance requirement)
• w_C = 0.15 (compliance violations are critical but less frequent)

These weights are configurable per policy and per municipality. A program with significant equity concerns might increase w_Q to 0.35 and reduce w_F to 0.15. A program under regulatory scrutiny might increase w_C to 0.30.

3.4 Per-Dimension Scoring Functions

Each per-dimension scoring function f transforms raw metrics into an urgency score. The transformation accounts for the direction of the metric (higher is better vs. lower is better), the threshold at which underperformance becomes concerning, and the severity curve (linear vs. exponential degradation).

ここで、ガンマ > 0 は重大度の指数です。ガンマ = 1 は線形劣化を生成します (目標を下回るすべてのユニットが均等に寄与します)。 gamma = 2 では二次劣化が生じます (目標をはるかに下回るパフォーマンスが不釣り合いに寄与します)。ガンマ < 1 の場合、凹状の劣化が生じます (早期警告が増幅されます)。デフォルトの推奨値はガンマ = 1.5 で、早期警告を中程度に増幅します。

低いほど良い指標 (結果あたりのコスト、待ち時間など) の場合、スコアリング関数は反転されます。f(m, t, c) は、目標を下回る不足ではなく、目標を上回る超過を評価します。

3.5 ヒステリシスと安定性

To prevent oscillation between Active and Paused states (the 'flapping' problem), the pause condition incorporates hysteresis. The threshold for pausing is higher than the threshold for remaining active:

where Delta_tau is the hysteresis margin (default: 0.1). A policy triggers a pause when P_pause exceeds tau_pause = 0.6, but the pause condition does not clear until P_pause falls below tau_clear = 0.4. This creates a dead band that absorbs metric noise without triggering unnecessary state transitions.

3.6 Temporal Smoothing

Raw metrics are noisy. A single bad month in a housing subsidy program -- perhaps due to seasonal housing market dynamics -- should not trigger a pause. The pause condition uses exponential moving average (EMA) smoothing to filter transient fluctuations:

where alpha in (0,1) is the smoothing factor. alpha = 0.3 (default) produces a smooth signal that responds to sustained trends while filtering single-period anomalies. The smoothed metrics m_bar are used in the pause condition function instead of the raw metrics m.

4. Accountability Under Pause: Who Decides and Why

The most politically dangerous moment in a policy's lifecycle is not its failure -- it is the decision to acknowledge that failure by pausing. Pausable Policy Design addresses this by making accountability a formal, traceable, non-optional component of every pause transition.

4.1 The Accountability Requirement Function

A(r) は、特定の一時停止理由に対する責任条件が満たされているかどうかを評価します。一時停止遷移は、A(r) = が満たされない限り続行できません。これは厳密な制約であり、推奨ではありません。ステート マシンの遷移ガード G(Active, Paused) には結合として A(r) が含まれています。

4.2 Accountability Components

The accountability requirement A(r) is a conjunction of four components:

権限 (A_authority): 一時停止は、ポリシーの影響クラスに指定された権限レベルを持つ個人によって開始または承認される必要があります。 3 つの権限レベルを定義します。

• Level 1 (Department): For low-impact policies (annual budget < $500K, beneficiaries < 100). The department director can pause unilaterally.
• Level 2 (Executive): For medium-impact policies ($500K-$5M, 100-1000 beneficiaries). Requires the city manager or deputy's approval.
• Level 3 (Legislative): For high-impact policies (> $5M, > 1000 beneficiaries). Requires council notification and a 48-hour objection window.

Each authority level maps to a specific role in the MARIA OS coordinate system, enabling automated authority verification.

Evidence (A_evidence): The pause must be supported by quantitative evidence of underperformance. The evidence bundle must include: (a) the current values of all metrics in the pause condition function, (b) the computed P_pause score and its component breakdown, (c) the trend analysis showing sustained (not transient) underperformance, and (d) comparison to the pre-defined performance targets.

Justification (A_justification): The pause must include a written justification that addresses: (a) why the current performance warrants a pause rather than continued monitoring, (b) what corrective actions are being considered during the pause, (c) what the expected duration of the pause is, and (d) what conditions would trigger either resumption or termination.

Notification (A_notification): Affected stakeholders must be notified before or concurrent with the pause. The notification requirements depend on the policy's impact class: Level 1 requires internal stakeholder notification, Level 2 requires beneficiary notification, and Level 3 requires public notice.

4.3 Accountability Chain

すべての一時停止により、不変の責任チェーンが作成されます。これは、トリガーとなる指標から権限を与えた個人まで一時停止の決定を追跡する、リンクされた一連のレコードです。

Accountability Chain:
  1. Metric trigger:     P_pause(m) = 0.67 > tau_pause = 0.50
  2. Component breakdown: E=0.71, F=0.58, Q=0.82, C=0.31
  3. Evidence bundle:     [housing_rate_report_Q3.pdf, cost_analysis_oct.csv, ...]
  4. Authority:           Director J. Martinez (Level 2), approved 2026-02-10
  5. Justification:       "Cost per placement 2.3x target, trending upward for 3 consecutive
                           months. Pause to evaluate vendor contract renegotiation."
  6. Notification:        Beneficiary letters sent 2026-02-08, public notice posted 2026-02-09
  7. Checkpoint:          Policy state snapshot ID: CP-2026-0210-HOU-041

説明責任の連鎖は MARIA OS 意思決定ログに保存され、監査人、監視委員会、および一般の人々 (プライバシー編集の対象) によって照会できます。チェーンのすべての要素は個別にアドレス指定可能であり、事後変更を防ぐために暗号的にハッシュされます。

4.4 Preventing Accountability Gaming

Two forms of accountability gaming are foreseeable and must be addressed by design:

Premature pause gaming: An administrator pauses a policy they oppose for political reasons, using manufactured or cherry-picked metrics as justification. The defense is the evidence requirement: the pause condition function P_pause uses a predetermined set of metrics with predetermined weights, computed from auditable data sources. An administrator cannot change the metrics or weights without going through a separate governance process (modifying the policy's monitoring configuration, which itself requires authority and justification).

ゲームの無期限一時停止: 管理者がポリシーを一時停止した後、再開を無期限に遅らせ、正式な終了手続きを行わずに実質的にポリシーを終了します。防御策は 一時停止期間の制限 です。すべての一時停止には最大期間を指定する必要があります (デフォルト: 自治体のプログラムの場合は 90 日)。再開または終了の決定が行われずに一時停止期間が経過すると、システムは自動的に次の権限レベルに昇格します。有効期限が切れたレベル 1 の一時停止は、レベル 2 のレビューにエスカレートします。有効期限が切れたレベル 2 の一時停止は、レベル 3 (法的) 審査にエスカレートします。これにより、単一の管理者が一時停止メカニズムをバックドア終了として使用することができなくなります。

4.5 責任の指標

The framework tracks accountability health across the policy portfolio via aggregate metrics:

The target is AccountabilityScore >= 0.99 -- fewer than 1% of pauses should proceed without complete accountability documentation. In our experimental evaluation, the MARIA OS implementation achieves 99.2% accountability attribution, with the remaining 0.8% representing emergency pauses where retroactive accountability documentation was completed within 48 hours.

5. Cost Function: Continue vs Pause vs Terminate

At the heart of every pause decision is an implicit cost comparison: is it cheaper (in the broadest sense) to continue running the policy, pause it for evaluation, or terminate it entirely? Pausable Policy Design makes this comparison explicit and computable.

5.1 The Three-Option Cost Model

ここで、Delta は評価期間 (コストを予測する将来の距離)、Delta_p は予想される一時停止期間、p_resume は一時停止されたポリシーが再開される (評価後に終了するのではなく) 推定される確率です。

5.2 Component Definitions

OpEx (Operational Expenditure): The ongoing cost of running the policy, including staff, contracts, facilities, and direct beneficiary payments. For a failing policy, OpEx is the most visible cost -- it is money being spent on a program that is not delivering proportional value.

OpportunityCost: The value of the next-best alternative use of the resources consumed by the policy. If the housing subsidy program spends $2M per year and an alternative program could house 40% more families with the same budget, the opportunity cost is the unrealized 40% improvement. Opportunity cost is the hardest component to estimate but often the largest.

HarmCost: The cost of harm inflicted by a failing policy on its intended beneficiaries or the public. A housing subsidy program that places families in substandard housing is actively harmful, not merely ineffective. HarmCost captures the welfare loss from continued operation of a malfunctioning program.

PauseCost_fixed: The one-time cost of executing a pause: creating the checkpoint, notifying beneficiaries, suspending contracts, and producing the pause report. This is typically small relative to ongoing operational costs.

メンテナンスコスト: 一時停止状態でポリシーを維持するためのコスト: データの保存、終了時の既存のコミットメントの順守、主要スタッフの維持、チェックポイント状態の維持。メンテナンスコストは通常​​、全運用コストの 10 ～ 20% です。

再開コスト: 一時停止された保険契約を再開するための 1 回限りのコスト: チェックポイントの復元、受益者の再関与、契約の再開、完全な運用への復帰など。

WindDownCost: 保険を永久に停止するためのコスト: 最終的な受益者への支払い、契約解除違約金、スタッフの再配置または退職、施設の廃止。

TransitionCost: The cost of moving beneficiaries from the terminated policy to alternative programs. This includes enrollment assistance, temporary gap coverage, and administrative overhead.

PoliticalCost: The reputational and political cost of termination. While difficult to quantify precisely, PoliticalCost can be estimated from historical precedent: how have similar termination decisions affected subsequent elections, approval ratings, and stakeholder relationships?

5.3 The Decision Rule

The optimal decision at time t is:

That is, choose the action with the lowest expected total cost. The decision rule is applied at each checkpoint (see Section 7) and produces a formal recommendation that feeds into the accountability chain.

5.4 When Pausing Dominates Continuing

Pausing is strictly preferred to continuing when:

不等式を拡張し、保守コストが OpEx の一部の mu であるという仮定の下で単純化します (MaintenanceCost = mu x OpEx、通常 mu は 0.15)。

OpEx = 200 万ドル/年、OpportunityCost = 80 万ドル/年、HarmCost = 20 万ドル/年、PauseCost_fixed = 50,000 ドル、mu = 0.15、Delta_p = 90 日、Delta = 1 年、ResumeCost = 100,000 ドル、p_resume = 0.6、および C_terminate = 300,000 ドルのポリシーの場合:

In this example, pausing costs $305K while continuing costs $3M over the evaluation horizon -- nearly a 10x cost advantage. Even with highly conservative estimates of opportunity cost and harm cost, the pause option dominates whenever the policy is substantially underperforming.

5.5 Sensitivity Analysis

コスト モデルの出力は、機会コスト、損害コスト、再開の確率という本質的に不確実な 3 つのパラメーターの影響を受けます。自治体は 3 つのシナリオ (楽観的、ベースライン、悲観的) に基づいて決定ルールを計算し、3 つのシナリオのうち少なくとも 2 つで一時停止オプションが優勢な場合は一時停止することをお勧めします。この堅牢な決定ルールにより、過剰な感度 (ノイズで一時停止) と過小な感度 (明らかな障害が発生しても継続) の両方が防止されます。

6. Checkpoint Design for Policy Resumption

The ability to pause a policy is only valuable if the policy can be resumed without catastrophic state loss. Checkpoint design determines what state is preserved during a pause, how it is preserved, and what guarantees the system provides about restoration integrity.

6.1 Policy State Components

A running policy's state consists of multiple components, each requiring different checkpoint strategies:

Beneficiary state (S_B): The enrollment status, benefit amounts, payment history, eligibility determinations, and case notes for each beneficiary. This is the most critical component -- loss of beneficiary state means re-enrollment, re-determination, and service disruption.

Financial state (S_F): The budget allocation, expenditure history, encumbered funds (committed but not yet disbursed), and projected cash flow. Financial state must be checkpointed to enable accurate budget reconciliation upon resumption.

Operational state (S_O): Active contracts with service providers, staff assignments, facility leases, technology systems, and inter-agency agreements. Operational state is the most complex component because it involves external parties whose own states are not controlled by the municipality.

Metric state (S_M): The historical time series of all performance metrics, the current smoothed values, the pause condition function parameters, and the evaluation models. Metric state is essential for continuity of performance monitoring upon resumption.

6.2 チェックポイントデータモデル

where id is a unique checkpoint identifier, t_created is the creation timestamp, P_id is the policy identifier, S_B through S_M are the state components defined above, H_integrity is a cryptographic integrity hash computed over all state components, and metadata includes the checkpoint creator, the reason for checkpoint, and the expected resumption conditions.

6.3 Checkpoint Integrity Guarantees

チェックポイント システムは、次の 3 つの整合性保証を提供します。

Completeness: Every state component is captured. The checkpoint process verifies that S_B, S_F, S_O, and S_M are all present and internally consistent before finalizing the checkpoint. An incomplete checkpoint is marked as invalid and cannot be used for resumption.

Immutability: Once created, a checkpoint cannot be modified. The integrity hash H_integrity is computed as:

Any modification to any state component would change the hash, making tampering detectable. The hash is stored separately from the checkpoint data (in the MARIA OS audit log) to prevent coordinated modification of both data and hash.

Restorability: A valid checkpoint can be restored to produce a policy state that is operationally equivalent to the state at the time of checkpoint creation. 'Operationally equivalent' means that beneficiaries receive the same benefits, financial accounts are reconciled to the same balances, and metric tracking continues from the same baseline.

6.4 Graceful Pause Procedure

The checkpoint creation follows a graceful pause procedure that brings in-flight operations to safe stopping points:

• Step 1 -- Drain: Stop accepting new applications and new commitments. Allow in-progress applications to complete their current processing step. Timeout: 5 business days.
• ステップ 2 -- 和解: 承認されているが未払いの給付金をすべて支払います。未決の契約支払いをすべて完了します。すべての金融口座を照合します。タイムアウト: 10 営業日。
• ステップ 3 -- スナップショット: 安定した状態から S_B、S_F、S_O、S_M をキャプチャします。 H_integrity を計算します。チェックポイントを保存します。
• ステップ 4 -- 通知: すべての受益者、サービス プロバイダー、関係者に一時停止通知を送信します。予想される一時停止期間と質問の連絡先情報を含めます。
• ステップ 5 -- ホールド: メンテナンス状態に入ります。主要なスタッフを維持し、データ システムを保存し、チェックポイントを維持します。

The total graceful pause procedure takes 15-20 business days from initiation to stable Paused state. Emergency pauses (e.g., fraud detection, safety concerns) can skip Steps 1-2 and snapshot immediately, with reconciliation performed retroactively.

6.5 Resumption Procedure

チェックポイントから再開するには、次の逆の手順に従います。

• ステップ 1 -- 検証: チェックポイント整合性ハッシュを検証します。チェックポイント データが完全で破損していないことを確認します。
• ステップ 2 -- 復元: チェックポイントから S_B、S_F、S_O、S_M をロードします。一時停止中に承認されたパラメータの変更を適用します (例: 改訂された資格基準、更新された給付額)。
• ステップ 3 -- 調整: 一時停止期間中に発生した変更を考慮します (例: 受益者の異動、契約の期限切れ、予算配分の調整など)。
• ステップ 4 -- 再度関与する: 受益者に通知し、サービス プロバイダー契約を再開し、新しい申し込みの受け付けを開始します。
• Step 5 -- Monitor: Enter a 30-day intensive monitoring period (the Resumed state) with daily metric collection and weekly pause condition evaluation. If the policy performs within targets during this period, it transitions to Active. If it triggers the pause condition again, it transitions back to Paused.

6.6 チェックポイントの保存と保持

Checkpoints are stored in the MARIA OS evidence store with the following retention policy:

• Active policy checkpoints: retained indefinitely during policy lifecycle
• Terminated policy checkpoints: retained for 7 years (matching municipal record retention requirements)
• Completed policy checkpoints: retained for 5 years
• Checkpoint storage is append-only: new checkpoints are created, never updated or deleted

For a typical municipal policy portfolio of 50-100 active programs, the annual checkpoint storage requirement is approximately 2-5 GB, well within the capacity of standard government IT infrastructure.

7. Partial Rollback Mechanisms

すべてのポリシーの失敗に完全な一時停止が必要なわけではありません。場合によっては、政策がほとんどの側面でうまく機能しているにもかかわらず、特定の領域で失敗していることがあります。部分的なロールバックにより、完全な一時停止によるオーバーヘッドや中断を発生させることなく、目的を絞った修正が可能になります。

7.1 Rollback Granularity

ロールバック粒度の 3 つのレベルを定義します。

パラメータのロールバック: 1 つの構成パラメータが元に戻されます。例: 増加が持続不可能であることが判明したため、家族あたりの給付額は 1,200 ドル/月から以前の 1,000 ドル/月に引き下げられます。

Component rollback: An entire policy component is reverted. Example: the new digital enrollment system is rolled back to the previous paper-based process because the digital system produced a 40% error rate in eligibility determinations.

Scope rollback: The policy's geographic or demographic scope is reduced. Example: a city-wide housing subsidy is rolled back to a pilot scope of three neighborhoods because city-wide implementation revealed capacity constraints.

7.2 Rollback Conditions

Partial rollback is appropriate when the following conditions are met:

• パフォーマンスの低いディメンションは 分離可能 です。その失敗によって他のポリシー コンポーネントが汚染されることはありません。
• The previous parameter value is known effective -- there is historical evidence that the rolled-back configuration performed adequately.
• ロールバックは アトミックに実行できます。パラメータの変更は、古い構成と新しい構成の間で矛盾した状態が生じることなく、きれいに反映されます。
• ロールバックの 影響は限定的です。影響を受ける受益者の数と変化の規模は許容範囲内です。

When these conditions are not met -- when the failure is systemic, the previous configuration is unknown or also failed, or the rollback creates inconsistencies -- a full pause is required instead.

7.3 Rollback Decision Function

ここで、 d はパフォーマンスが低いディメンション、 m_d はディメンション d のメトリック ベクトル、 m_{-d} は他のすべてのディメンションのメトリック ベクトル、 f_d はディメンションごとのスコアリング関数 (セクション 3.4 から)、 tau_rollback はロールバックしきい値 (デフォルト: 0.6)、 tau_healthy は影響を受けないディメンションのヘルスしきい値 (デフォルト: 0.3) です。

In words: partial rollback is triggered when one dimension is significantly underperforming (f_d > 0.6) but all other dimensions are healthy (f_{-d} < 0.3). If multiple dimensions are underperforming or the healthy dimensions are borderline, a full pause is required.

7.4 Rollback Accountability

部分的なロールバックには、完全な一時停止と同じ説明責任の連鎖が必要ですが、1 つ変更があります。理由は、部分的なロールバックで十分である理由 (つまり、完全な一時停止が保証されない理由) を説明する必要があります。これにより、実際に完全な一時停止が必要な場合に、一時停止に代わるよりソフトで政治的に目立たない代替手段としてロールバックが使用されるのを防ぎます。

The accountability requirement for partial rollback is:

where A_isolation(d) is an additional requirement that the rollback target dimension d is demonstrated to be operationally independent of the other dimensions. This independence must be documented with evidence, not merely asserted.

8. 民主的な無効化と透明性の要件

Pausable Policy Design operates within a democratic governance framework. Mathematical optimization can recommend pause, continue, or terminate decisions, but the final authority rests with elected officials and their designees. The framework must accommodate democratic override while preserving transparency and accountability.

8.1 Override Authority

• Override-to-continue: The framework recommends pause, but the elected authority directs continuation. The authority must provide documented justification and accept explicit accountability for continued operation.
• 一時停止へのオーバーライド: フレームワークは一時停止 (P_pause < tau_pause) を推奨しませんが、選出された当局が一時停止を指示します。これは、当局が指標フレームワークによって捕捉されない情報を所有している場合には正当です（例：機密調査、保留中の法改正）。

Both override types create accountability records that are permanently attached to the policy's decision log.

8.2 Override Accountability

オーバーライドには、フレームワークに合わせた決定と比較して 強化された説明責任要件が伴います。

追加の 2 つの要件は次のとおりです。

公的記録 (A_public-record): 上書き決定は、上書きする当局の身元および記載された正当性を含め、48 時間以内に公的記録に入力されなければなりません。この要件は、法執行機関の積極的な捜査に関連するオーバーライドの場合にのみ免除でき、免除自体が記録されます。

Review trigger (A_review-trigger): Every override automatically triggers a review by the next higher authority level within 30 days. A council member who overrides a department-level pause recommendation triggers a council committee review. This ensures that overrides do not become routine workarounds for the governance framework.

8.3 Transparency Architecture

このフレームワークは、次の 3 つのレベルで透明性を実装します。

Operational transparency: All metric data, pause condition scores, cost function computations, and decision recommendations are accessible in real-time through the MARIA OS dashboard. Department staff and managers can see exactly why the framework is recommending a particular action.

Governance transparency: All pause decisions, resume decisions, termination decisions, and overrides are logged with complete accountability chains. Council members and oversight committees can audit any decision in the portfolio.

公開の透明性: 公開ダッシュボードは、ポートフォリオ内の各ポリシーの概要レベルの情報を提供します。つまり、現在の状態 (アクティブ、一時停止、終了、完了)、現在の一時停止条件スコア (個人を特定できる情報を含む可能性のある生の指標の詳細なし)、および一時停止または上書きの決定に対する説明責任チェーンです。

8.4 透明度のグラデーション

Not all information can be made fully public. Beneficiary data, contract terms, and personnel decisions require privacy protection. The framework implements a transparency gradient with four access levels:

• パブリック: ポリシーの状態、集計パフォーマンス スコア、決定結果、オーバーライド レコード
• 法律: すべての公開データと詳細な指標、コスト関数の計算、およびスタッフのパフォーマンス
• 幹部: すべての法的データと個々の受益者のステータスおよび契約の詳細
• Audit: Complete access to all data including raw checkpoint state and integrity verification

システム内の各データには、作成時にその最小透明度レベルがタグ付けされます。 MARIA OS アクセス制御層は、勾配を自動的に適用します。

8.5 Whistleblower Integration

The framework includes a formal channel for anonymous reporting of governance irregularities. If an employee believes that a pause decision is being suppressed, that metrics are being manipulated, or that an override is being executed without proper accountability, they can file a report through the MARIA OS integrity channel. Reports are routed to the audit authority and trigger an independent review, with whistleblower identity protected by the system's access control.

9. MARIA OS 意思決定パイプラインとの統合

9.1 Architecture Mapping

Pausable Policy Design maps naturally onto the MARIA OS architecture. Each policy is represented as a first-class entity in the MARIA Coordinate System, and each policy lifecycle event (pause, resume, terminate, rollback) is processed through the Decision Pipeline.

PPD の概念と MARIA OS コンポーネント間のマッピングは次のとおりです。

| PPD Concept | MARIA OS Component | Location |

|---|---|---|

|ポリシー ステート マシン |意思決定パイプライン ステート マシン | lib/engine/decion-pipeline.ts |

| Pause condition P(m) | Responsibility Gate evaluation | lib/engine/responsibility-gates.ts |

| Accountability requirement A(r) | Evidence bundle + approval chain | lib/engine/approval-engine.ts |

| Checkpoint CP | Evidence store snapshot | lib/engine/evidence.ts |

| Cost function C_d(t) | Analytics engine computation | lib/engine/analytics.ts |

|オーバーライド処理 |強化されたログによる HITL エスカレーション | lib/engine/approval-engine.ts |

| Transparency dashboard | Dashboard panels | components/maria/*-panel.tsx |

9.2 Decision Pipeline Extension

The standard MARIA OS Decision Pipeline uses a 6-stage state machine: proposed -> validated -> [approval_required | approved] -> executed -> [completed | failed]. For policy governance, we extend this with three additional states that map to the PPD state machine:

Standard pipeline:  proposed -> validated -> approved -> executed -> completed
PPD extension:      ... -> executed/active -> paused -> resumed -> active -> completed
                                            -> paused -> terminated

拡張機能は、「実行」ステージ内のサブステート マシンとして実装されます。 「ポリシー」タイプの決定が「実行」ステージに入ると、アクティブ/一時停止/再開/終了/完了のライフサイクルを管理する PPD ステート マシンがアクティブになります。外側のパイプラインは、PPD サブマシンが最終状態 (終了または完了) に達するまでポリシーを「実行済み」(実行中) とみなし、その時点で外側のパイプラインはそれに応じて「完了」または「失敗」に移行します。

9.3 Gate Configuration for Policy Decisions

Policy pause and terminate decisions are classified as high-impact actions in the MARIA OS gate framework. The gate configurations are:

| Policy Action | Impact (I_i) | Risk (R_i) | Gate Strength (g_i) | Expected h_i |

|---|---|---|---|---|

|メトリクスの更新 | 0.05 | 0.02 | 0.1 | 0.01 |

| Parameter adjustment | 0.30 | 0.15 | 0.4 | 0.18 |

| Partial rollback | 0.50 | 0.30 | 0.6 | 0.55 |

| Full pause | 0.75 | 0.45 | 0.8 | 0.93 |

|一時停止から再開 | 0.60 | 0.35 | 0.7 | 0.78 |

| Terminate | 0.90 | 0.60 | 0.95 | 0.99 |

| Democratic override | 0.85 | 0.50 | 0.9 | 0.97 |

Full pause (g_i = 0.8) and termination (g_i = 0.95) have high gate strengths, ensuring that nearly all such decisions involve human review. Even a metric update (g_i = 0.1) has a non-zero gate, reflecting the principle that all policy actions are consequential and should be logged.

9.4 座標系のマッピング

MARIA OS 座標系では、自治体の政策ガバナンスは、自治体のテナントの銀河系内の専用のユニバースを占めます。

G1 (City of Springfield)
  U3 (Policy Governance Universe)
    P1 (Housing Domain)
      Z1 (Subsidy Programs Zone)
        A1 (Housing Subsidy Policy Agent)
        A2 (Housing Subsidy Monitor Agent)
      Z2 (Inspection Programs Zone)
    P2 (Transportation Domain)
    P3 (Public Safety Domain)
    P4 (Education Domain)

Each policy domain maps to a Planet, each program area maps to a Zone, and each policy has a dedicated monitoring agent. The hierarchical structure enables policy-level metrics to aggregate into domain-level, universe-level, and galaxy-level governance dashboards.

9.5 Real-Time Monitoring Integration

MARIA OS ダッシュボードには、専用のポリシー ガバナンス パネルが用意されています。

• ポリシー ポートフォリオ ステータス: すべてのポリシーを状態 (アクティブ/一時停止/終了/完了) ごとに視覚的にマップし、個々のポリシーの詳細にドリルダウンします。
• Pause Condition Monitor: Real-time P_pause scores for all active policies with threshold alerts and trend indicators
• コスト関数ダッシュボード: 一時停止のしきい値に近づいているポリシーのコスト比較分析 (継続、一時停止、終了)
• 責任監査証跡: 責任チェーンの視覚化による各ポリシーの完全な意思決定履歴
• チェックポイント レジストリ: 整合性検証とストレージ使用率を含むすべてのチェックポイントのステータス

10. 事例紹介：市営住宅補助制度

We demonstrate Pausable Policy Design through a detailed case study of a fictional but realistic municipal housing subsidy program, the Springfield Family Housing Assistance Program (SFHAP).

10.1 プログラムの説明

SFHAP は、2024 年 1 月にスプリングフィールド市議会によって 3 年間の認可と年間 420 万ドルの予算で認可されました。このプログラムは、地域の平均収入（AMI）の 60% 未満の収入がある世帯に、月額最大 1,200 ドルの家賃補助金を提供します。定められた目標は次のとおりです。

• House 350 families per year in safe, stable rental units
• 12か月の住宅安定率85%を達成
• 掲載成功ごとのコストを 12,000 ドル未満に維持する
• 追跡されたすべてのディメンションで対象人口の 10 パーセント ポイント以内の人口統計分布を提供します

10.2 パフォーマンスの軌跡

このプログラムは 2024 年 3 月に開始され、2024 年第 2 四半期中に目標内で実行されました。2024 年第 3 四半期から、パフォーマンスは複数の側面で悪化しました。

| Quarter | Families Housed | Stability Rate | Cost/Placement | Equity Gap |

|---|---|---|---|---|

| 2024 年第 2 四半期 | 82 | 87% | $11,200 | 4% |

| Q3 2024 | 71 | 81% | $13,800 | 7% |

| 2024 年第 4 四半期 | 58 | 74% | $16,200 | 12% |

| 2025 年第 1 四半期 | 49 | 68% | $19,100 | 18% |

By Q1 2025, the program was housing 41% fewer families than target (49 vs. 85/quarter), the stability rate had fallen 17 percentage points below target, the cost per placement was 59% above target, and the equity gap had grown to 18% -- indicating that the program was systematically underserving its intended demographic.

10.3 Pause Condition Evaluation

Under the PPD framework, the pause condition function is evaluated monthly using EMA-smoothed metrics. The February 2025 evaluation produced:

• f_E(m_E) = 0.78 (effectiveness severely below target: families housed and stability rate both failing)
• f_F(m_F) = 0.71 (効率の悪化: 配置あたりのコストは目標を 59% 上回っており、上昇傾向にあります)
• f_Q(m_Q) = 0.64 (許容差を超える資本ギャップ: 人口統計上の偏差 18% 対 目標 10%)
• f_C(m_C) = 0.12 (公称コンプライアンス: 規制違反なし、データ報告のわずかな遅れ)

複合一時停止条件スコア:

tau_pause = 0.50 の場合、一時停止条件が発生します: P_pause = 0.629 > 0.50。システムは、SFHAP をアクティブから一時停止に移行することを推奨します。

10.4 Cost Function Analysis

The cost function analysis for February 2025:

C_Continue (12 か月期間): - OpEx: 420 万ドル (年間予算) - 機会費用: 170 万ドル (同じ予算の代替住宅プログラムの推定値) - 危害コスト: 35 万ドル (不安定な住居に置かれている家族、プログラムを繰り返し利用する家族の管理負担) - 合計: 625万ドル

C_pause (90-day pause): - PauseCost_fixed: $85K (checkpoint creation, notification, contract suspension) - MaintenanceCost: $157K (0.15 x $4.2M x 0.25 year) - ResumeCost x p_resume: $120K x 0.55 = $66K - C_terminate x (1 - p_resume): $480K x 0.45 = $216K - Total: $524K

C_terminate: - 終了費用: $180,000 - 移行コスト: 220,000 ドル (194 人のアクティブな家族を代替プログラムに登録) - 政治的コスト: 80,000 ドル (同等のプログラム終了から推定) - 合計: 48万ドル

The decision rule recommends pause (C_pause = $524K << C_continue = $6.25M). The pause option is 12x cheaper than continuation, driven primarily by the large opportunity cost of continuing a failing program.

10.5 Accountability Chain Execution

SFHAP 一時停止の責任チェーン:

1. メトリックトリガー: P_pause = 0.629 > tau_pause = 0.50 (2025-02-15 にトリガー) 2. 権限: ハウジング サービス ディレクター、Maria Chen (レベル 2 -- プログラム予算 420 万ドル > 50 万ドル閾値)。 2025 年 2 月 18 日に市マネージャーの Robert Torres によって承認されました。 3. 証拠バンドル: 2025 年第 1 四半期のパフォーマンス レポート、EMA で平滑化された指標の傾向 (6 か月のウィンドウ)、コスト関数分析、ベンダーのパフォーマンス レビュー、人口動態の影響分析。 4. 根拠: 「SFHAP は、3 四半期連続で 4 つの指標のうち 3 つの指標でパフォーマンスを下回りました。掲載あたりのコストは上昇傾向にあり、安定化の兆しはありません。ベンダー契約の再交渉、資格基準の改訂、およびプログラムの再設計の可能性を評価するために一時停止します。予想される一時停止期間: 90 日。 5. 通知: 受益者通知レターは 2025 年 2 月 20 日に郵送されました。 2025 年 2 月 21 日にスプリングフィールド官報および市ウェブサイトに公告が掲載されました。Council briefed at regular session 2025-02-22. 6. Checkpoint: CP-2025-0301-HOU-SFHAP created 2025-03-01. Integrity hash: SHA-256(S_B||S_F||S_O||S_M||...) = 0x7a3f...c812.

10.6 一時停止期間のアクティビティ

90 日間の一時停止中 (2025 年 3 月から 5 月まで)、住宅サービス部門は次の評価活動を実施しました。

• ベンダー監査: 主要な住宅紹介ベンダーが、安定率の低下を説明する、紹介失敗率 42% の企業に下請けを行っていたことを発見しました。
• 適格性分析: 収入基準値 (60% AMI) とスプリングフィールドの住宅市場を組み合わせると、適格な家族と利用可能なユニットの間に不一致が生じ、資本ギャップの一因となることが判明しました。
• プログラムの再設計: (a) 新しいベンダーの調達、(b) AMI の 50% から 70% の補足層を備えた 50% AMI への資格の調整、(c) 住宅安定サポート コンポーネント (斡旋後最初の 6 か月間のケース管理) を備えた改訂されたプログラム モデルを開発しました。

10.7 Resume Decision

On May 20, 2025, the evaluation committee recommended resumption with revised parameters. The resume accountability chain:

1. Corrective action verification: New vendor contract signed (Blue River Housing, 91% historical stability rate). Eligibility criteria revised. Case management component designed and staffed. 2. Authority: City Manager Robert Torres, approved 2025-05-22. 3. Modified parameters: Vendor = Blue River Housing; eligibility = 50% AMI (primary) + 50-70% AMI (supplemental); case management = 6 months post-placement; revised budget = $4.5M/year (incremental $300K for case management). 4. Checkpoint restore: CP-2025-0301-HOU-SFHAP restored. 194 active beneficiaries re-engaged. Financial accounts reconciled.

10.8 Post-Resumption Performance

The resumed SFHAP entered a 30-day intensive monitoring period (June 2025) followed by regular quarterly evaluation. Post-resumption performance:

| Quarter | Families Housed | Stability Rate | Cost/Placement | Equity Gap |

|---|---|---|---|---|

| 2025 年第 3 四半期 | 91 | 89% | $12,400 | 6% |

| Q4 2025 | 94 | 91% | $11,800 | 5% |

| Q1 2026 | 97 | 92% | $11,200 | 4% |

再開から 2 四半期後の 2025 年第 4 四半期までに、4 つの指標すべてが目標内のパフォーマンスに戻りました。プレースメントあたりのコストは、19,100 ドル (一時停止前) から 11,200 ドル (2026 年第 1 四半期) に減少し、41% 改善されました。住宅安定率は68％から92％に上昇し、24ポイント改善した。自己資本ギャップは 18% から 4% に縮小し、許容範囲の 10% 内に収まりました。

10.9 反事実分析

Without the pause framework, what would have happened? Based on the pre-pause trajectory and historical precedent for similar programs:

Scenario A (Traditional governance): The annual evaluation in December 2025 would have identified underperformance. A legislative review in Q1 2026 would have debated continuation vs. termination. Under political pressure from beneficiary advocates, the program would have been continued with minor modifications. Total additional waste from March 2025 to March 2026: approximately $4.5M in operational expenditure on a program delivering outcomes at 41% of target.

Scenario B (Sunset clause): The 3-year sunset clause would have triggered in January 2027. The program would have run for 22 additional months before the forced evaluation. Total additional waste: approximately $7.7M.

Scenario C (Pausable Policy Design): The pause was triggered in February 2025, 6 months after performance deterioration began. The 90-day pause cost $524K. The resumed program achieved target performance within 2 quarters. Total cost of the intervention: $524K + $300K/year incremental budget = $824K. Net savings vs. Scenario A: $3.7M. Net savings vs. Scenario B: $6.9M.

11. ベンチマーク

We evaluate Pausable Policy Design against three baselines: traditional annual review governance, sunset clause governance, and the PPD framework implemented on MARIA OS. The evaluation uses a portfolio of 50 simulated municipal policies over a 5-year period, with varying performance trajectories (25% consistently performing, 35% gradually deteriorating, 25% fluctuating, 15% catastrophically failing).

11.1 Failing Policy Detection Rate

| Governance Model | Detection Rate | Mean Time to Detection | False Positive Rate |

|---|---|---|---|

|年次レビュー | 67.3% | 14.2ヶ月 | 2.1% |

| Sunset Clause (3-year) | 78.1% | 22.6 months | 0.8% |

| PPD (tau_pause = 0.5) | 94.7% | 4.8ヶ月 | 6.3% |

| PPD (tau_pause = 0.6) | 89.2% | 6.1ヶ月 | 3.1% |

| PPD (tau_pause = 0.4) | 97.1% | 3.2 months | 11.8% |

PPD at the default threshold (tau_pause = 0.5) detects 94.7% of failing policies with a mean time to detection of 4.8 months -- 9.4 months faster than annual review and 17.8 months faster than sunset clauses. The higher false positive rate (6.3% vs. 2.1%) reflects the sensitivity tradeoff: earlier detection comes with more false alarms. However, false positive pauses are low-cost events (the policy is paused briefly, evaluated, and resumed) compared to the high cost of undetected failures.

11.2 Cumulative Waste Reduction

| Governance Model | Total Spend on Failing Programs | Waste Ratio | Reduction vs. No Governance |

|---|---|---|---|

| No Governance | $47.2M | 100% | -- |

| Annual Review | $38.1M | 80.7% | 19.3% |

| Sunset Clause | $33.4M | 70.8% | 29.2% |

| PPD (tau_pause = 0.5) | $29.7M | 62.9% | 37.1% |

PPD reduces cumulative waste on failing programs by 37.1% compared to no governance, a 17.8-percentage-point improvement over annual review and a 7.9-percentage-point improvement over sunset clauses. The savings are driven by early detection and the ability to pause (preserving option value) rather than being forced to choose between continuation and termination.

11.3 説明責任の帰属

|ガバナンスモデル |完全な責任を伴う決定 |部分的な責任を伴う決定 |帰属のない決定 |

|---|---|---|---|

|年次レビュー | 71.4% | 18.3% | 10.3% |

| Sunset Clause | 82.6% | 12.1% | 5.3% |

| PPD | 99.2% | 0.6% | 0.2% |

PPD achieves 99.2% complete accountability attribution -- every pause, resume, terminate, and override decision has a traceable authority, evidence bundle, justification, and notification record. The 0.8% gap represents emergency pauses where retroactive documentation was completed within the 48-hour window. Under annual review governance, 10.3% of program decisions have no attribution at all -- the program was continued or modified without any documented decision-maker taking responsibility.

11.4 Resumption Integrity

| Metric | Value |

|---|---|

| Checkpoints created | 127 |

| Checkpoints restored | 68 |

| Integrity hash verification pass rate | 100% |

| Beneficiary state restoration accuracy | 98.6% |

| Financial reconciliation accuracy | 99.8% |

| Mean time to full resumption | 12.3 business days |

|受益者混乱インシデント | 3 (受益者一時停止イベント 2,847 件中) |

チェックポイント メカニズムは、受益者の状態復元精度 98.6% を達成します。ただし、1.4% のギャップは、チェックポイントで捕捉されなかった一時停止期間中に移転または資格変更を経験した受益者に起因します。 99.8% の財務調整精度により、チェックポイントがほぼ完璧に忠実に財政状態を把握していることが確認されます。 3 件の受益者中断インシデント (受益者停止イベントの 0.1%) では、連絡先情報が古いために再通知が遅れました。

12. 今後の方向性

12.1 予測一時停止トリガー

The current framework triggers pauses based on observed metric deterioration -- it is reactive. A natural extension is predictive pause triggers that anticipate performance failure before it materializes in the metrics. Machine learning models trained on the metric trajectories of historically failing programs could produce early warning signals 2-4 months before the reactive pause condition fires. The challenge is balancing sensitivity (catching failures early) against specificity (avoiding false alarms that erode trust in the framework).

A predictive model P_predict(m, t) would estimate the probability that P_pause will exceed tau_pause within the next T months, given current metric vector m at time t. When P_predict exceeds a configured confidence threshold, the system would issue a pre-pause advisory -- not a formal pause, but a heightened monitoring state that increases metric collection frequency and triggers a preliminary cost function analysis.

12.2 Cross-Policy Correlation Analysis

Municipal policies do not operate in isolation. A housing subsidy program's performance may be affected by changes in the transportation program (affecting beneficiaries' access to employment), the education program (affecting family decisions about where to live), or the economic development program (affecting the availability of affordable rental units). The current framework evaluates each policy independently.

Future work should develop a cross-policy correlation model that identifies causal relationships between policy portfolios. When Policy A's metrics deteriorate, the model would evaluate whether the deterioration is endogenous (caused by Policy A's own design) or exogenous (caused by changes in the environment created by Policies B, C, and D). Endogenous deterioration warrants a pause of Policy A. Exogenous deterioration warrants a coordinated review of the interacting policies.

12.3 Citizen Feedback Integration

現在の指標フレームワークは、管理データ (登録者数、支出記録、成果評価) に依存しています。政策が目的とする人々の声を直接反映するものではありません。今後の作業では、構造化された市民フィードバックを 5 番目の指標次元として一時停止条件関数に統合する必要があります。

市民のフィードバックは、標準化された調査、パブリックコメントシステム、NLP によって処理されたコミュニティ会議の記録を通じて収集されます。フィードバックは、満足度、アクセシビリティ、公平性、応答性の次元でスコア付けされ、専用の重み w_citizen を使用して複合一時停止条件関数に重み付けされます。技術的な課題は、フィードバック収集が代表的であり、ゲームに耐えられるものであることを保証することです。

12.4 Inter-Municipal Benchmarking

Municipalities implementing PPD on MARIA OS could benefit from inter-municipal benchmarking: comparing their policies' performance against similar policies in comparable municipalities. A housing subsidy program in Springfield that costs $12,000 per successful placement might be performing well relative to its own targets but poorly relative to comparable programs in similar-sized cities that achieve $8,000 per placement.

自治体間のベンチマークには、標準化された指標の定義、プライバシーを保護するデータ共有プロトコル、状況要因 (住宅市場の状況、人口構成、規制環境) の慎重な制御が必要です。連合学習技術を利用すれば、地方自治体が生のプログラム データを共有する必要なくベンチマークを実行できる可能性があります。

12.5 適応閾値キャリブレーション

一時停止しきい値 tau_pause は現在、静的なガバナンス パラメーターとして設定されています。今後の作業では、自治体の過去の一時停止精度に基づいて tau_pause を調整する 適応しきい値キャリブレーション を開発する必要があります。現在のしきい値によって誤検知の一時停止 (不必要な中断) が多すぎる場合、システムは tau_pause を徐々に増やす必要があります。偽陰性 (失敗の見逃し) が多すぎる場合、システムは tau_pause を減らす必要があります。

Adaptive calibration is a form of meta-learning: the governance framework learns to govern itself. The key constraint is that threshold adjustments must be transparent, auditable, and subject to human override -- the system cannot silently reduce its own sensitivity. Every threshold adjustment would go through the standard accountability chain.

12.6 Constitutional Integration

The deepest future direction is integrating PPD with municipal constitutional and charter frameworks. Many city charters include provisions about program evaluation, budget oversight, and public accountability that could be formalized as constraints in the PPD framework. For example, a charter requirement that 'all programs exceeding $1M annually shall be subject to independent evaluation every 18 months' could be encoded as a maximum pause interval constraint: if P_pause has not been evaluated in 18 months, the system triggers a mandatory review regardless of metric performance.

This constitutional integration would transform PPD from an administrative tool into a governance infrastructure layer that implements the city's fundamental governance commitments as executable constraints.

13. 結論

This paper has presented Pausable Policy Design, a mathematical framework for making government policy interruption a formal, accountable, and reversible operation. The framework addresses the fundamental problem of unstoppable policies -- programs that continue consuming resources and producing suboptimal outcomes because no governance mechanism exists to pause, evaluate, and decide.

The key contributions are:

The Policy State Machine formalizes the policy lifecycle as a six-state automaton (Draft, Active, Paused, Resumed, Terminated, Completed) with guarded transitions that enforce governance requirements at the architectural level. The state machine provides the semantic foundation for treating policies as interruptible programs rather than irreversible commitments.

The Pause Condition Function P_pause(m) transforms observable performance metrics into a continuous urgency score, with weighted dimensions for effectiveness, efficiency, equity, and compliance. Temporal smoothing, hysteresis, and configurable thresholds prevent both over-sensitivity and under-sensitivity. The function makes the 'should we pause?' question answerable with quantitative evidence rather than political intuition.

The Accountability Requirement A(r) ensures that every pause decision has a traceable authority, an evidence bundle, a written justification, and stakeholder notification. The accountability chain is immutable, cryptographically hashed, and publicly accessible (subject to privacy protections). This addresses the accountability diffusion problem that is the root cause of policy persistence.

The Cost Function provides a three-way comparison (continue vs. pause vs. terminate) that makes the economic case for interruption explicit and auditable. The cost model includes operational expenditure, opportunity cost, harm cost, and political cost, enabling decision-makers to see the full picture rather than anchoring on sunk costs.

チェックポイント メカニズム は、一時停止中にポリシーの状態を保持し、受益者の中断やデータ損失を発生させずに再開できるようにします。チェックポイントは、完全性、不変性、および復元可能性を保証し、一時停止を元に戻せるようにし、プログラムを一時停止するとプログラムが破壊される可能性があるという正当な懸念に対処します。

The Democratic Override Architecture preserves elected officials' authority while imposing enhanced accountability requirements on decisions that countermand the framework's recommendations. The framework is a decision support system, not a decision replacement system.

The case study demonstrates that PPD, implemented on MARIA OS, would have detected the SFHAP's performance deterioration 10 months earlier than traditional annual review, saved $3.7M in cumulative waste, and produced a redesigned program that achieved target performance within two quarters of resumption.

ベンチマークでは、PPD が検出までの平均時間 4.8 か月 (年次レビューの場合は 14.2 か月) で失敗したポリシーの 94.7% を検出し、累積無駄を 37% 削減し、99.2% の説明責任の帰属を達成し、98.6% の再開の整合性を維持することが確認されています。

より広範な意味は、一時停止可能性はガバナンスの弱点ではなく、ガバナンスの能力であるということです。政策を一時停止できる政府は、間違いから学び、軌道修正し、より効果的に有権者に奉仕できる政府です。一時停止できない政府は存続するか破壊することしかできず、プログラムのパフォーマンスが低下しているものの回復可能な可能性がある場合、どちらの選択肢も公共の利益には役立ちません。

参考文献

- [1] Government Accountability Office. (2024). "2024 Annual Report: Additional Opportunities to Reduce Fragmentation, Overlap, and Duplication and Achieve Billions of Dollars in Financial Benefits." GAO-24-106915. Primary source for the $521B savings estimate from program consolidation and termination.

- [2] Pressman, J. and Wildavsky, A. (1984). "Implementation: How Great Expectations in Washington Are Dashed in Oakland." 3rd ed. University of California Press. Classic analysis of the gap between policy design and policy execution in government programs.

- [3] Bardach, E. and Patashnik, E. (2019). "A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving." 6th ed. CQ Press. Standard framework for policy analysis including the evaluation criteria (effectiveness, efficiency, equity) that inform our metric dimensions.

- [4] Behn, R. (2014). "The PerformanceStat Potential: A Leadership Strategy for Producing Results." Brookings Institution Press. Analysis of performance management systems in government, including the challenges of metric-driven governance that motivate our temporal smoothing and hysteresis designs.

- [5] Moynihan, D. (2008). "The Dynamics of Performance Management: Constructing Information and Reform." Georgetown University Press. Research on how government organizations use (and fail to use) performance information, providing empirical grounding for the accountability gaming defenses.

- [6] Sunstein, C. (2014). "Simpler: The Future of Government." Simon & Schuster. Argument for evidence-based, adaptive government policies that aligns with the PPD framework's emphasis on continuous evaluation and formal pause conditions.

- [7] European Parliament. (2024). "Regulation (EU) 2024/1689 -- Artificial Intelligence Act." Official Journal of the European Union. Regulatory framework for AI governance that informs the transparency and accountability requirements of PPD.

- [8] National Institute of Standards and Technology. (2023). "AI Risk Management Framework (AI RMF 1.0)." NIST AI 100-1. US federal framework for AI governance, with accountability and transparency requirements that map to the PPD accountability chain.

- [9] チャンディ、K.M.およびランポート、L. (1985)。 「分散スナップショット: 分散システムのグローバルな状態の決定」。コンピュータ システム上の ACM トランザクション、3(1)、63 ～ 75。分散システムにおける一貫したスナップショットのための基本的なアルゴリズム。チェックポイント メカニズムの設計にインスピレーションを与えます。

- [10] Gray, J. and Reuter, A. (1993). "Transaction Processing: Concepts and Techniques." Morgan Kaufmann. Checkpoint and recovery theory from database systems, adapted for policy state preservation.

- [11] Argyris, C. および Schon, D. (1996)。 「組織学習 II: 理論、方法、実践」アディソン・ウェスリー。ポリシーの一時停止を組織の学習メカニズムとして扱うための概念的な基盤を提供する二重ループ学習理論。

- [12] フッド、C. (2011)。 「責任のゲーム: 政府におけるスピン、官僚主義、自己保存」プリンストン大学出版局。セクション 4.4 の説明責任ゲームの防御を動機付ける政府における責任回避行動の分析。

- [13] MARIA OS Technical Documentation. (2026). Internal architecture specification for the Decision Pipeline, Responsibility Gate Engine, Evidence Store, and MARIA Coordinate System.