In 2018, China's legislature voted 2,958 to 2 to abolish presidential term limits. Why hold the vote at all? Because the vote was the product, not overhead on the decision. Your review board that has never said no is running the same play.
On March 11, 2018, nearly three thousand delegates of China's National People's Congress voted on whether to remove presidential term limits from the constitution, the most consequential change to the document in a generation, the one that cleared Xi Jinping's path to rule indefinitely. The result: 2,958 in favor, 2 against, 3 abstentions, 1 invalid ballot.
Here is the question worth sitting with: why hold the vote at all?
The outcome was never in doubt. Everyone in the Great Hall of the People knew it; everyone watching knew it; the two delegates who pressed the wrong button presumably knew it too. The vote consumed time, machinery, and ceremony to produce a decision that had already been made. And yet no one running the world's most efficient authoritarian system considered the ritual a waste. That should tell you something. The vote wasn't overhead on the decision. The vote was the product.
Political science has a name for this, and it turns out to be a name your engineering organization needs.
For decades, scholars sorted governments into two bins: democracies and autocracies. Then the Cold War ended, and something stranger proliferated: regimes that held real elections, seated real legislatures, ran real courts, and never let any of it constrain power. In Competitive Authoritarianism: Hybrid Regimes After the Cold War (Cambridge, 2010), Steven Levitsky and Lucan Way studied thirty-five such cases from 1990 to 2008 and defined the type: systems that blend meaningful elections with illicit incumbent advantage. Andreas Schedler called the family "electoral authoritarianism." The casual term is older and blunter: a facade. A Potemkin institution.
The central insight in this literature is that the institutions are not abolished. Abolition is the amateur move: it's loud, it invites resistance, it forfeits legitimacy. The professional move is to keep the institution and hollow it: maintain the elections (but tilt the field), seat the legislature (but decide elsewhere), staff the courts (but capture the bench). The form persists in full ceremonial fidelity. The function, the institution's capacity to produce an outcome power doesn't want, is quietly removed.
The archetype is the rubber-stamp legislature, and the National People's Congress is its living exemplar. In seven decades, the NPC has never voted down a bill the Party put before it. The high-water mark of defiance came in April 1992, when delegates were asked to bless the Three Gorges Dam: 1,767 voted in favor, 177 against, and roughly a third of the body withheld assent, an act of dissent so unprecedented that it made international news. Note what the rebellion amounted to. The dam passed anyway. The boldest moment in the institution's history was a loud abstention on the way to yes.
A legislature that has never rejected a bill is not a legislature. It is a ratification ceremony with a quorum.
Here is the counterintuitive core, and the reason the hybrid-regime literature is more than taxonomy: scholars argue the veneer is often worse than open autocracy: more durable, harder to oppose. An undisguised dictatorship is at least legible. Everyone can see there is no check, so the demand for one stays alive.
The veneer kills that demand. It manufactures legitimacy ("we have a parliament") while suppressing the pressure for the real thing, because how do you campaign for an institution that visibly already exists? It co-opts the opposition into playing a rigged game, and every round they play legitimizes the table. The fake check doesn't merely fail to do the work. It occupies the slot where the real check would go, and it persuades everyone the work is being done.
Hold that mechanism in your head, false confidence plus suppressed demand, and now walk through your own organization.
The architecture review board that has never rejected a design. The security review that has always, under deadline pressure, found a way to yes. The two-approver merge rule where the second approval arrives in under a minute, every time, from whoever was nearest. The postmortem that completes its template, files its action items, and changes nothing about how the next incident unfolds. The RFC process where the document is written after the decision, as a record of what was already agreed in a meeting you weren't in.
Each of these has the form of a check: the calendar invite, the template, the sign-off field, the letterhead. Each is missing the same thing the NPC is missing: any live capacity to produce the negative outcome it nominally exists to produce. And each generates exactly what the rubber-stamp parliament generates: legitimacy without constraint. "It went through review" is the engineering sentence that does the same work as "we have democratic institutions": it ends the conversation that should be starting.
The political-science frame gives you the diagnostic, and it is bracingly simple. Don't ask whether the institution exists. Existence is the trap; existence is precisely what a veneer provides. Ask two questions instead. Does this body have the power to block the thing it reviews, actually, procedurally, no workaround? And does it have the demonstrated willingness to use that power under real pressure, a deadline, an executive sponsor, a quarter on the line? Power and willingness, both. A board with neither is decoration. A board with power but no willingness is the more common and more dangerous case: a check that exists in the org chart and fails precisely when checking matters, which is to say it fails exactly when it's needed and only then.
There's a one-line version of the audit. For every institutional check in your organization, find the last time it said no and the no held. Get a date. If you can't, you don't have a check. You have the ritual of one, and the work it was supposed to do is simply not being done, while everyone believes it is.
The canonical engineering case study is thirty years old and still the sharpest. On the eve of the Challenger launch in January 1986, the gate worked, briefly. Engineers at Morton Thiokol, the booster contractor, looked at the forecast and recommended against launching: their O-ring data gave them no confidence below 53°F, and the pad would be far colder. Robert Lund, the VP of engineering, backed them: he didn't want to fly.
Then NASA pushed back, hard, and Thiokol's leadership called a private caucus. Senior VP Jerald Mason, as the Rogers Commission later heard, told Lund to take off his engineering hat and put on his management hat. Management was polled; the engineers were not. The recommendation reversed. In testimony afterward, Commissioner Rogers asked Lund the question that should be framed on the wall of every review board: "How do you explain the fact that you changed your mind when you changed your hat?" Lund's answer described the inversion precisely: that night, the burden had flipped from prove it's safe to fly to prove it isn't.
Read that as a political scientist would. The institution existed. The institution even said no. And then the no was converted to a yes by power operating through the institution's own ceremony, a caucus, a poll, a signed recommendation, so that the launch decision carried the full legitimacy of a review it had, in substance, just overridden. That is the veneer mechanism in motion, and it's why the fake gate is worse than no gate: a missing review can't sign the launch authorization. Seventy-three seconds after liftoff, everyone learned what the signature had been worth.
It's worth being precise about what this is and isn't, because engineering already has two adjacent concepts, and the differences are the point.
The first cousin is the cargo cult, Feynman's 1974 image of replicating a runway's visible form and waiting for planes that never come. Software does this constantly: standups without iteration, OKRs without strategy, the ceremonies of agile without the feedback loops that made them work. Development economists Lant Pritchett, Matt Andrews, and Michael Woolcock found the same pattern in states that adopt the visible structures of successful institutions without the underlying capability, they called it "isomorphic mimicry," looking like a state. But notice the engine: ignorance, plus hope. The cargo-culting team genuinely wants the planes to land. They copied the form because the mechanism was invisible to them. Call it competence theater.
The second cousin is security theater, Bruce Schneier's term from 2003 for measures that make people feel secure without making them secure: the confiscated water bottle, the photo-ID ritual. His framing is the durable part: security is both a feeling and a reality, and they're different. The corporate numbers here are almost too on-the-nose. A 2019 Ponemon Institute study, titled, fittingly, The Cybersecurity Illusion: The Emperor Has No Clothes, surveyed 577 IT security practitioners and found enterprises deploying an average of 47 security tools on an average of $18.4 million a year in spend, while 53 percent of security leaders admitted they don't know whether their tools are actually working. Forty-seven instruments of form; no measured function. That's theater optimized for the feeling.
The veneer is the third thing, and it's darker than either. The cargo cult copies form out of ignorance, hoping for function. Security theater performs form for optics, indifferent to function. The veneer maintains form in order to suppress function, because the false legitimacy is the deliverable. Nobody on a rubber-stamp review board is confused about why the planes don't land. The board exists so that the question "shouldn't someone review this?" always has an answer, and so that the answer never costs anything. Competence theater, optics theater, power theater. The escalation is in whom the form is protecting.
| Theater | Why the form is there | Relationship to function |
|---|---|---|
| Cargo cult (competence theater) | Ignorance, plus hope | Wants function, copied form blindly |
| Security theater (optics theater) | Optics, the feeling of safety | Indifferent to function |
| The veneer (power theater) | To manufacture legitimacy | Maintains form to suppress function |
One honest caveat: in most engineering organizations, nobody sat down and designed the veneer the way a regime designs one. It accretes. The board's first no got overridden by an executive, and everyone updated; the security gate blocked a launch once and the VP "escalated," and the gate learned; saying yes was always cheaper that quarter, and the people who kept saying yes kept getting invited. Drift, not conspiracy. But this is where the political frame earns its keep, because the literature's verdict doesn't depend on intent: a check that cannot say no functions as a veneer whatever its origin story, and it does the regime's work, manufacturing confidence, suppressing demand for the real thing, with no autocrat required. You don't need to find a villain to find the problem. That should make the audit easier to run, not harder: it accuses a structure, not a colleague.
Two boundaries, so the analogy doesn't run past its warrant.
First, a 100 percent approval rate is evidence, not proof. There's a known steelman: maybe everything gets approved because the gate's standards are so well understood that teams conform before submitting. The shadow of the gate does the work; the gate itself rarely has to. This is a real phenomenon: legal scholars Mark Ramseyer and Eric Rasmusen made a version of this argument about Japan's famous 99-percent-plus conviction rate (Journal of Legal Studies, 2001): prosecutors there decline to bring any case they might lose, so the rate measures selection, not a captured court. Fine. But notice what the steelman requires: a record of the standard being enforced somewhere: submissions withdrawn after pre-review, designs reworked before the meeting, prosecutions declined. A healthy gate with a perfect approval rate leaves a paper trail of nos that happened upstream. A veneer leaves nothing but yeses all the way down. If your review board claims the shadow defense, ask to see the shadow.
Second, organizations are not states, and the disanalogy is mostly good news. A citizen can't churn out of a regime; your engineers can quit, your customers can leave, and reality, the outage, the breach, the recall, eventually audits you whether you consented or not. More importantly, not every advisory body is supposed to hold a veto, and there's nothing dishonest about a design review that exists to sharpen rather than to gate. The dishonesty is in the mismatch: a body that presents as a check, that lends its sign-off to launch decisions, that lets leadership say "it passed review", while lacking the power or the will to block. The fix for that mismatch runs in either direction, and both are honest. Give the gate teeth: a real veto, an appeal path that doesn't run through the people being checked, protected dissent, conditions that are tracked to closure. Or take down the letterhead: rename it a consultation, strip its sign-off from the launch checklist, and let the absence of a real gate become visible enough that someone demands one. What you may not do, on this view, is keep the ceremony and the powerlessness together. That combination isn't a weak check. It's a working veneer.
The discipline, then, fits in a sentence. Audit your governance the way a political scientist audits a hybrid regime: ignore the org chart, ignore the letterhead, and for every check, find the last dated no that held under pressure. Where you find one, you have an institution. Where you find none, you have a ceremony, and somewhere behind it, like a dam vote in 1992, a decision that was made before anyone raised a hand.
Sources: Steven Levitsky & Lucan Way, "Competitive Authoritarianism: Hybrid Regimes After the Cold War" (Cambridge UP, 2010); Andreas Schedler (ed.), "Electoral Authoritarianism" (2006); 2018 PRC constitutional amendment vote and 1992 Three Gorges Dam NPC vote (encyclopedic and contemporaneous accounts; abstention tallies for 1992 vary slightly by source); Rogers Commission report and testimony (1986) on the Morton Thiokol pre-launch teleconference; Richard Feynman, "Cargo Cult Science," Caltech commencement address (1974); Lant Pritchett, Matt Andrews & Michael Woolcock, "Looking Like a State" (Journal of Development Studies, 2013); Bruce Schneier, "Beyond Fear" (2003); Ponemon Institute / AttackIQ, "The Cybersecurity Illusion: The Emperor Has No Clothes" (2019); J. Mark Ramseyer & Eric B. Rasmusen, "Why Is the Japanese Conviction Rate So High?" (Journal of Legal Studies, 2001).
"It passed review" should be a record you can open, not a sentence that ends the conversation.
The audit in this essay is a provenance question: for every gate, find the last dated no that held. An agent review gate that always approves is a veneer, and the only way to tell it apart from a real one is the trail it leaves. Chain of Consciousness records that trail: a tamper-evident log of what an agent reviewer actually saw, weighed, and decided, so "it passed review" comes with the dated nos behind it, instead of standing in for them.
pip install chain-of-consciousness · npm install chain-of-consciousness
Hosted Chain of Consciousness → · See it in action