Permission Drift: What Happens When Nobody Holds the Line
A follow-up to “Ethics in the Age of AI,” which discussed the idea of a permission structure and argued that AI has no way to feel one shift. This piece is about what happens when humans do have that capacity — but nobody is using it.
On January 5, 2024, a door plug blew off an Alaska Airlines 737 MAX at 16,000 feet, tearing a hole in the fuselage mid-flight. The FAA grounded the fleet. The NTSB began an investigation of the incident. An FAA report that had already been ordered in response to the 737 Max crashes in 2018 and 2019 was published after a year-long investigation started in March 2023. A panel of 24 experts reviewed 4,000 pages of documents, seven surveys, 250 interviews and meetings with employees at six different Boeing sites for the report. Seven weeks after the incident, the panel reported back: The incident wasn’t caused by a single broken part, the panel found. Instead, the safety experts blamed a “disconnect” between senior management and the people building the planes, a persistent fear of retaliation for reporting safety concerns, and a lack of awareness of safety metrics at every level of the company.
Boeing’s safety culture didn’t fail abruptly in January 2024. It drifted to failure, one unenforced boundary at a time, over roughly two decades of a program that let the company increasingly certify its own safety work.
That drift has a name, and it isn’t unique to aviation.
The Permission Structure Gap, Revisited
In an earlier article, I wrote about the idea of a permission structure: the inherited, unwritten rules that tell a culture’s members what they can and cannot do. I argued that these structures are alive. Beliefs shift, the permission structure shifts with them, and the new structure reinforces the shifted belief. I also argued that AI has none of this. It gets a frozen permission structure at training time and can never feel it go stale.
Humans can feel a permission structure go stale. That’s the whole point of it being alive. But alive doesn’t mean self-correcting, and a permission structure isn’t a wall. It’s porous — a line that holds only because enough people, most of the time, shape their behavior around it without being told to. That’s what makes it powerful: It doesn’t just describe what a culture permits; it shapes the behavior. But a porous line can also move, and it never moves by itself. It takes a person, or a group of people, to move it, and a person, or a group of people, to hold it.
The line moves in one of two ways:
- Through action: Someone crosses it on purpose, behaving as though the line isn’t real.
- Through inaction: Someone with standing to hold the line doesn’t, when it’s crossed in front of them.
Drift almost always runs through the second path. There’s a moment that the person who tests the boundary and the person accountable for it should face each other. If they do, the line holds even after a real test. If they don’t, the line has already moved, whether or not anyone says so out loud.
Call it permission drift: the tendency of a permission structure to loosen the moment someone crosses a line, but no one responds in a way that keeps that line in place.
The Research Behind the Drift
The clearest demonstration of how this works comes from a Dutch field experiment published in Science in 2008. Kees Keizer and colleagues ran six studies in real public spaces. In a bicycle alley with clean walls, 33% of people littered a flyer stuck to their handlebars. In the same alley covered in graffiti, littering jumped to 69%. At a mailbox with no graffiti nearby, 13% of passersby stole a visibly protruding envelope with cash inside it. With graffiti sprayed on the mailbox, theft more than doubled to 27%.
Nobody told these people littering or stealing was acceptable. The only thing that changed was whether an earlier violation had gone unaddressed and stayed visible. One unenforced boundary was enough to make the next one feel breakable, too.
In 2021, economist Nicolás Ajzenman published a study in the American Economic Journal: Applied Economics that traced the same pattern in institutional corruption. Mexico audits municipal governments for misuse of public funds, but publishes the results roughly two years after the fact. That means Ajzenman could compare the same community before and after it learned that local officials had broken the rules and faced no real consequence. In the year following an audit’s release, secondary-school students in that municipality became 10% more likely to cheat on standardized tests, and survey respondents reported a measurable drop in how much they valued honesty and rule-following. The corruption itself didn’t change anyone’s behavior. Finding out it had gone unanswered did.
Organizations: When Nobody Owns the Line
Boeing’s drift didn’t start with the door plug. The FAA traced it to a delegation program called the Organization Designation Authorization, which let Boeing employees certify increasing portions of the company’s safety work on the FAA’s behalf. The idea makes sense on paper: The FAA doesn’t have the staff to inspect every rivet on every jet. In practice, it meant the people accountable for catching safety shortcuts increasingly answered — for their paychecks and their next promotion — to the people whose shortcuts they were supposed to catch.
The 2024 panel uncovered a fear of retaliation, a disconnect between management and engineers, and lack of shared awareness of the metrics meant to catch problems early. Each is a symptom of the same missing interaction: an engineer who spotted a shortcut and a manager positioned to answer for it, failing to face each other. Facing the shortcut cost more for them than letting it pass. The line moved a little at a time. After it moved once without consequence, moving it again cost less than the first move did.
I see a smaller version of this in nearly every organization I work with. A compliance role sits vacant for two quarters while the company looks for the “right” hire. A manager who used to review every exception stops, because the volume got unmanageable and nobody replaced the review. Six months later, the exception has become the procedure, written into the onboarding materials new hires read. Nobody voted to change the rule. The rule changed because nobody was left to enforce it.
Families: The Same Drift
The developmental psychologist Gerald Patterson spent decades at the Oregon Social Learning Center documenting what he called the coercive family process: A child misbehaves. A parent’s response is inconsistent or the parent eventually gives in to end the conflict. The child learns, correctly, that escalation works. Again, there’s an action and a missed interaction. The child tests the line on purpose; the parent, worn down, fails to enforce the boundary. That fails to stop the next escalation. It also teaches the child which rules are actually enforced.
Something similar is happening on a generational scale. Social psychologist Jonathan Haidt documents it in The Anxious Generation, describing smartphone access as a permission structure no individual parent can maintain alone. As he explains, “When we each act alone and try to say, ‘No, you’re not getting a smartphone,’ our child says, ‘But I'm the only one who doesn’t have one. I’m excluded.’” Once enough families let their kids get smartphones, it’s hard for any one family to hold the line against them for their own children. Common Sense Media's 2025 census found one in four children now owns a phone by age 8, a boundary that would have looked unthinkable to most parents a decade ago but barely raises a question today.
Society: The Boundary and the Reversal
California shows us an example of drift with a documented before, a documented after, and a natural experiment in between.
In 2014, Proposition 47 reclassified theft under $950 as a misdemeanor. UC Irvine criminologist Charis Kubrin found that the arrest rate for reported theft fell from about 15% in 2013 to 6.6% by 2022. More than nine in ten reported thefts resulted in no arrest at all. Nothing in the statute told police to stop making arrests, Kubrin noted. What changed was a slow breakdown between police and the community. When their theft reports went nowhere, retailers learned that the line against theft didn’t mean much anymore. A 2025 National Retail Federation survey found 64% of retailers now report less than half their theft incidents to police, citing an insufficient law enforcement response as the top reason.
In 2024, California voters passed Proposition 36 with 68% approval, restoring felony accountability for repeat theft offenders. The line didn’t drift back on its own. It moved because voters wanted it enforced again.
What Stops Permission Drift
Closing a permission structure gap, as I wrote in the earlier piece, is a discipline of design: deciding in advance what a system should be allowed to do. Stopping permission drift is a different discipline. It has less to do with writing the rule well and more to do with making sure somebody is still maintaining that rule.
Name the line — and its owner. A written policy with nobody specifically accountable for enforcing it is a permission structure waiting to drift. Boeing’s delegation program had procedures. What it lost, gradually, was people positioned to enforce those procedures against the interests of the people they reported to.
Take the first violation seriously. Keizer’s data isn’t subtle. It took only a single unaddressed act of visible disorder to affect behavior. Don’t wait to address broken boundaries. Your people are paying attention to these moments when enforcement fails to happen.
Don’t leave the post empty. A vacant compliance role. A police department that stops sending officers to theft calls. Each situation looks, in the moment, like a staffing problem. But something deeper is happening: a permission structure losing the one thing that was holding it in place.
The Rule Is Never What Holds the Line
The person enforcing the rule is.
An AI system trained on a frozen set of values can’t feel a permission structure shift, because the structure was never alive for the system to begin with. Humans have exactly the capacity AI lacks: We can feel a boundary being tested and choose whether to respond or let it pass.
I'd love to hear where you’re seeing this in your own organization. If a permission structure is drifting and you’d like to think through where to plant the flag again, I’d welcome a conversation. Book a 30-minute Insight Call with me.
