Pattern 07 · Before
Capability Disclosure
Before the human hands over control, the machine says what it cannot do and where it will not run, then refuses to engage outside those conditions. Super Cruise offers hands-free driving only on roads GM has mapped.
The mechanism
declare the envelope → re-check while running
- 01Declare the envelopeWhere it works, what it can't see
- 02Check the conditionsIs this one of them?
- 03 · Key momentOffer or withholdEngagement available only inside
- 04Name the blockerSay which condition is missing
- 05Re-check while runningWithdraw when the envelope ends
At 01: Name conditions the operator can recognize from the seat — this road, this load, this weather — not a sensor specification.
At 02: The Tesla had GPS, commercial road data and sign recognition, so it could tell what kind of road it was on. Nothing acted on the answer.
Without / with the pattern
Anti-pattern: Fine Print Limits
Limits in the manual, then Engages anywhere, then Misuse looks like use
The boundary exists in the owner's manual and nowhere in the machine's behavior. At Williston the manual restricted Autosteer to highways and limited-access roads; the firmware placed no restriction on road class at all.
With the pattern
Envelope declared, then Conditions checked, then Engages only inside
The machine holds the line itself, so operating outside what it was built for stops being something an operator can do by accident.
Related patterns
- Precedes · 03Graceful DegradationDisclosure draws the envelope before anything starts; degradation is what happens when the machine reaches that edge while running.
- Complements · 05Shared Mental ModelDisclosure is where the human's model of the machine starts. Keeping it current once the machine is running is the other pattern's job.
- Complements · 11Readiness CheckDisclosure says where the machine will run; this says whether the human it is counting on is actually there. Both are preconditions checked before engagement rather than claims made in a manual.
Sources
The gap this closes is not between what a machine can do and what it says — it is between what it says and what it allows. Tesla's manual was neither wrong nor hidden: it restricted Autosteer to highways and limited-access roads, in a ten-page section carrying sixteen warnings and four cautions.3 The car knew what road it was on, from GPS, map data and sign recognition, and engaged anyway.3 That is why the useful version of this pattern is a constraint rather than a disclosure: a limit the operator has to remember is a limit the operator will eventually forget, usually on a day when everything else is going well. The harder design question is what to do at the boundary, because refusing outright is honest and unpopular, and a system that refuses without naming the condition it is missing just reads as broken.