All systems require some form of enforcement to operate properly. Without accountability or repercussions, actors in a system will greedily pursue their own motivations without much regard for the larger good. This is why we have laws, social norms, rules. They allow complex systems to not descend into self interested chaos.

Inside a corporate system there are three types of enforcement:

1. Culture - the culture (values) causes people to make decisions in the absence of specific direction from leadership, policy or hard coded systems to guide them.

2. Policy - There is a written policy that people adhere to.

3. Technical - The systems are hard coded to allow or prevent specific actions or behaviors.

Culture

Culture can be an effective form of enforcement. Culture is difficult to create and difficult to change. If culture is set inside a company and incentive systems (bonus, promotion, recognition) reward behaviors inline with the culture then a form of enforcement exists. "This is the way we do it here" is a powerful force. The culture creates both formal and informal processes that embed themselves in the fabric of the company.

Policy

Policy comes in two flavors.

1. Strict policy where violation has severe consequences (i.e. termination or legal liability)

2. Soft policy where it is encouraged but there is no real consequence for not following it.

Strict policies, like codes of conduct or HR policies, are well documented and enforced. Violation of them comes with the risk of termination. As a result they have consequences for not adhering to them.

Soft policies are more like guidelines or best practices. Soft policies are everywhere in companies. The prevalence of wikis or tools like Notion make it easy for individuals to create a lot of policy-like content. Many teams will create "policies" or "best practices" or "design principles" in an attempt to enforce some set of values or practices they deem important.

Technical

Technical enforcement is, by far, the most effective. If people are prevented from doing something, there is no need for a policy or culture to do the work. It is, by definition, enforced.

For example, build systems that reject commits that violate some standard (security, perf, bugs) or automated review of user generated content that blocks inappropriate content are technically enforced systems.

Whenever teams are pushing for systemic change I encourage them to try and build systems that technically enforce the change they want. If that is not possible, try to get a hard policy created. If they can only create soft policy then they need to adjust their expectations on the likelihood it will have lasting impact.

Designers get frustrated when they can't get people to change behaviors. For example, a Designer may be frustrated because Engineers are shipping random UI elements into the product. If the culture allows this, i.e. there is no strict policy preventing it and technically nothing stops them then it is next to impossible for change to occur.

Designers will try to create soft policy to try and effect change, to little success. Working groups and internal committees also fall into this trap. Since soft policies have little to no consequences the majority of them fail to take root.

Cultural change is slow and requires the most senior people to commit to the change, model it and reward its behaviors. Bottoms up culture can exist but I haven't seen it be successful without being paired with top down support, policy and technical systems to enforce it.

All systemic change needs to be paired with effective enforcement.