The system that requires a hero

On the structural fragility of governance that depends on good people

When Commander Vimes of the Ankh-Morpork City Watch learns that Cockbill Street has been without water for four days, he intervenes. This is not policy. The water authority has a repair queue. The Palace has a process. Cockbill Street is somewhere near the bottom of both. What moves it to the top is that Vimes grew up in Cockbill Street, still walks those streets on night patrol, and is constitutionally incapable of accepting that a broken tap in the Shades is a lower priority than a broken tap in the Isle of Gods. By morning, an engineer has been sent. By evening, the water is running. The residents of Cockbill Street are, on this occasion, looked after.

Vimes is presented as a hero in this moment, and he is. The intervention is real, the outcome is good, and the care for working-class Ankh-Morpork that motivates it is genuine. But there is a question that the celebration of the intervention tends to foreclose: what does it mean that Vimes is necessary?

If the water authority’s repair queue would have left Cockbill Street without water for another week, and only the Commander’s personal intervention prevented that, then the queue is broken. The system that routes repairs according to political visibility rather than need is broken. The distribution of political visibility that makes Cockbill Street invisible and the Isle of Gods urgent is broken. Vimes fixed the tap. He did not fix any of those things. And tomorrow, when Vimes is occupied with a murder investigation in the Merchant Quarter, the next broken tap in the Shades will wait.

How it works

A personality-dependent circuit breaker is a balancing loop in a system that only fires when a specific individual is present, aware, and motivated to act. It is a circuit breaker in the sense that it genuinely interrupts a harmful dynamic: Cockbill Street gets water, the crisis is resolved, the cascade that would have followed from continued failure is prevented. It fails as a circuit breaker in three ways that are structurally important.

The first failure is absence. The mechanism requires the individual to be present, to have noticed the problem, and to have the authority and motivation to intervene. Any of these conditions can fail independently. Vimes does not work a single beat; he is responsible for a city. There will always be a Cockbill Street that he has not yet walked down.

The second failure is suppression. Systems can actively resist the individuals who would function as circuit breakers. When an individual with insight and moral agency attempts to surface a problem that the institutional system prefers not to address, the system has mechanisms: reassignment, discrediting, formal censure, marginalisation. The circuit breaker is not absent; it is present and being blocked.

The third failure is the most insidious: the mechanism works well enough, and consistently enough, that it is mistaken for structural function. The system appears to work. The Cockbill Street tap gets fixed. The repair queue appears responsive. Nobody builds the structural mechanism that would fix the queue itself, because the queue appears, from the outside, to be producing acceptable outcomes. The heroism that fills the structural gap makes the gap invisible.

When the loop fails to fire: The 2003 French heatwave

In the summer of 2003, Europe experienced a heatwave of exceptional severity. In France alone, approximately 15,000 people died, most of them elderly people living alone in cities, in buildings without air conditioning, in a country with no heat emergency protocols.

Individual doctors, social workers, and community volunteers had been raising alarms through the first two weeks of August. They were Vimes figures: people close enough to the ground to see what was happening, with sufficient moral investment to act and to report. Their warnings did not move the institutional response because the institutional system had no category for a heat emergency. The Ministry of Health was in summer operation. The relevant ministers were on holiday, as the calendar specified they should be. The mechanism by which individual alarm would have been converted into a national emergency response did not exist. The individual circuit breakers fired. The structural loop did not.

The response after the fact was swift and real. France’s Plan Canicule, developed in the following year, created the structural mechanisms that the individual warnings had been unable to activate: a national alert system, a network of cooling refuges open to the public in sustained heat, mandatory welfare checks on isolated elderly residents conducted by local authorities, a register of vulnerable people for whom proactive outreach would be triggered automatically. These mechanisms do not depend on any individual doctor deciding to make additional visits. They fire structurally, regardless of who holds any particular post. The 2019 European heatwave, which was in meteorological terms more severe than 2003, killed a fraction of the number of people in France. The mechanism built from catastrophe worked. The question that remains is what it would have taken to build it before 15,000 deaths made its absence impossible to ignore.

When the circuit breaker is removed: Falcone and Borsellino

The magistrates Giovanni Falcone and Paolo Borsellino were the institutional circuit breakers in Italy’s effort to prosecute the Sicilian Mafia during the 1980s and early 1990s. They had developed, through years of case-building, a methodology for anti-Mafia prosecution that was not replicated elsewhere in the Italian judiciary: a collaborative investigative pool, shared intelligence, coordinated prosecution strategies, and a willingness to pursue the financial and political connections of organised crime rather than only its operational members. The results they produced were structurally dependent on their presence, their methodology, and their institutional protection.

Falcone was killed by a car bomb in May 1992. Borsellino was killed two months later. Their deaths revealed, with brutal clarity, how much of the anti-Mafia effort had been personalised rather than institutionalised. The investigative pool they had built was not, in the event, a structural mechanism that would persist without them; it was a structure held together by their presence and their relationships. Its continuation required rebuilding around different individuals, a process that took years and never fully recovered the investigative coherence of the original.

The institutional response to their murders was, eventually, structural: the creation of the Direzione Investigativa Antimafia (DIA) and the Direzione Nazionale Antimafia (DNA) attempted to do precisely what the Vimes problem requires, to convert individual methodology into institutional capacity that does not depend on any single person. These structures have had genuine effect. They were built, as the French heatwave mechanisms were built, in the aftermath of a catastrophic demonstration that individual circuit breakers are not enough. The lesson extracted from the catastrophe was structural. Apparently, the lesson required the catastrophe to be extracted.

When the institution suppresses the warning: Dr. Li Wenliang (December 2019 - February 2020)

In late December 2019, Dr. Li Wenliang, an ophthalmologist working in Wuhan, sent messages to colleagues in a private group warning them about patients presenting with symptoms resembling SARS. He was summoned by local police, made to sign a statement acknowledging that his warning had been an illegal disturbance of public order, and instructed to stop making false comments. He contracted COVID-19 in January 2020 while treating patients and died in February.

The Vimes effect in its suppressed form: an individual close to the ground, with sufficient insight and moral agency to see what was happening and the motivation to surface it, meeting an institutional system that had stronger mechanisms for managing inconvenient information than for acting on it. The gap between individual awareness and structural response was not bridged by his warning; it was reinforced. The structural mechanism that would have converted early clinical observations into an early public health response was absent. The individual who tried to act as that mechanism was penalised for attempting to do so.

This is the most fragile version of the personality-dependent circuit breaker. Not merely absent, not merely insufficient at scale, but actively prevented from firing by the institutional system it was trying to protect.

What heroism hides

There is a specific way in which celebrated individual interventions can make structural problems harder to address. When the Vimes effect fires consistently enough, the system it is compensating for appears, from a sufficient distance, to be working. The repair queue delivers. The public health warning is heard eventually. The prosecution is eventually pursued. The outcome is acceptable, or close enough to acceptable that the structural mechanism that would have produced the same outcome without depending on a specific person is never built.

This is not ingratitude. It is a misreading of the evidence. An outcome that was achieved through individual heroism is not evidence that the system is structurally sound. It is evidence that the heroism was necessary. Necessary heroism is a symptom, not a reassurance.

The Netherlands offers a useful contrast. After the North Sea flood of February 1953, which killed 1,836 people and flooded nearly two thousand square kilometres of land, the Dutch response was to build structural capacity that would not depend on any individual’s decision or presence. The Delta Works project took decades and committed the country to a systematic programme of flood defence infrastructure designed to function as an engineered system, not as a managed response. The standard adopted, a one-in-ten-thousand-year flood protection level for the most densely populated areas, was not set by a charismatic individual; it was set by an engineering committee and encoded into national law. The protection it provides does not require a Vimes. It functions regardless of who holds any particular post in any particular institution. This is what structural resilience looks like when a society invests in it: boring, expensive, maintained through budget cycles that do not individually seem urgent, producing outcomes that are invisible because they are the absence of catastrophe.

The succession problem

The personality-dependent circuit breaker has a specific vulnerability at institutional transitions. When the individual, or group of individuals, who has/have been filling the structural gap is promoted, retires, moves on, or loses authority, the gap they were filling becomes visible all at once. The system that appeared to function well reveals that it was functioning well because of a specific person, not because of its structure.

This pattern is observable in public health institutions, in emergency management agencies, in anti-corruption bodies, and in infrastructure regulators across many countries. A director or commissioner who has spent years building informal networks and using personal authority to bridge coordination gaps leaves the post. Their successor is competent and well-intentioned. The informal networks do not transfer. The bridges built on personal authority collapse quietly. It is only when the next crisis arrives that the extent of what was lost becomes apparent.

The Italian Protezione Civile, which performed its L’Aquila earthquake response in 2009 with genuine effectiveness, had been built around structural investment after the Irpinia disaster of 1980. But it had also, over the following decades, accumulated personalised functions in its leadership. When its long-serving director Guido Bertolaso departed in 2010, the institution faced the familiar question of any organisation that had become partly dependent on individual authority: how much of what worked was structure, and how much was person? The answer to that question is only available in the next crisis, which is never a comfortable time to be discovering it.

The right question

Vimes is not the problem. His intervention saves real people and prevents real harm. The problem is the question that his intervention makes it easier not to ask: why does Cockbill Street need Vimes?

A system that works when good people are in post and fails when they are not is not a good system. It is a fragile system that happens to be staffed, at this moment, by people with the motivation and authority to cover its structural gaps. The coverage is real. The fragility is also real. They coexist, which is why the fragility is so easy to miss.

The right question to ask of any governance mechanism that depends on individual virtue is: what would this look like if the virtue were absent? If the answer is substantially worse, the individual’s virtue is doing structural work that the structure should be doing. Celebrating the individual without asking the question is understandable. It is also a way of ensuring that the structure never gets built.

In Ankh-Morpork, the Watch under Vimes works because Vimes makes it work. When he is occupied elsewhere, the Shades waits. The structural inequality that makes the Shades invisible to the repair queue operates between his interventions, undisturbed. He knows this. It is the thing about his city that he cannot fix, and that knowledge is part of what makes him what he is: a man doing individual good inside a structure designed to make individual good insufficient.

That is not a tribute to him. It is a description of the problem.