One of the Sidebars^[1] to the Business Agility Manifesto^[2] unabashedly indicts the software industry for its long-standing failure to provide direct support for obligations, an obvious and fundamental aspect of real-life business activity.

8. The software industry has failed to appreciate something fundamental about business activity.  Business is grounded in obligations, which can be violated.  Such business rules require selective reaction to violations (for example alerts or corrective measures) and graded levels of enforcement (all the way from strictly enforced to simply guideline).

Where can you find obligations in business?  Virtually everywhere you look:  acts, laws, statutes, regulations, contracts, MOUs, agreements, terms & conditions, deals, bids, deeds of sale, warranties, guarantees, prospectuses, licenses, citations, certifications, notices — and of course, business policies.

Direct support for obligations is a fundamental capability your organization needs in the Knowledge Age.  What's it about?

Behavioral Rules vs. Decision Rules

In the relevant business rule standard, obligations are behavioral rules^[3] — one of two major varieties of rule.  Behavioral rules govern the conduct of on-going business activity by 'watching' for violations.  Here is an example of a behavioral rule.

A student with a failing grade must not be an active member of a sports team.

This business rule is not about selecting the most appropriate sports team for a student, nor does it apply only at a single point of determination (e.g., when a case of a student wanting to join a team comes up).  Instead, the business rule is meant to be enforced continuously — for example, if a student who is already active on some sports team should let his or her grades fall.  In other words, the business rule is about shaping (governing) the conduct of on-going business activity — that is, ensuring its integrity.

In general, every behavioral rule produces two or more kinds of operational business events where it could potentially be violated or needs to be evaluated.  (I mean produces here in the sense of can be analyzed to discover.)  Unless you start your analysis from the rule, however — and not some process or use case — you'll never achieve consistent enforcement of the rule.^[4]

Behavioral rules need to be clearly distinguished from definitional rules (or decision rules), the other variety of rule.^[5]  Table 1 identifies the fundamental differences between behavioral rules and decision rules.^[6]

Table 1.  Behavioral Rules vs. Decision Rules

	Behavioral Rules	Decision Rules
focus	Operational business governance	Operational business decisions
purpose	Shaping (governing) the conduct of on-going business activity and its integrity	Providing answers for repetitive questions arising in day-to-day business activity
featured kind of business rule	Business rules that can be violated	Business rules that indicate the correct or best outcome for some case
most common original source	Interpretation of some law, act, statute, regulation, contract, agreement, business deal, business policy, deed, license, certification, service level agreement, etc.	Judgments or evaluations made by subject matter experts
role	Prevent situations (states) the business deems undesirable	Ensure consistency of operational business decisions
point(s) of evaluation	Each operational business event where the business rule could be violated	The single point of determination in day-to-day business activity at which an operational business decision is made for a case
most frequent representation	Generally fit no pattern, so usually must be expressed as individual statements (e.g., using RuleSpeak[7])	Generally fall into patterns, so often can be expressed in decision tables
quantity in a typical business capability	A great many	Each decision table has multiple — overall, a great many

Violations and Enforcement

Fundamental to behavioral rules is the assumption that violations can be detected so the rules can be enforced — hopefully in real time — and so the business capability can react promptly and selectively to them.  If you can't detect violations, how can you run the business?!^[8]

There are three fundamental business questions regarding appropriate enforcement of each behavioral rule, as follows.  None of these questions, by the way, apply to definitional or decision rules.

1. How strictly should the behavioral rule be enforced?
2. What message is appropriate when a violation occurs?
3. What business response is needed?

Addressing these enforcement questions intelligently is key to creating highly-agile business capabilities, ones that can evolve rapidly in day-to-day operation.  The remainder of this discussion examines each of these questions in turn.

1. Enforcement Level

How strictly should the behavioral rule be enforced?

Example

Business Rule:  A service representative must not be assigned to good customers in more than 3 states or provinces.

Ask:  How strictly should this business rule be enforced?

Enforcement Level:  Override by pre-authorized actor

The most obvious enforcement levels for behavioral rules are listed in Table 2.^[9]  Don't overlook the last one in the table.  A behavioral rule that is actively evaluated, but not enforced, is (literally) a guideline.  Guidelines are business rules too!

Table 2.  Common Enforcement Levels for Behavioral Rules

Enforcement Level	Description
strictly enforced[10]	Violations are disallowed in all cases — achieving some new state successfully is always prevented.
override by pre-authorized actor	The behavioral rule is enforced, but an actor with proper before-the-fact authorization may override it.
override with explanation	The behavioral rule may be overridden simply by providing an explanation.
guideline	Suggested, but not enforced.

2. Guidance Message

What message should be returned when a violation of the behavioral rule occurs?

When a behavioral rule is violated, somebody — often a business actor directly engaged in a business process — usually needs to know about it.  The violation means the work being conducted has strayed outside the boundaries of what the business deems acceptable or desirable.  From the business perspective some error has been made, so some error message should go to someone.  What should that error message say?

As a default, I like to say that the business rule statement is the error message.  From a business point of view, that equivalence must always be true — what else are behavioral rules about?!  For the service-representative business rule earlier, the appropriate message might therefore simply be "A service representative must not be assigned to good customers in more than 3 states or provinces."

Every guidance message^[11] should be as friendly and as helpful as possible.  More explanation or suggestions can be appended or substituted as desired.  Perhaps a link to other media (e.g., a how-to video) can be provided.  Sometimes the best guidance message takes the form of some icon or signal (e.g., a warning light turning to yellow or red).  In all cases, guidance messages should be made available only to people who are qualified and capable.

3. Violation Response

Does the appropriate violation response for the behavioral rule need to be more selective, rigorous, or comprehensive than simply a message?

Example

Business Rule:  A cursory review of a received engineering design must be conducted within 5 business days from the date received.

Ask:  What violation response is appropriate for this rule?

Violation Response:  The received engineering design must be brought to the attention of the manager of the department by the morning of the next business day.

In general, a violation response can be one or more of some business processes, sanctions, operational business decisions, special notifications, etc.  Real-time violation responses are critical in cases of potential fraud or malicious business behavior.

References

[1]  Sidebar for the Software Industry:  Reconfiguration Agility https://busagilitymanifesto.org/accompaniments/supplements/sidebar-for-the-software-industry 

[2]  The Business Agility Manifesto:  Building for Change, by Roger T. Burlton,  Ronald G. Ross, and John A. Zachman, (2017) https://busagilitymanifesto.org/

[3]  Behavioral business rules are a central notion of the OMG standard Semantics of Business Vocabulary and Business Rules (SBVR).  For more information on SBVR, see SBVR Insider on BRCommunity.com, http://www.brcommunity.com/standards.php?id=620

[4]  An example is worked through on pp 170-174 of Building Business Solutions:  Business Analysis with Business Rules (2nd ed), by Ronald G. Ross with Gladys S.W. Lam, 2015, 308 pp.

[5]  The material that follows is extracted from pp. 170-189 of Building Business Solutions:  Business Analysis with Business Rules (2nd ed).

[6]  Behavioral rules also have nothing in common with inference rules, the central feature of most rule engines and decision management systems (not all) currently on the market.

[7]  Free on www.RuleSpeak.com  

[8]  To say it differently, if you can't detect violations, but you can still run the business, perhaps you don't need the business rule at all(!).  

[9]  from Business Rule Concepts:  Getting to the Point of Knowledge (4th ed), by Ronald G. Ross 2013, 162pp.  Table 12-1 discusses additional enforcement levels.  It also provides tips for designing procedures where behavioral rules are involved (which is just about all of them!).  

[10]  Strictly enforced is assumed as the default enforcement level.  

[11]  Rather than 'error message' (which sounds technical) or 'violation message' (which sounds harsh, especially for guidelines), I prefer guidance message.  

# # #