The Capacity We Spend Before We Need It

06:00, shift briefing. 06:17, pre-start checklist. 07:05, the first production issue of the day. 08:10, a safety alert. 09:00, a meeting. 10:23, a permit that needs revising. 11:40, another checklist. 12:15, a KPI discussion. 13:06, an alarm — nothing serious, reset. 13:48, another approval.

None of these things is necessarily wrong. Most of them exist for a reason, and some of them are essential.

Then comes 14:37, and something changes. Not dramatically. A vibration that was not there yesterday. A smell that somehow does not belong. A machine cycle that lasts a fraction longer than usual, or a colleague's movement that simply looks wrong. Nothing has failed yet. There is no red light announcing accident in thirty seconds, and there is no box on the checklist that says tick here if reality suddenly feels slightly different.

And at that moment, after almost nine hours of being instructed, informed, alerted, measured, interrupted, checked and asked to confirm, the system suddenly needs something it cannot fully write into a procedure. It needs a human being who can notice, interpret, doubt, judge, speak and act.

Perhaps the question is no longer only whether this worker was properly trained. There may be another one, and it is more uncomfortable:

How much of the human capacity we needed at 14:37 had our own system already spent by 14:36?

I did not arrive at this question through the literature. I arrived at it on a Wednesday, many years ago, when I was a production trainer on a brand-new line. Everything was new at the same time: the line, the people, the work instructions, and rules that seemed to change almost every week. That day I had spent hours filling in documents and checking operators, making sure everyone was doing what the new standards required. In a sense, I had been doing safety all day long. And at the end of the shift I simply forgot one of the most elementary steps of all: stopping the carousel as the instruction required. Not because I didn't know it — it was a step I taught others. I forgot because, by then, there was very little of me left to remember with. It was my colleagues who called after me as I was leaving for home, reminding me not to forget to stop the carousel. What caught the gap that afternoon was not a checklist or a document, but people who still had some attention left. No course had taught me what that afternoon did: a system can be busy with safety all day and still run a person out of the capacity safety depends on.

Where this series has been going

In The Worker Who Arrived Today I suggested that competence may be relatively stable while available human capacity is not — that the person who walks through the gate each morning, the Human-as-Arrived, is not always the one our systems imagine. In What Does Safety Train Us to Become? I asked what years inside a safety system leave in a person, and proposed the name safety formation.

This article looks at the space between those two timescales: the hours of a single shift. If human capacity arrives in the morning and is formed over years, it is also spent, minute by minute, through the day. And part of what spends it may be the safety system itself.

People create safety

This is not an entirely new starting point. Decades ago, Sidney Dekker reminded the profession, in The Field Guide to Understanding 'Human Error', that human error should be the beginning of an investigation rather than its conclusion. He took us back even further, to the studies of Fitts and Jones in the 1940s, which showed how apparently irrational pilot errors became understandable once researchers looked at the cockpits, tasks and circumstances surrounding the people involved. Change the environment, and you change the assessments and actions that happen inside it.

The implication was profound. The worker is not an unreliable component operating inside an otherwise safe machine. Safety is created continuously, through the interaction between people, technology, constraints, goals and circumstances. As Dekker puts it, safety is not simply built into a system or bolted on through isolated technical and procedural fixes; people at every level of an organisation actively create it.

Resilience Engineering and Safety-II developed that idea further. Provan, Woods, Dekker and Rae distinguish between centralised control, in which safety tries to predetermine what safe work should look like, and guided adaptability, in which organisations also develop people's ability to respond safely to conditions that emerge in real work.

Recent evidence makes this remarkably tangible. In a 2026 study at a petrochemical facility, Ashraf, Peres and Sasangohar used hard-hat cameras to follow operators through 1,422 procedural steps. About a third of those steps (32.9%) differed in some way from the written procedure — and yet every single task was completed successfully. When the researchers asked experts and the workers themselves why, three kinds of adaptation emerged: routine ones, efficiency ones, and — the ones that stayed with me — safety adaptations, where operators added checks the procedure never asked for. The workers' own phrase for it was "trust but verify".

Variation, in other words, was not simply a failure to comply. Much of it was people helping the work succeed, and sometimes adding safety that the paper had left out.

Which raises a question. If people continuously contribute attention, judgment and adaptation to make safety possible, what exactly are they contributing? And who is protecting it?

The invisible safety resource

We monitor many resources in safety: training hours, PPE, machine guarding, inspection frequency, emergency equipment, headcount, competency matrices, corrective actions, budgets. But there is another resource present in almost every successful operation that rarely appears on any balance sheet — the human capacity to deal with what was not entirely predicted.

For now, I propose to call it Human Safety Capacity: the context-sensitive human capacity available to perceive, interpret, judge, speak and adapt in the service of safe work. It is not competence alone, not behaviour, not compliance, and certainly not some mysterious quality possessed by the mythical "good worker". I see at least five dimensions in it.

Attention — can I notice what matters among everything competing for my attention?

Sensemaking — when something changes, can I understand what may be happening, rather than simply matching it to a familiar category?

Judgment — can I decide what the situation requires when rules, objectives and signals point in different directions?

Voice — can I say something is wrong, I don't understand this, stop, or even the procedure does not seem to fit what is happening here?

Adaptive agency — when reality departs from the expected scenario, can I act responsibly, rather than wait for the system to tell me what to do?

We usually file these under human factors, non-technical skills or resilient performance. But perhaps we should look at them differently. Perhaps they are not merely characteristics of the human being inside the safety system.

Perhaps they are part of the safety infrastructure itself.

Safety can protect capacity. It can also spend it.

I am not arguing against procedures — quite the opposite. A well-designed procedure frees human capacity by removing unnecessary demands on memory. A checklist protects attention from forgetting routine but critical steps. Automation can reduce workload, and a clear standard stops people from solving, again and again, problems that design should already have solved. Training can widen someone's ability to recognise weak signals, a psychologically safe conversation can strengthen voice, and a good supervisor can create the conditions in which judgment grows. Safety systems can build capacity.

But the opposite can happen too. Human cognitive resources are not unlimited, and industry takes this seriously enough that a 2025 integrative review found 146 studies on assessing cognitive workload for safety management, most of them from high-risk industries. The less intuitive part is that the danger runs in both directions: Young and Stanton showed that mental underload can also shrink the attention available to us, not only overload. A day that is simultaneously fragmented and monotonous may be the worst combination of all.

And in 2026, research on safety clutter — a term introduced by Rae, Provan, Weber and Dekker in 2018 — went a step further. Working in construction, Raheemy, Hallowell, Lingard and Sherratt described clutter as the waste within safety effort: work that consumes time and resources without improving safety. One of their conclusions is that decluttering protects capacity for the safety work that actually prevents serious injuries and fatalities.

That should make us uncomfortable. It means an activity can carry the label safety and still compete with safety.

Two ledgers

Perhaps every safety intervention should therefore be read through two ledgers.

The first is the one we know well — the ledger of protection. What risk does this control reduce? Here we examine barriers, severity, probability, exposure and compliance.

The second is rarely opened — the ledger of human capacity. What does this intervention require from the people who must live with it? And over time, what does it strengthen, and what does it consume?

Think about how this plays out. An alarm can communicate danger; ten meaningful alarms can give an operator situational awareness; hundreds of low-value alarms begin to compete for the very attention they are meant to direct. A procedure can support judgment, while an excessively rigid one may, in some environments, slowly teach people that judgment will never be required. A reporting system can improve learning, but a reporting system associated with blame gradually consumes voice. One KPI can reveal a weak signal; forty dashboards can bury it. And a supervisor who verifies that work is under control is doing his job, while a system that demands approval for every minor decision may be quietly communicating: do not think until authorised.

None of these outcomes is automatic, and that distinction matters. The argument is not that procedures are bad, or that control is bad. The argument is simply this:

No safety intervention should be assumed to have zero human-capacity cost.

When punishment consumes voice

Dekker gives an especially clear illustration. Discussing punishment after failure, he argues that fear does more than create an unpleasant culture: it changes the flow of safety information. People become less willing to bring bad news upward, and the organisation learns less about what is actually happening.

Through the lens proposed here, we could say it slightly differently. Punishment did not merely affect the culture. It consumed voice — and voice was one of the resources through which the organisation created safety.

This matters, because a company can have excellent procedures, beautiful standards, sophisticated dashboards and strong audit results while it progressively destroys people's willingness to say I made a mistake, I nearly lost control, or something doesn't feel right. The formal safety system may look stronger every year, while its real human capacity is quietly weakening.

Permission to judge is not the capacity to judge

In May 2026, Martijn Flinterman asked in an essay whether safety professionals are enabling judgment or merely enforcing execution. Drawing on the sociologist Hartmut Rosa, he describes a wider shift in modern life from acting — through experience, responsibility and situational judgment — towards executing protocols, algorithms and increasingly sophisticated systems. His point is not that standards are unnecessary, but that excessive standardisation can remove the very room in which responsible judgment develops.

I explored the long-term side of this in my previous article. Here I want to add a narrower distinction: between having permission to judge and still having the capacity to judge. A person who has spent years being told exactly what to observe, which box to tick, when to escalate and who is authorised to decide may one day be given freedom — and discover that freedom alone does not immediately restore judgment. Human capacities can be trained. They may also be deconditioned by disuse. That remains a hypothesis worth investigating, not a conclusion we should pretend is already established. But it is precisely the kind of question safety should be asking.

The Human Capacity Test

What would this mean in practice? Perhaps, before adding another layer, we could ask five additional questions.

What risk does this intervention reduce? If we cannot answer clearly, why are we adding it?

What human capacity does it require? Attention, memory, judgment, time, interpretation, communication?

What human capacity does it strengthen? Does it help people recognise danger, build shared understanding, develop judgment, make it easier to speak up?

What capacity might it quietly weaken or consume? Could this alarm feed alarm fatigue? Could this reporting requirement bury weak signals under administrative volume? Could this approval process erode local ownership? Could this investigation make people less willing to report the next near miss?

What capacity remains when something happens that the control did not anticipate? This may be the most important question of all, because sooner or later reality produces something that was not in the slide deck.

Back to 14:37

The vibration is still there. The procedure has not changed, no rule has been broken, no alarm has crossed its threshold, and the machine is technically still running. But the experienced operator beside it feels something.

Perhaps this is exactly where safety stops being something the organisation has and becomes something people create. Dekker argued that progress requires us to open the black box of human performance — to understand how people make complex systems succeed, and how that success can break down. Perhaps there is another black box worth opening. Not only how do people create safety?, but:

What does the safety system itself do to the human capacity required to create it?

This changes something fundamental. The human being is no longer only the person safety must protect; the human being also carries part of the capacity through which protection becomes possible. The relationship becomes circular: the safety system shapes human capacity, human capacity helps create safety, and that experience shapes the next safety system. Which gives safety another responsibility — not merely to use human capacity, but to steward it.

Safety Capacity Stewardship

Perhaps this is the principle underneath everything above. I would tentatively call it Safety Capacity Stewardship: the responsibility of a safety system to protect, develop and wisely use the human capacities on which safe performance depends.

Attention should not be treated as free. Voice should not be treated as guaranteed. Judgment should not be treated as something people magically possess after training. Adaptive capacity should not be treated as inexhaustible. And compliance should not automatically be mistaken for capacity.

Sometimes the safest worker is the one who follows the procedure exactly. Sometimes the safest worker is the one who recognises that reality has moved outside the assumptions on which that procedure was written. The difficult work of safety is knowing the difference — and making sure people still have enough left in them to tell.

Maybe our question has been incomplete

For decades we asked how to stop humans from making mistakes. Many of us then learned to ask a better question: how do we design systems in which mistakes do not become disasters? Resilience Engineering pushed us further, asking how people make work succeed despite complexity and variability. Perhaps there is now one more question worth adding:

How do we protect and develop the human capacity through which that success is created?

Because one day — perhaps at 14:37 on an otherwise ordinary Wednesday — the procedure will reach the edge of what its authors could predict. The dashboard will not know yet. The KPI will learn tomorrow. The investigation may understand next month. But someone will be standing beside the machine now, and between the weak signal and the accident there may be only a few seconds of human attention, experience, doubt, judgment and courage.

We should be very careful what we spend before that moment arrives.

Because at 14:37, the system may need what it spent at 14:36.