The Four Laws of System Design for Computational Law

The framework

The Four Laws are design rules for software that does legal work. Ross Brodskiy first stated them on Medium in April 2026 (the original essay) and later restated them, each tied to an enforceable control, in the isResponsive paper. The name deliberately borrows from Asimov's laws of robotics: these are construction rules for machines, not statutes, and they bind no court. Their claim is blunt. A system that violates any of them is, in the essay's words, "defective as a matter of design."

The laws are ordered. A lower-numbered law prevails over a higher-numbered one, so the Zeroth Law outranks all the others and the Third Law yields to the three above it. The wording below follows the isResponsive statement.

Zeroth Law: no unwarranted confidence. "No output may be presented with greater confidence than the system can defend. Uncertainty must be surfaced, not smoothed over. A refusal is always preferable to a fabrication." The reason is specific to law. Outputs get filed and cited, so a plausible answer that cannot be defended is worse than no answer: someone will rely on it. Computational law cannot afford the graceful degradation that other domains tolerate.

First Law: full explainability. "No output may be produced that the system cannot explain. Every result must be traceable, on demand, to its inputs, reasoning, and supporting authorities." Lawyers are right to extend zero default trust to a machine. Trust is earned through a reasoning chain that someone else can reconstruct.

Second Law: grounding in validated authority. "All legal propositions surfaced to the user must be grounded in validated authority retrieved through the Knowledge Graph, except where such reliance would conflict with the Zeroth or First Law." The source of law is a curated, validated store of authority, not the model's training data and not doctrine the model reconstructs from memory. The isResponsive paper puts the division of labor plainly: the model may classify against a rubric, but it may not become an unsupervised source of law.

Third Law: testable, versioned reasoning. "All reasoning components must be independently testable and version-controlled, except where such isolation would conflict with the higher laws." Reasoning steps are first-class assets. Each can be run against fixed inputs, each consumes versioned artifacts, and each can be verified in isolation, so a change in behavior is a change someone made and logged, not drift.

What precedence means in practice

Precedence settles conflicts that real systems run into:

1. A validated authority exists, but the system cannot explain why it applies to this question. The First Law beats the Second: the authority is not offered as the answer.
2. A grounded, explained answer would still claim more than the evidence supports. The Zeroth Law beats both: the system reports the uncertainty or declines.
3. Isolating a component for testing would hide part of its trace. The First Law beats the Third.

In the isResponsive setting the Zeroth Law becomes a statistical rule. The system may certify a document review as complete only when the lower confidence bound on recall clears the target, not when the point estimate looks good. When the bound fails, the correct output is a refusal to certify.

How to apply it

A user asks a research system: "What is the pleading standard for a demurrer in California?" Walk the question down the stack.

Zeroth Law. Before answering, the system must know what it can defend. The question names California but not the court the case is in. If the action has been removed to federal court, the demurrer becomes a Rule 12(b)(6) motion and the standard changes with it. A system that cannot tell which court the motion is in says so and asks, rather than guessing. That is not unhelpfulness. It is the law working.

Second Law. The answer must come from validated California authority. A general demurrer under Code of Civil Procedure section 430.10(e) asks whether the complaint states facts sufficient to constitute a cause of action, and section 425.10(a)(1) requires a statement of the facts constituting the cause of action: California is a fact-pleading jurisdiction. Under Blank v. Kirwan (1985) 39 Cal.3d 311, a demurrer admits material facts properly pleaded but not contentions, deductions, or conclusions, and leave to amend turns on whether there is a reasonable possibility the defect can be cured.

What the Second Law forbids is the answer a model trained mostly on federal practice tends to write: the plausibility standard of Twombly and Iqbal. Those cases construe Federal Rule of Civil Procedure 8(a)(2) and do not govern a California demurrer. The federal language is fluent, heavily represented in training data, and wrong in this forum (see Twombly Doesn't Live Here).

First Law. Every sentence of the answer carries its trace: which forum the system assumed and why, which authorities it retrieved, and which it excluded. A reviewer should be able to see that federal plausibility cases came back in retrieval and were deliberately set aside because the forum is a California superior court. An answer that happens to be correct but cannot show this path still fails the First Law, because the next answer from the same path may not be correct.

Third Law. The steps that did the work (identifying the forum, selecting the pleading regime, assembling authority) are separate components with their own tests. A fixed regression case, "California superior court, general demurrer," must never return the federal standard. A second case, "same action, removed to federal court," must. When the knowledge graph is updated or a model is swapped, both tests run again, and any change in output traces to a versioned change.

The answer that survives all four laws is short, grounded, and candid about its one assumption: here is the California standard, here is where each sentence comes from, and here is the fact (the forum) on which the answer depends.

Known limitations and critiques

The laws say what, not how. They fix outcomes, not thresholds. "Greater confidence than the system can defend" needs an operational meaning for each task. isResponsive supplies one for document review, a lower confidence bound on recall. Legal research has no agreed equivalent yet, and the Institute's own candidate, the Grayness Score, is still a draft.

Halting collides with demand. Users want answers, and a confident answer feels more useful than an honest caveat. A system that obeys the Zeroth Law will sometimes decline where a competitor answers, and it will look worse in a demonstration. The laws accept that cost without pricing it. Stopping is also a design problem in its own right: in the tiny company experiment, a loop of agents kept running after its authorized work was done because it had never been given permission to halt. Refusal has to be engineered, not merely permitted.

The knowledge graph moves the trust problem; it does not remove it. The Second Law is only as strong as the word "validated." A graph inherits the errors of whoever builds and maintains it: coverage gaps, update latency, misclassified treatment. The citator literature is sobering on the last point. In the study reported in Good Law for What?, three major services agreed that negative treatment existed in only 53 of 357 citing relationships that at least one of them had labeled negative. A system can satisfy the Second Law and still ground an answer in a wrongly validated authority.

Explanations can be manufactured. A trace written after the fact to justify a result satisfies the letter of the First Law and defeats its purpose. The law has force only if the trace records the path the system actually took.

A binary standard for a graded reality. "Defective as a matter of design" works well in an architecture review, but real systems comply partially and unevenly across tasks. The laws do not say how to compare two systems that each fall short in different places.

Not legal rules. The laws are an engineering discipline. They do not define a lawyer's duties, and a system's compliance does not discharge the lawyer's own obligation to verify.