Kepner–Tregoe (KT) — методология рационального анализа, которая разделяет четыре разных типа управленческой работы: разобраться, что происходит; найти причину отклонения; выбрать вариант; заранее увидеть, что может пойти не так.
№78 ТРИЗ сильнее для invention и снятия противоречий; KT сильнее для causal diagnosis, structured choice и implementation risk. №80 TOC ищет системное ограничение; KT помогает диагностировать конкретное отклонение и выбрать действие. №81 IDEF0 моделирует функции системы; KT не моделирует architecture полностью. №82 BPMN описывает поток процесса; KT используется, когда внутри процесса возникла проблема или нужно принять решение.
Хорошо сочетается с №13 Problem Formulation, №23 Uncertainty, №25 Evidence-First, №30 What-If, №36 Formal Solvers, №45 Verification, №46 Observability и №47 Evals. Для AI operations KT особенно полезен поверх traces/metrics: факты приходят из observability, KT организует анализ.
CONTROL PLANE: templates, scoring rules, priority/risk criteria. DATA PLANE: facts, deviations, IS/IS NOT matrix, objectives, alternatives, risks, preventive actions. RUNTIME: может использоваться on-demand для incident/decision support, но не как default request step. OFFLINE: incident reviews, architecture choices, release readiness, vendor/model selection.
Success: facts separated from assumptions; cause hypotheses tested against all known facts; decision alternatives evaluated against explicit objectives; implementation risks get owner/action/trigger. Failure: jumping to favorite cause, fake precision in scores, double-counting criteria, ignoring MUST failures, or using risk analysis as excuse never to act.
KT does not prove causality by itself, invent radically new mechanisms, optimize mathematical objective functions, replace experiments, or determine business values. It structures thinking and evidence use; tests, telemetry, domain expertise and evaluation still decide what is true.
Несколько concerns, непонятно приоритеты и следующий аналитический шаг.
Что-то работает не так, как должно, и причина неизвестна.
Есть несколько вариантов и критерии успеха.
Нужно предотвратить или подготовиться к возможным сбоям реализации.
Revenue, customer impact, safety, legal exposure, SLA, data loss, strategic importance.
Deadline, active outage, expiring opportunity, irreversible window.
Error rate rising, backlog compounding, affected tenants expanding, cost accelerating.
CONCERN PRIORITY Concern: retrieval latency increased Seriousness: medium — p95 misses internal target, but no user outage yet Urgency: high — release rollout reaches 100% tomorrow Growth: high — queue depth rising 18% / hour Action: PA immediately owner: Search Platform
What should be happening?
What is happening instead?
Precise gap whose cause we must explain.
Причина уже встроена в statement и незаметно становится гипотезой по умолчанию.
Object + deviation + observable facts. Причина пока открыта.
| Dimension | IS — где deviation наблюдается | IS NOT — где могло быть, но не наблюдается |
|---|---|---|
| WHAT | Какой объект? Какая именно deviation? | Похожие объекты/отклонения, которых нет. |
| WHERE | Где физически/логически? В какой части объекта? | Где рядом/аналогично, но всё нормально? |
| WHEN | Когда впервые? Когда повторяется? На каком этапе lifecycle? | Когда могло проявиться, но не проявляется? |
| EXTENT | Сколько объектов? Насколько велико отклонение? Тренд? | Какие масштабы/частоты не затронуты? |
PROBLEM:
Model response p95 rose from 700ms to 2.4s.
WHAT
IS:
model profile "standard-v4"
IS NOT:
"fast-v2" on same gateway
WHERE
IS:
EU deployment
IS NOT:
US deployment
WHEN
IS:
requests after 14:20 deployment
IS NOT:
requests before 14:20
EXTENT
IS:
long-context requests > 40k tokens
IS NOT:
requests < 10k tokens
DISTINCTIONS:
standard-v4 + EU + new deployment + long context
CHANGES:
new serving config at 14:20
KV-cache policy changed only on EU standard pool
POSSIBLE CAUSE:
new KV-cache configuration causes additional
long-context prefill/eviction overhead.
TEST:
explains WHAT? yes
WHERE? yes
WHEN? yes
EXTENT? yes
NEXT:
inspect metrics / reproduce / rollback one pool
to verify causal hypothesis.
Model version, timeout, parser mode, index parameters, rollout flag.
Tenant, document type, language, context size, traffic source.
Region, host class, browser, OS, provider, network path.
Deployment, migration, traffic shift, dependency update, policy change.
Release, config, dependency, dataset, traffic, provider behavior.
Nothing deployed today, but backlog/data volume crossed threshold.
Each existed before, but only together produce deviation.
If cause is true, what metric/log/state should differ?
Can we recreate deviation by introducing suspected condition?
Does deviation disappear when suspected cause is removed?
Can we explain why comparable unaffected cases remain unaffected?
Classic PA works well when a coherent deviation has a common cause.
If facts do not fit one cause, Situation Appraisal may reveal multiple problems.
Distinguish initiating cause from amplifiers and consequences.
Too broad: unclear timeframe, workload, deployment boundary and what counts as an alternative.
Clear object, use case, environment and decision horizon.
EU data residency, required API capability, budget ceiling, legal requirement, hard availability requirement.
“Fast” is not MUST. “p95 search latency ≤ 150ms at 20M vectors under benchmark X” can be.
Any alternative failing a true MUST is removed before WANT scoring.
If every preference becomes mandatory, no alternative survives and no trade-off can be evaluated.
DECISION: primary vector platform MUST: EU deployment available tenant filtering supported deletion supported max annual infra budget ≤ X benchmark correctness threshold ≥ Y WANTS: operational simplicity weight 10 low p95 latency weight 9 low total cost weight 8 good hybrid filtering weight 8 mature backup/recovery weight 7 easy observability weight 6 low lock-in weight 5
| Objective | Weight | Alt A rating | A weighted | Alt B rating | B weighted |
|---|---|---|---|---|---|
| Operational simplicity | 10 | 9 | 90 | 6 | 60 |
| p95 latency | 9 | 7 | 63 | 10 | 90 |
| Total cost | 8 | 8 | 64 | 5 | 40 |
| Hybrid filtering | 8 | 6 | 48 | 9 | 72 |
| TOTAL | — | — | 265 | — | 262 |
Latency, throughput, cost, recall, availability.
Vendor docs, architecture constraints, verified case data.
Mark confidence and rationale instead of disguising opinion as measurement.
If critical rating lacks evidence, define experiment/POC rather than guessing a 7/10.
Would decision change if cost weight moves from 8 to 9?
What if latency rating is one point lower than benchmark estimate?
What if traffic doubles, model changes, region requirement expands?
Migration failure, vendor lock-in, hidden operational burden, data risk, skill shortage.
Use qualitative/quantitative estimate with evidence and uncertainty.
Assess impact if consequence occurs; consider detectability/reversibility separately where useful.
{
"decision_id": "DEC-...",
"statement": "...",
"date": "...",
"musts": [...],
"wants": [
{"name":"latency","weight":9}
],
"alternatives": [...],
"evidence_refs": [...],
"scores": {...},
"adverse_consequences": [...],
"selected": "B",
"rationale": "...",
"assumptions": [...],
"review_trigger": "traffic > 2x or vendor pricing changes"
}A good decision can still have a bad outcome. Record lets you later distinguish poor reasoning from unforeseeable change and avoid hindsight bias.
Reduce probability: canary, schema compatibility check, capacity headroom, backup verification, permission test, training.
Reduce impact: rollback, fallback provider, traffic switch, disable feature, restore backup, human escalation.
Error rate > 2%, p95 > 1.5s, queue age > 5m.
Migration checksum mismatch, provider region unavailable.
If backfill not 90% complete by 18:00, pause cutover.
Every trigger needs a person/system responsible for contingent action.
PLAN: route 30% traffic from Model A to Model B. CRITICAL AREA: structured tool-calling. POTENTIAL PROBLEM: Model B emits more invalid tool arguments. LIKELY CAUSE: schema adherence differs on long conversations. PREVENTIVE: run tool-contract eval set; validate args deterministically; start at 5% canary; exclude high-risk tool intents initially. TRIGGER: invalid_tool_args > 0.7% OR high-risk schema failure > 0. CONTINGENT: disable Model B route; return affected cohort to A; preserve traces for failure analysis. OWNER: Model Platform on-call. SECOND POTENTIAL PROBLEM: Model A fallback capacity insufficient. PREVENTIVE: reserve capacity / verify quota. CONTINGENT: degrade optional DEEP work, rate-limit noncritical traffic.
DEVIATION:
grounded-answer pass rate fell 91% → 78%.
IS / IS NOT
WHAT IS:
product manuals corpus
WHAT IS NOT:
policy documents corpus
WHERE IS:
documents ingested after parser v3
WHERE IS NOT:
old indexed documents
WHEN IS:
after Aug 28 reindex
WHEN IS NOT:
before reindex
EXTENT IS:
tables-heavy PDFs
EXTENT IS NOT:
text-heavy PDFs
DISTINCTIONS:
parser v3 + new reindex + tables
CHANGES:
table extraction logic changed
chunk boundaries changed
CANDIDATE CAUSES:
A) embedding model degraded
B) parser table extraction loses row associations
C) query router changed
TEST AGAINST FACTS:
A fails WHEN/WHERE distinction:
same embedding used old documents successfully.
C fails WHAT:
same routing across corpora.
B explains all known IS/IS NOT facts.
VERIFY:
compare Document IR;
reconstruct affected table;
reparse with v2;
run eval.
LESSON:
don't optimize vector search before diagnosing
whether source representation is broken.
Finds what actually causes the deviation.
If correction faces a hard contradiction, generate inventive mechanisms.
Select viable concept against objectives and de-risk implementation.
Find leverage point in entire flow.
Diagnose a specific unexpected behavior, choose corrective action, analyze implementation risks.
Extract concerns, draft IS/IS NOT matrix, summarize changes and evidence.
Propose possible causes linked to distinctions and changes.
LLM must mark missing cells as unknown rather than “completing” a plausible story.
Model saying “most likely” is not verification. Test against telemetry/experiments.
{
"problem_statement": "...",
"facts": [
{
"dimension":"WHEN",
"side":"IS",
"statement":"first seen at 14:20",
"evidence_ref":"trace://..."
}
],
"unknowns": [
"whether US pool received same config"
],
"distinctions": [...],
"changes": [...],
"possible_causes": [
{
"cause":"...",
"explains":["WHAT","WHERE","WHEN"],
"fails_to_explain":["EXTENT"],
"confidence":"LOW",
"verification_test":"..."
}
]
}AI assistant may suggest what to measure next, but must not convert absence of evidence into a fabricated IS/IS NOT fact.
{
"decision_statement": "...",
"musts": [
{
"criterion":"EU residency",
"threshold":"required"
}
],
"wants": [
{
"criterion":"operational simplicity",
"weight":10
}
],
"alternatives": [
{
"name":"A",
"ratings":[
{
"criterion":"operational simplicity",
"rating":8,
"evidence_ref":"..."
}
]
}
],
"sensitivity_checks": [...],
"adverse_consequences": [...],
"selected":"...",
"assumptions":[...],
"review_triggers":[...]
}
IS/IS NOT forces candidate cause to fit multiple facts.
Ask explicitly which IS/IS NOT facts candidate cannot explain.
Decision objectives defined before rating alternatives.
PPA makes potential failures and triggers explicit before rollout.
How many mixed issues are decomposed into independently actionable concerns?
Does verified cause explain all critical IS/IS NOT facts?
Incident start → experimentally/observationally confirmed cause.
% decision ratings backed by measurement/reference rather than unsupported opinion.
Does selected option survive plausible weight/rating changes?
Potential problems caught before implementation through preventive actions.
Trigger → contingent action execution time.
Less repeated diagnosis/decision reversal caused by undocumented assumptions.
| Time | Action |
|---|---|
| 0–2 min | Write object + deviation without assumed cause. |
| 2–7 min | Fill WHAT / WHERE / WHEN / EXTENT for IS and closest meaningful IS NOT. |
| 7–10 min | List distinctions between IS and IS NOT. |
| 10–12 min | List changes around distinctions and first occurrence. |
| 12–16 min | Generate possible causes from distinctions × changes. |
| 16–18 min | Test each cause against all known facts. Reject weak fits. |
| 18–20 min | Define fastest safe verification experiment for top cause. |
| Time | Action |
|---|---|
| 0–3 min | Write precise decision statement and horizon. |
| 3–8 min | Define true MUST objectives with measurable thresholds. |
| 8–13 min | Define WANT objectives and relative weights. |
| 13–18 min | Screen alternatives against MUSTs. |
| 18–23 min | Rate surviving alternatives against WANTs with evidence refs. |
| 23–26 min | Run sensitivity: weights/ratings/scenarios. |
| 26–30 min | List adverse consequences of top candidates and make decision. |
KEPNER–TREGOE WORKSHEET =========================================================== A. SITUATION APPRAISAL Concerns: 1. 2. 3. For each: Seriousness: Urgency: Growth: Owner: Next process: [ ] Problem Analysis [ ] Decision Analysis [ ] Potential Problem Analysis B. PROBLEM ANALYSIS Problem statement: OBJECT: DEVIATION: WHAT IS: IS NOT: WHERE IS: IS NOT: WHEN IS: IS NOT: EXTENT IS: IS NOT: DISTINCTIONS: 1. 2. 3. CHANGES: 1. 2. 3. POSSIBLE CAUSES: A. B. C. TEST EACH CAUSE AGAINST: WHAT: WHERE: WHEN: EXTENT: MOST PROBABLE: → VERIFICATION TEST: → C. DECISION ANALYSIS Decision statement: → MUST OBJECTIVES: 1. 2. 3. WANT OBJECTIVES: criterion / weight 1. 2. 3. ALTERNATIVES: A. B. C. SCORES: → SENSITIVITY: → ADVERSE CONSEQUENCES: A → B → C → SELECTED: → RATIONALE: → REVIEW TRIGGER: → D. POTENTIAL PROBLEM ANALYSIS Plan / step: → Potential problem: → Likely cause: → Preventive action: → Trigger / early warning: → Contingent action: → Owner: →
You are assisting with Kepner–Tregoe Problem Analysis.
Rules:
1. Do not propose a root cause immediately.
2. Restate the problem as OBJECT + DEVIATION.
3. Separate facts, inferences and unknowns.
4. Build IS / IS NOT across:
WHAT, WHERE, WHEN, EXTENT.
5. IS NOT must be a meaningful comparable case.
6. Never invent a missing fact.
7. Identify distinctions between IS and IS NOT.
8. Identify known changes associated with distinctions.
9. Generate candidate causes from distinctions and changes.
10. For every candidate, test whether it explains
every important IS / IS NOT fact.
11. Explicitly list facts the cause fails to explain.
12. Rank hypotheses only provisionally.
13. Define the smallest safe observation/experiment
that could verify or falsify the top hypothesis.
14. Do not call a hypothesis a root cause
until verification evidence exists.
You are assisting with Kepner–Tregoe Decision Analysis. 1. Write a precise decision statement. 2. Ask for the decision horizon and scope. 3. Separate objectives into: MUST — non-negotiable pass/fail thresholds; WANT — desirable weighted objectives. 4. Challenge every MUST: is it genuinely mandatory? 5. For every WANT: define measurable meaning where possible. 6. List alternatives without scoring yet. 7. Screen alternatives against MUSTs. 8. Score surviving alternatives against WANTs. 9. Cite evidence for each important rating. 10. Mark unsupported ratings as assumptions/unknowns. 11. Run sensitivity on weights and uncertain ratings. 12. Identify adverse consequences for top alternatives. 13. Recommend only after objectives, evidence and risks are visible. 14. Record assumptions and review triggers.
| Question | Answer |
|---|---|
| Стоит ли использовать? | Да. Особенно для incidents, root-cause work, architecture/vendor choices и rollout risk. |
| Separate Component? | N/A. Это методология/процедура, а не отдельный runtime service. |
| Минимум 80% ценности? | Choose correct KT process; IS/IS NOT for diagnosis; MUST/WANT + evidence + sensitivity for decisions; prevention/contingency/trigger for rollout risk. |
| Когда overkill? | Очевидный баг с уже доказанной причиной, тривиальный выбор, либо ситуация, где нужен творческий invention rather than diagnosis. |
| Trigger? | “We have facts but are arguing about the cause”; “we have options but criteria are implicit”; “we chose a plan but rollout risk is unclear”. |
| Как измерить uplift? | Time-to-verified-cause, fewer repeated incidents, decision reversals, evidence coverage, rollout failure rate and recovery readiness. |
| Можно ли использовать AI? | Да. AI is strong at structuring facts/hypotheses/criteria; it must never fabricate missing IS/IS NOT facts or substitute confidence for causal verification. |
Situation, cause, choice and future risk require different analysis.
Keep hypotheses out of the problem statement.
Diagnostic power comes from meaningful contrast.
Reject hypotheses that fit only the loudest symptom.
KT narrows search; experiment/telemetry confirms.
Non-negotiables screen alternatives before weighted trade-offs.
Do not use numerical tables to hide subjective guesses.
Highest utility score may still have unacceptable risk.
Prevent before; contingency after; owner always.
START
↓
WHAT KIND OF SITUATION IS THIS?
────────────────────────────────────────────
MANY CONCERNS / CHAOS
↓
SITUATION APPRAISAL
list concerns
↓
separate mixed issues
↓
clarify
↓
priority:
seriousness
urgency
growth
↓
owner + next process
────────────────────────────────────────────
UNEXPECTED DEVIATION
CAUSE UNKNOWN
↓
PROBLEM ANALYSIS
EXPECTED
vs
ACTUAL
↓
OBJECT + DEVIATION
↓
IS / IS NOT
WHAT
WHERE
WHEN
EXTENT
↓
DISTINCTIONS
↓
CHANGES
↓
POSSIBLE CAUSES
↓
TEST EACH CAUSE
AGAINST ALL FACTS
↓
MOST PROBABLE HYPOTHESIS
↓
VERIFY WITH:
telemetry
experiment
reproduction
rollback
direct observation
↓
CAUSE VERIFIED
────────────────────────────────────────────
CAUSE KNOWN / NEED TO CHOOSE ACTION
↓
DECISION ANALYSIS
decision statement
↓
MUST objectives
pass / fail
↓
WANT objectives
weighted
↓
alternatives
↓
MUST screening
↓
evidence-based scoring
↓
sensitivity analysis
↓
adverse consequences
↓
select alternative
↓
record assumptions
and review trigger
────────────────────────────────────────────
PLAN CHOSEN
↓
POTENTIAL PROBLEM ANALYSIS
critical step
↓
what could go wrong?
↓
likely cause
↓
PREVENTIVE ACTION
reduce probability
↓
EARLY WARNING / TRIGGER
↓
CONTINGENT ACTION
reduce impact
↓
owner
────────────────────────────────────────────
WITH TRIZ:
KT PA
finds the real cause/conflict
↓
TRIZ
invents stronger mechanism
↓
KT DA
chooses between concepts
↓
KT PPA
de-risks rollout
↓
EVAL / PROTOTYPE / PRODUCTION
verifies real outcome
────────────────────────────────────────────
IN AI SYSTEMS:
OBSERVABILITY
provides facts
KT
organizes diagnosis
TRIZ
helps invent non-obvious redesign
EVALS
measure whether change helped
PRODUCTION ARCHITECTURE
implements safely
────────────────────────────────────────────
THE MOST IMPORTANT KT QUESTION
IS OFTEN NOT:
“WHAT IS THE ROOT CAUSE?”
IT IS:
“WHAT EXACTLY IS DIFFERENT
BETWEEN WHERE THE PROBLEM
IS
AND WHERE IT LOGICALLY
COULD HAVE BEEN
BUT IS NOT?”
THAT CONTRAST
TURNS A WALL OF POSSIBLE CAUSES
INTO A MUCH SMALLER
TESTABLE SET.
A. Related ECC ideas. Context-as-cache, scoped memory, lifecycle hooks, selective capabilities, feature flags, deterministic enforcement, provider-neutral adapters and eval-gated learning are applied only where relevant to №79 Kepner–Tregoe.
B–E. Existing boundary and placement. The existing conceptual boundary, class METHODOLOGY, default N/A and owner Design-time / Problem Solving remain authoritative. Runtime/control/data/offline placement is unchanged; durable state stays outside model context.
F–H. Hooks and contracts. Use bounded PRE_MODEL/POST_MODEL, PRE_TOOL/POST_TOOL, CHECKPOINT and TASK_COMPLETED events as applicable. Illustrative fields and canonical contracts are defined in NEW_CONTRACTS_SPEC.md; no universal schema is implied.
I–J. Security and evaluation. Host-side schema, permission, secret, budget, idempotency and audit checks take precedence over LLM output. Optional mechanisms require a feature flag and WITH/WITHOUT ablation; measure quality, acceptance, correction, latency, cost, escalations and severe errors.
K–L. Task profiles and cross-references. A TaskProfile selects the relevant skill, tool/context slice, memory scope and enforcement profile independently from FAST/STANDARD/DEEP. See cross-reference map, hook spec and ablation plan. Provider adapters remain outside the core.