17. Mars Organizing Principles
Let me start again with the obvious: back then there were no perfect blueprints for building and running a founding city on Mars.
We had fragments — elegant fragments — collected from racing teams, carriers at sea, polar stations, fabs, trauma centers, mines, and rockets that refused to politely wait for the paperwork. Those fragments were invaluable, but Mars made its own weather. We needed a pattern language that could survive dust veils and long latencies, one that would scale from a hundred exhausted builders to a few thousand professionals with families starting to ask sensible questions about schools and parks.
The organizing principles that I share here were in that first century our scaffolding for coordinating our group of a few thousand pioneers.
They were not slogans, nor were they process manuals (those live in the TOM — Target Operating Model — something I will share in a later codex). They were, and in some cases still are, structural rules about power, responsibility, and how decisions flow.
I helped design and implement them at Port Harmonia when our headcount hovered near a thousand and every extra committee felt like another air leak. I write this centuries later with affection for their plainness. They were never fashionable. They were what worked.
♦
Here is the set of organizing principles as we lived it on Mars in that first century at settlement stage one through six (beyond stage six things changed as you will see in the Governance codex):
Three Sovereignties: Technical, Operations, Civic — peer pillars with independent final calls.
One Owner, One Boundary Owner: single-threaded responsibility for systems and interfaces.
Autonomy with Auditability: decide locally; leave crisp tracks in a shared record.
Two Modes, Pre-Wired: Business-as-Usual and Crisis with explicit triggers and roles.
One Language, One Clock, One TOM: shared taxonomy, time-syntax, and operating model.
Two Hats, Kept Current: resilience by cross-qualification, not by idle reserves.
Triggers, Not Politics: scale and reorg by published breakpoints, not personalities.
Three Lanes, One Ledger: pillar-to-Earth interfaces federated, bound by a single record.
Matrix by Charter: joint teams with a single lead and a sunset date — never by default.
Federate with a Spine: towns/outposts run locally under a central crisis and standards spine.
Duty of Care Outside the Line: population services belong to Civic, not production.
Leadership by Warrant: leaders certified for role, termed, and recallable.
What follows are the working meanings — how each principle felt on a dusty Tuesol in Mariix.
♦
Principle #1) Three Organizational Sovereignties
We learned quickly that survival hinged on three different currencies of control. Technical truth — what the physics would tolerate. Choreography — who went where, when, in a finite, pressurised prioritized volume. Legitimacy — governance, permits, medicine, investigations, and the public record that kept the settlement worthy of trust. If you fold those powers into one chain, schedule eats safety for breakfast and technical nuance starves under agenda minutes.
So we constituted three peer pillars. Three equal and specialized pillars.
Technical held configuration baselines, released set-points, owned the “as-built” and the “as-intended,” and answered for the integrity of air, water, energy, and the machines that made them. Operations owned SIMOPS, platform access, pads and airlocks, the master plan and the seasonal windows — our calendar was physical, and Ops kept it honest. Civic carried permits, investigations, medical and public health, earth relations, finance ops, and security.
Civic could stop work; Technical could refuse unsafe configurations; Operations could deny a lift, a bay, a window. Power was equal, responsibility was shared, alignment was structurally necessary.
When a heavy lift overlapped a pressure break in the adjacent gallery, Operations had the casting vote on choreography; Civic set the permit conditions; Technical defined what safe isolation looked like. In crisis, we switched modes (more in a moment). But we never merged the pillars. Incident command unified roles, not ownership. That structural separation was our anti-capture device. It made our arguments slightly longer and our lives much longer.
Within the pillars we made three more deliberate choices.
Manufacture & Maintenance lived inside each pillar — own the asset, own its upkeep — while Supply & Logistics sat squarely in Operations and set the calendar. Formula One and SpaceX taught us this rule time and time again.
Mobility & Flight was the exception that proved the rule: two clocks, one mission. Ops ran the deck; the Earth flight authority held technical safety for vehicles in transit. The handshake between them was ritualised: turnarounds were sacred, and every form and datum used the shared IDs and the common timebase. This followed the proven structure of a century of aircraft carrier air-wing reporting.
Mission Command & Control (MCC) — the nervous system — lived in Operations with Civic co-owning the architectural plumbing of governance and longer-term planning. But day-to-day it was Ops on point and in-charge. The consoles published the posture each sol: windows, outages, permits, alarms. And Civic — quietly, implacably — kept the framing we would someday be judged by.
♦
Principle #2) One Owner, One Boundary Owner
A system without a named owner is a rumor with wiring. We made owners visible. Every major object — reactor, farm loop, rover, bay — had a Service [Maintenance] Reliability Engineer (SRE) and a Manufacturing [Design] Responsible Engineer (MRE). Every boundary had a human name for its interface: mechanical, electrical, software, process. Their names were printed on drawings and Management of Change cards; they signed FRACAS closeouts; they were pinged by MCC when a delta crossed a threshold. Committees could advise; owners decided. When something refused to work, there was a number to call that wasn’t a meeting.
These ‘Directly Responsible Individuals’ (DRIs) made escalation short. A technician flagged a seal face that looked wrong; the cell lead paged the MRE; the MRE grabbed the SRE; the chief engineer agreed to the deletion on the spot — with a rollback plan logged and a permit update if the hazard profile moved. We shaved hours off our problems by knowing who held the pen.
♦
Principle #3) Autonomy with Auditability
Earth was too far away and the dust did not read email. Local teams had to act. But autonomy without trace is just speed without memory.
We enforced a simple pact. If you change something consequential, you log it in the shared system — once. The MoC was lightweight but real: hazard notes, bounds, rollback, owners, timestamp. As-built reconciled to as-designed nightly. Mission Control’s posture board, the permit register, and the MoC log shared one language of asset IDs, hazards, and time. A side channel was a violation; a fix unlogged did not exist.
That discipline gave us two gifts. One: the ability to learn. FRACAS, our failure memory, wasn’t a museum of anecdotes; it linked to the MoC that fixed the fault and the test that proved it. Two: legitimacy. Civic could attest to regulators and funders on Earth that we weren’t improvising our way into catastrophe, and Operations could rely on the record to choreograph safely.
♦
Principle #4) Two Modes, Pre-Wired
Some days were ordinary — if anything on Mars qualifies. Others turned on a hiss in your headset and a single word said twice. We did not want to re-negotiate authority while losing pressure.
So we ran two operating modes with hard triggers and issued role cards. In Business-as-Usual, the three pillars argued, collaborated, and traded. In Crisis, we shifted into a unified incident command. The Incident Commander sat in Civic (life and legitimacy), the Operations Section chief marshalled resources and choreography, the Technical Advisor defined safe envelopes and isolation. Span of control was capped; liaisons to Earth were pre-named; escalation and stand-down were drills as well as doctrines. When the IC declared “return to BAU,” the Integration Cell published posture and residual risk, and corrective actions flowed into MoC and FRACAS with named owners. The Cobra team coordinated.
The trick was not the paperwork. It was the muscle memory. We practiced the switch until rank receded and crisis role remained.
♦
Principle #5) One Language, One Clock, One TOM
Many settlements died on Earth from translation. Mars would be less forgiving. We agreed early to speak one operational tongue. The asset dictionary was shared across pillars; hazards used one taxonomy; geography and zones referenced the same map; time was Marian: sols, windows, quarters, with a single timebase keyed to MCC.
The TOM — the Target Operating Model — held the living “how.” Tiered daily rhythms. Outage and turnaround boards. Permitting forms. FRACAS schema. Handover rituals. External reporting packs. Review formats and the few numbers that truly moved the world. You could argue a rubric in the TOM; you could not invent a private one in a corner of the habitat. The Mars Grid (of space) and Marian calendar (of time) were cornerstones here.
This did not make us slow. It made us interoperable.
♦
Principle #6) Two Hats, Kept Current
We could not afford a fat reserve. We also could not afford to be brittle. Our answer was currency.
Almost everyone carried two hats: a primary craft and a secondary that was adjacent and hands-on. The currency rule was a machine we did not bend: at least twelve hours a month in your secondary, real work or certified simulation, spread over sessions, with a quarterly mini-drill. Lapse your currency and your secondary privileges suspended until you re-qualified. The rostering engine drew from those secondaries to surge Operations for pad days, to bolster Medical & Safety for incidents, to flood Construction for a 72-sol blitz — without collapsing lifeline consoles or MCC.
The result was a settlement that breathed. We surged without creating idle benches, and we discovered unexpected talent. (A certain epidemiologist’s kitting streak became legend and reduced our backlog half-life by a third across one dust season. I still have the chart.)
♦
Principle #7) Triggers, Not Politics
Organizations bloat by anecdote. One loud failure breeds a permanent team; one charismatic manager collects individual contributor orphans; a “temporary” layer persists long after its role has evaporated. We tried something duller and kinder: reorg by trigger.
We published a table of breakpoints — headcount in a function, permit queue ninety-fifth percentile, median age of MoCs, outage collision rate, takt stability, incident load per shift. Crossing a threshold triggered specific changes: add a 24/7 seat; split an area into two; carve a new interface; create a training cell; slow the build to pay the seat bill. Exceptions required a written rationale and a sunset date.
We were not immune to fashion, but the table kept our waistline honest.
♦
Principle #8) Three Lanes, One Ledger
Mars had three conversations with Earth. Technical spoke to design houses and suppliers, asking for analyses, changes, and parts. Operations spoke to mission control and flight authorities about windows, turnarounds, staffing, and choreography. Civic spoke to regulators, funders, and the public about permits, investigations, finances, and the social contract. Each lane needed autonomy; each needed to be auditable.
So we federated those interfaces by pillar and bound them with one record. No pillar could commit another’s envelope. Every commitment landed in the shared ledger with the same asset IDs and timebase. The Integration Cell published Mars’s posture to Earth on a clean cadence. In crisis, the lanes converged under incident communications with Civic in the lead and the other pillars speaking to their counterparts through a single, clear story.
We never eliminated friction with Earth. We prevented it from tearing our threads.
♦
Principle #9) Matrix by Charter
Cross-functional work is either surgical or mushy. To keep the scalpel sharp, we insisted that any joint effort beyond a day’s coordination be chartered. The charter named a single lead and precisely scoped the mission, budget, gates, and decision rights. It named the contributors and their owners. It had a sunset date at birth and a handover checklist for when it ended. Without a charter, you were a helpful visitor.
This let us assemble “war teams” to change out a reactor, replicate a pressure-rated part, stand up a new gallery — and then disband them before they ossified into shadow empires. Line owners kept people, safety, and currency; the chartered lead kept speed and a phone that would always be answered.
♦
Principle #10) Federate with a Spine
As we grew, the temptation to centralise or to fragment arrived like clockwork. Towns and outposts needed autonomy to breathe; the city needed coherence to survive. Our compromise was a spine.
Remote sites operated locally under mini-pillars with their own BAU authority, within the standard taxonomy and timebase. They had local Ops plans and small Civic desks for permits and clinic duty. But crisis authority remained central, standards and records were common, and deviations from the dictionary were not permitted. The Integration liaison at each outpost wore the heaviest pager: they kept the clocks aligned and the records clean.
This federation let us run fast without diverging into incompatible dialects that would later demand expensive translation.
♦
Principle #11) Duty of Care Outside the Line
We learned from offshore camps and hospitals that when production owns care, care loses in the budget meeting. We moved the duty of care outside the line.
Public health, medical services, schooling registries, housing allocation, safeguarding, ombuds — all sat in Civic. Education was delivered in the line functions and registered by Civic for standards and currency; welfare disputes were handled by a process independent of a foreman’s output targets. This was not bureaucracy for its own sake. It was the difference between a settlement and a factory with beds.
The first time Civic denied a permit for an overdue school ventilation upgrade on a busy build fortnight, I recall the silence on the Ops channel. Then the Operations lead cleared a window, and the work was done by midnight. Legitimacy improves throughput in the long run. On Mars, the long run arrived by morning.
♦
Principle #12) Leadership by Warrant
We did not want leaders by inertia, or by the soft tyranny of schedule ownership. We issued warrants. To hold a role — pillar lead, area lead, flight director, incident commander — you needed the warrant for that role: certification against a published rubric, a fixed term, 360° feedback at renewal, and a clean ledger of permits, MoCs, and debriefs. Warrants were recorded by Civic with expiries that did not slide. Acting appointments were timed and reviewed. Conflicts of interest were declared and mitigated in the record.
The effect was subtle. People sought mastery rather than dominion. When recall was necessary for cause — rare but not mythical — the system did not convulse. It shrugged, logged, and moved on.
♦
Where did our first century Mars Organizing Principles come from? Not from poetry. From practice.
[P#1] The three pillars echoed carriers — ship engineering (technical), deck ops (choreography), captain’s legal and safety authority (legitimacy).
[P#2] The single-owner rule owed much to SpaceX and F1, where a component has a name and a phone number, and to semiconductor fabs where a tool with no owner is a downtime generator.
[P#3] Autonomy with auditability combined Muskian “run the test” with the airline and trauma center insistence on trace.
[P#4] Two modes and span caps came directly from ICS and the nuclear navy’s comfort with role over rank. The UK’s Cobra meeting also steered its design.
[P#5] One dictionary/clock was our antidote to Antarctic “station dialects.”
[P#6] Two hats and currency were the hospital solution to rota equity at scale, modified for a place where a missed update can mean a missed breath.
[P#7] Triggers-not-politics learned from cost-cap sports and fabs’ statistically justified staffing.
[P#8] Three swim lanes to Earth mirrored trackside/factory splits in F1 and the clean interfaces between carrier and air wing.
[P#9] Matrix by charter, not by default, was copied shamelessly from turnarounds in refineries and the best of SpaceX “war teams”, and Google’s org architecture ecosystem.
[P#10] Federated empowered spines followed both high-tech business and military norms honed by centuries of empowered frontline command-and-control structures.
[P#11] Duty of care outside the line: a correction learned from offshore camps that tried the opposite and regretted it.
[P#12] Warrants: an old naval trick, repurposed for a young city.
We did not invent much. We assembled and refined with prejudice.
♦
A closing clarity for the archivists among you…
Our twelve Martian org design principles cleanly encoded the best of our MarsX-style plan ownership/speed and high-reliability expeditionary practice.
Principles #1-#2-#3 >> gave us ownership + trace.
Principles #4-#5-#6 >> wire in our cadence, mode, and resilience.
Principles #7-#8-#9-#10 >> enabled us to scale, federate, and integrate with Earth.
Principles #11-#12 >> ensured we protect legitimacy and leadership quality.
With these simple concepts we engineered the organization of several thousand pairs of hands in that founding century to build not only a settlement but the beginning of a multiplanetary species.