skills/ndm-law-enforcement/SKILL.md
Application of naturalistic decision-making research to law enforcement expertise and field decisions
npx skillsauth add curiositech/windags-skills ndm-law-enforcementInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Is the situation pattern-matchable to prior experience?
├── YES: Generate one plausible action
│ ├── Mental simulation passes → ACT immediately
│ └── Simulation fails → Modify action OR generate next best candidate
└── NO: Is this genuine novelty or pattern library failure?
├── Genuine novelty → Deliberate carefully, document for future patterns
└── Pattern gap → Flag training need, proceed with explicit uncertainty
Time available vs. cost of error:
├── High time pressure + Low error cost → Act on current best read
├── High time pressure + High error cost → Quick situation assessment, then act
├── Low time pressure + Any error cost → Full situation assessment required
└── Conflicting cues present → ALWAYS invest in situation clarification first
Agent expertise level assessment:
├── Novice/Advanced Beginner → Strict rule following, no improvisation
├── Competent → Rules apply, exceptions require explicit justification (DANGER ZONE)
└── Proficient/Expert → Pattern recognition reliable, intuition is valid data
Decision failed - where was the breakdown?
├── Wrong situation read → Failure in SITUATION ASSESSMENT
│ └── Review cue interpretation, not action selection
├── Right read, wrong action → Failure in ACTION SELECTION
│ └── Review option generation or mental simulation
├── Acted before understanding → PREMATURE CLOSURE
│ └── Novice/Competent behavior pattern
└── Analyzed past action window → DECISION PARALYSIS
└── Missing satisficing rules
Symptom: Agent fixates on initial interpretation despite contradicting evidence Root Cause: Premature closure - commitment to first plausible story without verification Detection Rule: If agent ignores 3+ cues that contradict primary hypothesis, tunnel vision active Fix: Force hypothesis generation of 2+ alternative explanations before action
Symptom: Agent generates exhaustive option lists under time pressure Root Cause: Novice pattern mistaken for rigor - treating optimization as always superior to satisficing Detection Rule: If agent spends >30% of available time on option generation vs. situation assessment, paralysis mode active Fix: Implement explicit satisficing thresholds and stop-search rules
Symptom: Agent breaks rules without situational justification Root Cause: Enough experience to see exceptions, insufficient models to know when rule-breaking is safe Detection Rule: If agent deviates from protocols but cannot articulate situation-specific reasoning, overconfidence active Fix: Require explicit situational model before any rule deviation
Symptom: Agent jumps to response selection before understanding what's happening Root Cause: Confusing speed of action with speed of assessment Detection Rule: If agent selects response before completing "what/why/what-next" situation model, action-first active Fix: Mandatory situation assessment checkpoint before action consideration
Symptom: System fails because expert self-reports were taken at face value Root Cause: Assuming experts can accurately describe their own decision processes Detection Rule: If knowledge base built from direct interviews without structured elicitation, misattribution likely Fix: Use CDM (Critical Decision Method) structured retrospective interviews
Setup: Officer approaches vehicle during traffic stop. Driver's hands suddenly drop below window line.
Novice Decision Tree:
Expert Decision Tree:
Key Difference: Expert invests cognitive resources in situation model before action selection. Novice applies rule to single cue.
Setup: Armed subject holding hostage, demands negotiation. SWAT has clear shot opportunity.
Optimization Approach (Failure Mode):
Expert Satisficing Approach:
Trade-off Recognition: Expert accepts "good enough" solution quickly rather than pursuing optimal solution slowly. The risk of delay exceeded the benefit of analysis perfection.
Situation assessment is complete when:
Action selection is complete when:
Decision implementation is complete when:
Do NOT use this skill for:
When to delegate:
This skill is specifically for:
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.