Carrying the Fire: Wildavsky, McCarthy, and What Resilience Is For

I did not finish The Road in one sitting. I did not finish it in twenty sittings. I read, but I had to stop after about 10 minutes every time because my son’s face had replaced the boy’s on every page.

McCarthy gives the boy no name. He is simply “the boy” — a child walking south through ash with his father, pushing a shopping cart that holds everything they own. The world has ended. The cause is never named and doesn’t matter. What matters is that a father is trying to keep his son alive in a landscape where every system — electrical, agricultural, social, moral — has been destroyed. And the boy trusts him. Completely, without reservation, with a trust that assumes the world must still contain goodness because his father says it does.

It is a trust I know, and one I have felt and feel with my own two sons. I put the book down, walked to Alois’s room, and stood in the doorway. He was asleep. I heard him breathing. Two and a half years old. I stood there longer than I needed to. Then I went back to the book.

I read books for this journal to gain structural insights into governance and systems, and to rekindle my love for literature and philosophy, even though philosophy is no longer what I do for a living. I write about how complex systems fail, how institutions respond, and how practitioners navigate the distance between frameworks and operational reality. The reading is analytical, and the writing that follows is often measured. This is how the writing works. This time, a book found me, and I was touched.

What follows is not an abandonment of the objectives I set out for myself and this journal. McCarthy’s father is, when stripped to the bone, still a governance practitioner. He is someone responsible for another human’s survival in a world where every institutional scaffolding has collapsed.

Aaron Wildavsky’s Searching for Safety will provide the theoretical frame to this essay: how do societies that choose between anticipation and resilience as strategies for keeping people safe differ, and what are the trade-offs? McCarthy’s The Road tests that frame at its absolute limit, and Manu Larcenet’s graphic novel adaptation renders the test visible in a register that neither theory nor prose alone can reach.

The question this essay asks is not how to make systems safer. Previous essays have addressed that. The question is more general, and probably more important: what is safety for?

Two Strategies for Safety

Last month, the spire problem showed how visionary ambition can exceed structural capacity — and how custodianship, not mastery, is the relationship we can realistically expect to have with the systems we inherit. The month before, Perrow demonstrated that in tightly coupled, complex systems, serious accidents are structurally inevitable. Both essays left a question unanswered. If accidents are normal, forecasts are unreliable, and systems exceed our comprehension, what do we do? Resign ourselves? Build better models? Do we accept the limits and carry on?

Aaron Wildavsky, a political scientist at Berkeley, recognised the dilemma of the ungovernable and humanity’s inherent weakness in anticipating the future. In Searching for Safety, published in 1988, he opens with a deceptively simple proposition: “There are two bedrock approaches to managing risk — trial and error, and trial without error.” The whole book unfolds from the tension between these two models.

anticipation is what Wildavsky calls “a mode of control by a central mind,” in which “efforts are made to predict and prevent potential dangers before damage is done.” It asks: What could go wrong? and produces precautionary regulation, risk assessments, safety standards, and compliance frameworks. Its logic is prophylactic — identify the threat, build the wall. Forbidding a pharmaceutical drug until its safety is proven is an anticipatory measure. So is every other risk register and every pre-market compliance gate.

resilience is “the capacity to cope with unanticipated dangers after they have become manifest, learning to bounce back.” It asks: When something goes wrong, can we respond? It produces adaptive capacity, distributed experimentation, rapid learning, and organisational flexibility. An innovative biomedical industry that develops new drugs for new diseases is, in Wildavsky’s framing, a resilient device, insofar as it can get new drugs to patients quickly when needed. So is a well-trained incident response team.

Wildavsky does not treat these as equal partners in a balanced portfolio. He argues — with considerable political provocation — that modern societies have overinvested in anticipation at the expense of resilience. The argument is counterintuitive, and he knows it. “The uncertainties are so substantial,” he writes, “that we cannot tell in advance which, if any, among a multitude of hypothesized dangers will actually turn out to be the real ones.” Each wrong prediction is not merely an intellectual error. It consumes resources, triggers regulations, and leaves the society less able to cope with the dangers that actually arrive — the ones no one actually predicted.

He draws a remarkable analogy from ecology. The ecologist C. S. Holling found that ecosystems subjected to extreme climatic conditions, such as high fluctuation or constant disturbance, developed high resilience. More stable, benign environments, he found, produced populations that were “much less able to absorb chance climatic extremes even though the populations tend to be more constant.” Wildavsky draws the policy conclusion from this that “low stability seems to introduce high resilience.” The very thing anticipation seeks to maintain — stability, predictability, control — may erode the capacity to cope when conditions change beyond all prediction.

His core mechanism for resilience is trial and error: the decentralised process by which individuals, firms, and institutions experiment, fail in small ways, learn, and adapt. “True, without trials there can be no new errors; but without these errors, there is also less new learning.” Trial and error is messy, unplannable, and often inefficient in the short term. But it is the process through which societies develop the capacity to cope with the unexpected. When a strategy of “no trials without prior guarantees against error” replaces trial and error, the opportunity to take risks to achieve beneficial outcomes is lost.

The argument carries a further implication that connects directly to the previous essays in this series. Wildavsky states it bluntly: “Richer is safer and poorer is sicker.” Not because wealth buys better prediction, but because wealth increases what he calls the “global level of general resources” — the surplus capacity that makes resilience possible. A society with resources can absorb shocks, experiment with responses, and tolerate the short-term costs of trial and error. A society stretched to its limits cannot. He demonstrates this with earthquake mortality: “The Los Angeles earthquake of 1971 had a low death toll, while the Managua, Nicaragua quake of the following year, though of slightly less magnitude, killed tens of thousands.”

And then comes his most arresting claim. Safety, Wildavsky argues, is not a state that can be achieved and preserved. It is a process. “Safety degrades; it, too, has a half-life. Unless safety is continuously reaccomplished, it will decline, though this may not be known until it is too late.” The title of his final chapter names the paradox: The Secret of Safety Lies in Danger. Safety is not the absence of risk. It is what emerges when risk is engaged, absorbed, and survived. “There is no fixed destination,” he concludes, quoting Herbert Simon, “only a process of searching and ameliorating. Searching is the end.”

This is where Wildavsky’s framework meets its most extreme test.

The Road as Limit Case

McCarthy’s The Road is a world in which anticipation has failed absolutely. Whatever catastrophe destroyed civilisation — the novel offers only ash, dead forests, and a sunless sky — no institution prevented it, no regulation anticipated it, no governance framework survived it. Every system that Wildavsky’s framework assumes as background has been erased.

The novel’s first paragraph establishes the terms: “When he woke in the woods in the dark and the cold of the night he’d reach out to touch the child sleeping beside him.” The hand reaching through darkness. The touch confirms the child, his child, is still alive. This is what remains when every instrument of governance has been destroyed — a body verifying that another body is still there. “His hand rose and fell softly with each precious breath.” My own son does the same thing in reverse, keeping his hand on me when we sleep in the same bed, ensuring that I remain in place until the dark of sleep takes him.

What they carry is minimal. A grocery cart. A pistol. A tarpaulin. Some scavenged food. What they are is established early with a sentence that functions as the novel’s moral equation: “each the other’s world entire.”

The father operates as pure resilience in Wildavsky’s sense. He adapts moment to moment. Every decision is trial and error: which road to take, which house to enter, when to hide, when to run. He learns from each encounter. There is no centralised authority to consult, no regulation to follow, no framework to apply. His governance is immediate, embodied, and total. He is simultaneously the risk assessor, the decision-maker, the operator, and the one accountable for the consequences.

But McCarthy pushes Wildavsky’s framework beyond what Wildavsky intended, doing so through two scenes that mirror each other.

In the first, the father pries open a locked hatch in the floor of an abandoned house. The boy begs him not to. “There’s a reason this is locked,” the father says. He descends with a lighter. What he finds: “Huddled against the back wall were naked people, male and female, all trying to hide, shielding their faces with their hands. On the mattress lay a man with his legs gone to the hip and the stumps of them blackened and burnt.” People kept as livestock. The boy and father flee.

In the second, the father discovers another hatch, in a garden. Again, the boy begs him not to open it — the memory of the first cellar has taught him what locked doors contain. But the father insists: “This is what the good guys do. They keep trying. They dont give up.” He kisses the boy on the forehead, descends, and finds: “Crate upon crate of canned goods. Tomatoes, peaches, beans, apricots. Canned hams. Corned beef. Hundreds of gallons of water.” He calls up: “I found everything. Everything.”

The two scenes together constitute a pure illustration of trial and error at its most elemental. The same action — opening a locked hatch — produces catastrophic horror in one instance and salvation in the next. The father has no way to predict which. He has only the willingness to try, the judgment to read the signs, and the courage to descend. This is Wildavsky’s framework stripped to its most primitive form. “The courage to take a chance,” Wildavsky writes, “is the only way — not of playing it safe, for that is impossible — to play it safer.” I, too, have opened hatches, and I hope to continue finding the courage to open them.

There is a stark difference between the two books: Wildavsky’s resilience assumes a functioning society in which trial and error can operate: markets that transmit information, institutions that accumulate learning, and feedback mechanisms that distribute the lessons of failure. The Road removes all of it. No feedback loops beyond the father’s own senses. No institutional memory beyond what he carries in his head. No distributed experimentation: only one path, chosen under pressure, with no way to know whether the alternative would have been better.

And there is a cost. Resilience without institutional scaffolding is bare survival, not safety. The father keeps his son alive, but he cannot keep him well. After the cellar, the father looks into the boy’s face, “and very much feared that something was gone that could not be put right again.” Each trial leaves its mark. The boy is learning that the world contains horrors his father cannot prevent, only flee. The father’s resilience maintains biological continuity, but cannot maintain innocence.

McCarthy measures this cost in a passage of extraordinary bleakness. The father stands in a ruined living room and sees “for a brief moment the absolute truth of the world. The cold relentless circling of the intestate earth. Darkness implacable. The blind dogs of the sun in their running. The crushing black vacuum of the universe. And somewhere two hunted animals trembling like groundfoxes in their cover. Borrowed time and borrowed world and borrowed eyes with which to sorrow it.”

Against this, the boy’s question. Over and over, throughout the novel, in different forms: “Are we still the good guys?” It is, beneath its surface simplicity, a governance question. In the absence of institutions, who defines moral order? The father carries it forward the only way available to him: by example, by memory, by assertion. “Because we’re carrying the fire.” The boy accepts this. “And we’re carrying the fire. Yes.” But the fire is never defined. It is the irreducible thing — the commitment that makes survival worth the suffering. Without it, the father would be the same as the men in one of the roaming bands that have abandoned the distinction between survival and destruction.

The wife understood this and rejected it. In one of the novel’s most devastating passages, the father remembers her telling him: “A person who had no one would be well advised to cobble together some passable ghost. Breathe it into being and coax it along with words of love. Offer it each phantom crumb and shield it from harm with your body.” She sees what the father is doing — maintaining a commitment to goodness in a world that no longer supports it or rewards it — and considers it a form of futile madness. She walks into the dark and does not return.

The father’s answer to her is not an argument. It is the rest of the novel. He keeps going. He carries the fire.

What Ink Reveals

McCarthy’s prose style does some of this work through omission. No quotation marks. Sparse punctuation. Biblical cadence. The ash-covered landscape is rendered in sentences that themselves feel scoured, stripped of ornament, reduced to function. The prose enacts the condition it describes.

Manu Larcenet’s graphic novel adaptation of The Road does something that neither McCarthy’s prose nor Wildavsky’s theory can do: it makes the devastation simultaneous. McCarthy’s destruction unfolds in time — sentence by sentence, scene by scene — as the reader accumulates the loss. Larcenet renders it in a single frame. A road vanishing into dark mountains with two figures barely visible against the emptiness. Ruined infrastructure. Ash-flecked sky. The eye takes in the entire landscape at once. There is no temporal sequence, no unfolding argument. The totality of system failure is immediate and complete.

But Larcenet’s real achievement is in the compositional language of protection. The father’s body — hunched, angled, always between the boy and whatever lies ahead or behind — shows him continuously shielding his son. His posture is governance: the physical positioning of a body between threat and vulnerability. Seen from behind, pushing the cart, the father’s silhouette creates a boundary, a perimeter, a system of one. The boy walks beside him, smaller, trusting the direction. McCarthy achieves this through rhythm and implication; Larcenet renders it visible in ink: the ratio of grey to dark, the size of the figures against the emptiness, the way the eye moves across a panel — scanning the horizon for danger, then landing on the boy, drawn with a tenderness that the surrounding desolation makes almost unbearable.

Larcenet does not add to McCarthy. He translates the things not said. And in this translation, certain things become visible that had to remain implicit in the original. The body language of custodianship. The visual weight of a world that has failed its inhabitants. The radical disproportion between the scale of the loss and the smallness of what endures.

For Practitioners

Wildavsky’s framework, tested against McCarthy’s limit case, reinforces what this series has been building toward: design systems that fail well, not systems that never fail. Build resilience into people, not just procedures — the father in The Road has no runbook, only judgment, attention, and the willingness to descend. Accept that anticipation has limits and invest in the capacity to cope with what prediction cannot reach. These are Wildavsky’s operational lessons, and they are sound. But McCarthy asks a harder question.

What is the system for?

Every governance framework risks becoming an end in itself. The compliance function exists to serve compliance. The audit programme that measures auditability. The risk register that manages the risk of having an incomplete risk register. ISO 22301 ensures business continuity — but continuity of what, and for whom? NIS2 protects essential services — but what makes a service essential? The answer is always, at bottom, the same: people, love, the future. The next shift of operators. The patients who depend on the pharmaceutical supply chain. The households whose water arrives treated and safe. The children who will inherit whatever we maintain or allow to decay.

The previous essay introduced custodianship — the relationship we have with systems we did not build and cannot fully comprehend. McCarthy deepens the concept. Custodianship is not just maintenance. It is maintenance animated by purpose. The spire stands because seven centuries of custodians tended it, but it also stands for something: a community, a tradition, a set of commitments that outlasted any individual custodian. Without the fire that continues to animate it, the spire is just stone.

McCarthy’s radical simplification is a corrective worth revisiting periodically: strip away every institutional layer, and what are you actually protecting? If you cannot answer that question with a concrete noun — a patient, a community, a water supply, your son — the framework may have lost contact with its purpose.

The Fire

This essay started differently from those that came before it. The analytical distance that normally governs my writing here collapsed for a few hundred words. The book won momentarily. Some books do not permit the usual distance. The Road is one of them. It reaches past our normal subjects, and finds something prior to all of it: the fact that we, that I, do this work — the reading, the writing, the building of systems, the tending of complex and fragile architectures — because there are people on the other side of the system. Small, trusting, dependent, and asleep in the next room.

Wildavsky gives us the framework: resilience through adaptive capacity, trial and error, the insight that safety degrades and must be continuously reaccomplished. The learning of children. McCarthy gives us the stakes: what happens when every framework fails, and only the fire remains. Larcenet gives us the image: a father’s body angled between the unpredictable emptiness and the child.

The novel’s final paragraphs describe brook trout that once lived in mountain streams — McCarthy’s elegy for everything the fire is trying to preserve, the irreducible thing, prior to governance, prior to frameworks, prior to any system we might build. The thing that makes building worth the effort.

On their backs were vermiculate patterns that were maps of the world in its becoming. Maps and mazes. Of a thing which could not be put back. Not be made right again.

— Cormac McCarthy, The Road

The fire is not a metaphor for governance or morality. It is what it is for. Without it, we, I am maintaining systems to maintain systems — a custodian without a charge, carrying nothing. The boy asked his father whether they were still the good guys. His father said yes. He said they were carrying the fire. It is worth asking ourselves the same question. And it is worth being able to answer it.

Extended Reading & Watching

• Wildavsky, Aaron. Searching for Safety. Transaction Publishers, 1988.
• McCarthy, Cormac. The Road. Alfred A. Knopf, 2006.
• Larcenet, Manu. The Road: A Graphic Novel Adaptation. Dargaud, 2024.
• Children of Men. Dir. Alfonso Cuarón, 2006. A world where no children have been born for eighteen years — where the future has stopped and the fire has no one to carry it to. The ceasefire scene, in which soldiers stop shooting at the sound of a newborn’s cry and then start again, is safety achieved and lost within two minutes.
• Chernobyl. Written by Craig Mazin, HBO, 2019. The safety test that caused the disaster it was designed to prevent — anticipation destroying itself at nuclear scale. The final episode’s question, “What is the cost of lies?”, is the institutional version of the boy’s question: are we still the good guys?
• Leave No Trace. Dir. Debra Granik, 2018. A father and daughter survive in the woods with no institutional scaffolding — pure resilience, pure trial and error. When the daughter chooses community over survival, the film finds the limit Wildavsky’s framework does not reach: the point where carrying the fire becomes a prison.
• Sidney Dekker. Safety Differently. Dekker’s short case for studying what goes right rather than what goes wrong — the practitioner’s version of Wildavsky’s argument for resilience.