Startups treat rule-breaking as a virtue, and mostly they are right to. For years, Y Combinator's application asked founders to describe a time they had most successfully hacked a non-computer system to their advantage¹, on the logic that the instinct to route around an illegitimate rule tracks with the instinct to build something new. The canonical wins reinforce it. Uber reinterpreted what a taxi had to be. Airbnb reinterpreted what a hotel had to be². Both looked at a rulebook written to protect incumbents and decided it did not apply to them. Even Paul Graham, who championed that instinct, attached a caveat that does a lot of work: the best founders, he wrote, "delight in breaking rules, but not rules that matter."¹

There is a real pattern underneath the mythology. Draw the quadrant of competent versus not, and rule-following versus rule-breaking, and the competent rule-breakers are the ones who tend to win. They break rules on purpose, they are right often enough to matter, and the breaking is what creates the opening. The skill is not recklessness. It is knowing which rules are conventions and which ones are laws with consequences you cannot undo.

The assumption the playbook depends on

That playbook assumes one thing it never states, and it is easy to miss because in most industries it is always true. The precondition is that breaking the rule is recoverable. The worst case is a lawsuit, a fine, a bad quarter, an angry incumbent. Painful, survivable, sometimes even good publicity. The competent rule-breaker is really running a bet that the downside of being wrong is bounded.

Take that assumption away and the whole calculation changes. When breaking a rule can cause harm you cannot undo, the skill that made someone a great startup operator becomes the thing that gets someone hurt. And there are whole industries where that is the normal case, not the edge case.

In regulated industries, some rules are load-bearing

The useful distinction is not between rules and no rules. It is between rules that are soft and rules that are load-bearing. A soft rule protects a status quo: an incumbent's margin, a team's habit, a process nobody has questioned in years. Break it and something inconvenient happens. A load-bearing rule protects something real and irreplaceable: a patient's safety, the integrity of a controlled-substance supply chain, the confidentiality of data a person never consented to share. Break it and the damage does not roll back.

Healthcare and pharma are where this gets sharpest, because the load-bearing rules are dense and the failures are not abstract. You cannot reinterpret your way out of a controlled-substance requirement the way Uber reinterpreted a medallion. There is no growth-hack framing of a mishandled patient record that makes the exposure un-happen. The rulebook is not there to protect an incumbent taxi lobby. It is there because someone got hurt before it existed.

The real skill is discrimination, not breaking or following

The competence that transfers into a regulated industry is not rule-breaking, and it is not rule-following either. It is the ability to tell the two kinds of rules apart, and then treat them completely differently.

The best operators in regulated domains are ruthless about the soft rules. They kill the process theater, the conservative-by-habit approvals, the "we have always done it this way" gates that exist because nobody re-examined them. They break those precisely so they can move fast enough to earn the credibility and the focus to never break the load-bearing ones. Someone who follows every soft rule out of caution is not being safe. They are being slow for no reason, and slow burns credibility you will need when a real constraint is on the line. Rule-following is a failure mode too, just a less visible one.

The opposite failure: treating every rule as sacred

The over-correction is as dangerous as recklessness, and more common in regulated shops. It is the culture that decides, after one scare, that every rule now carries the weight of a federal statute. Conventions get frozen. Habits get enshrined. The soft rules and the load-bearing ones get the same reverence, which sounds safe and is not, because it drowns the real constraints in a sea of fake ones. When everything is sacred, people stop being able to tell what actually matters, and the discrimination skill atrophies. A team that cannot break a soft rule will eventually mishandle a load-bearing one, because it never built the muscle of telling them apart.

How to tell them apart

For any rule you are tempted to break or blindly keep, three questions do most of the work. What actually happens if we break it: a reversible inconvenience, or irreversible harm, criminal exposure, or loss of the license to operate? Who wrote it and why: a regulator protecting a person, or an incumbent protecting a moat, or a team protecting a routine? Can you get the outcome the rule protects some other way, or is the rule the only thing standing between you and the harm?

Load-bearing rules protect something real, irreplaceable, and hard to reconstruct once broken. Soft rules protect a status quo that will survive being questioned. Most rules are soft. The discipline is refusing to treat the load-bearing minority as if they were soft, and refusing to treat the soft majority as if they were load-bearing.

Where people will push back

"Regulated industries just can't move fast, that's the tradeoff."

That is the myth this argument rejects. The slowness in regulated companies is mostly self-inflicted, spent on soft rules that could be broken freely. The load-bearing rules are a small set. A team that clears the soft ones aggressively has more speed to spend, not less, and more attention left for the constraints that actually bind.

"You're just describing compliance with extra words."

Compliance tells you the load-bearing rules exist. It does not tell you which of your other thousand conventions are fake, and it tends to make everything feel mandatory. The discrimination skill is the opposite of a compliance checklist. It is the judgment a checklist cannot encode.

"Encouraging any rule-breaking in healthcare is irresponsible."

The argument encourages breaking soft rules and never load-bearing ones, and it treats the ability to tell them apart as the actual safety mechanism. A culture that cannot distinguish is the unsafe one, because it either breaks everything or freezes everything, and both eventually hurt someone.

When this does not apply

If you work in a domain where the worst case of any broken rule is bounded and reversible, the standard startup playbook is fine, and this whole distinction is overhead you do not need. The discrimination skill earns its keep specifically where the cost of a wrong call is irreversible, where a rule might be protecting a person rather than a market position. The more load-bearing rules in your environment, the more this matters. The fewer, the less.

The takeaway

Startups are right that competent rule-breaking is a superpower, and they are usually working in environments where the rules are soft enough that the worst case is survivable. Regulated industries do not remove the superpower. They change the stakes, and they add a second skill that matters more than either breaking or following. The valuable person in a regulated industry is not the one who breaks rules or the one who keeps them. It is the one who can tell which rules are load-bearing. Break the soft ones freely. Treat the load-bearing ones as physics. And build a culture that can always tell the difference, because the day it cannot is the day it hurts someone.

Further reading

• Building Without a Playbook: Lessons from Creating a New Product Category What it takes to operate when the rules are not handed to you, and how to decide which conventions still apply.
• Wendy Liu, "Without their permission" A critical take on Silicon Valley's rule-breaking ethos, useful as the counter-view.

Resources