The Protective Expert

Knowledge-guarding in teams, the depth of intervention it demands, and what actually works.

Aco Kovaceski · 24 October 2026

The problem

Organisations lose more value to guarded knowledge than to missing knowledge. The capability they need usually exists inside the building. It sits with people who hold it, defend it, and will not let it move, and who resist anything built on knowledge that arrived from outside their own group. The visible symptoms are familiar: the modernisation programme that stalls in proof-of-concept purgatory, the platform nobody but one engineer can touch, the external recommendation that dies in review for reasons that keep shifting.

The standard diagnosis is wrong. These behaviours get labelled as a skills gap, a change management problem, or plain stubbornness, and the standard treatments follow: training, communications plans, and town halls. They fail, predictably, because the behaviours are not caused by ignorance. They are caused by motivation. From the inside of the person exhibiting them, guarding knowledge is rational. Their knowledge is their asset, their status, and in many cases their job security. An intervention that treats a motivated behaviour as an informational one is aimed at the wrong target, and the depth of intervention required is routinely underestimated as a result.

This paper names the six research traditions that describe this phenomenon, maps the observable behaviours each produces in working teams, sets out how deep an intervention must go to shift each mechanism, and gives concrete approaches matched to that depth. It also examines two field observations from several decades of consulting and leadership work. First, the behaviours appear in inverse proportion to the genuine intelligence of the people involved, and the research literature on rationality explains why. Second, the guarding pathology has a mirror image: teams forever convinced the grass is greener elsewhere routinely underperform teams that make what they have work, which means the target condition is calibration, not openness.

One phenomenon, six names

Six research traditions describe knowledge-protective behaviour, each from a different angle. In practice they co-occur and reinforce each other, which is one reason interventions aimed at a single mechanism underperform. The useful distinction is not between the constructs but between what each one protects: the group's output, the holder's beliefs, the holder's territory, the holder's habits, the holder's face, or the holder's autonomy.

Two points matter for intervention design. First, only one of the six (Einstellung) is a purely cognitive failure. The other five are motivated: the person gains something by resisting, or avoids losing something. Second, the mechanisms stack. A senior engineer rejecting a proposed platform migration may simultaneously be defending the superiority of the in-house stack (NIH), dismissing benchmark evidence (Semmelweis), protecting a decade of accumulated and undocumented system knowledge (territoriality), reaching for the solution pattern that made their career (Einstellung), avoiding the admission that the old design has aged badly (defensive routine), and bristling at having the change imposed (reactance). Treating that as one problem with one fix is how programmes fail.

What it looks like in teams

Each mechanism has a behavioural signature. The signatures matter because the spoken objections are rarely the real ones: the stated reason is almost always framed as a technical or risk argument, which makes it look like a debate that can be won on evidence. It cannot, because evidence is not what is being defended. Diagnose from the pattern of behaviour, not from the content of the objection.

Two composite patterns are worth calling out because they are so common in technical organisations. The first is proof-of-concept purgatory: the external solution is never rejected outright, which would require defending a position, but is subjected to an endless series of pilots, evaluations and spike investigations that exhaust the sponsor. This is NIH wearing the costume of diligence. The second is the indispensable custodian: an individual whose systems only they can operate, who is simultaneously the most helpful person in the building and the single largest delivery risk in it. Helpfulness is the mechanism of territoriality here, because every act of personal assistance is a reinforcement of dependency and a substitute for transfer. A caution applies before diagnosing either pattern: sometimes the objection is simply true, and the discriminator is set out in When the resisters are right, below.

Proof-of-concept purgatory has a mirror failure worth recording, because it shows the diagnostic trap from the other side. An evaluation run outside the real operating constraints can validate the external option on the happy path while the actual cost sits in the constraints. A government example: a POC selects product X over incumbent Y on functional merit, and at go-live it emerges that X cannot satisfy the ISM security controls the incumbent already met, at a cost of two years and significant remediation investment before anything can proceed. The POC proved the demo, not the deployment. The people who raised the controls during evaluation were likely recorded as resisters, which is the trap in miniature: pricing a real constraint and guarding a position look identical from a distance, and the difference shows only in the specifics (a named control, a costed gap, a stated condition under which the objector would change their mind).

Why it happens

The six constructs reduce to five underlying drivers. Interventions act on drivers, not on labels, so this is the layer that matters for design.

Competence threat and identity. For a knowledge worker, expertise is not something they have, it is something they are. A new method that obsoletes their expertise is processed as a threat to the self, and the response is defence, not evaluation. This is the engine of the Semmelweis reflex and of defensive routines, and it explains why the resistance is strongest in people whose identity is most fused with a specific body of knowledge.

Loss aversion and endowment. Accumulated knowledge is an endowed asset. People price what they hold well above what outsiders would pay for it, and a change is framed as a certain loss of that asset against an uncertain gain. Prospect theory predicts the resulting asymmetry: the defence of the old way will be fought harder than the adoption of the new way will ever be championed.

Power and security. Being the only person who understands a system is leverage: over workload, over priorities, over one's own continued employment. Knowledge hiding is frequently a rational response to an environment where sharing has historically been punished, through redundancy, through credit capture, or through being handed more work. Pfeffer's observation stands: knowledge is a currency, and nobody gives away currency without an exchange.

Cognitive economy and habit. Routines are cheap to run. A new method imposes real cognitive cost on exactly the people who have driven the cost of the old method to near zero, so the people best at the old way face the worst personal exchange rate on the new one. This is the honest core of the Einstellung effect, and it is the one driver that involves no bad faith at all.

Autonomy. People do not resist change; they resist being changed. The same technical migration lands completely differently depending on whether the team shaped it or received it, and reactance scales with the degree of imposition, not with the size of the change.

The practical consequence: every one of these drivers makes the behaviour locally rational. The person guarding their knowledge is not confused and is usually not malicious. They are responding correctly to the incentive structure and the threat landscape they actually inhabit. That is why the behaviour cannot be trained away, and why the depth of intervention has to match the depth of the driver.

The symmetric error: the grass is greener

Knowledge-guarding is one tail of a distribution, and the paper would mislead if it ignored the other. The mirror-image failure is the standing conviction that the answer is always elsewhere: the team that re-platforms before the last platform has paid for itself, chases the market's current favourite, and treats every incumbent as legacy by definition. Rogers (2003) named the general form pro-innovation bias, the assumption that an innovation should be adopted and that non-adoption is the thing requiring explanation.

March (1991) gave the trade-off its lasting frame: organisations must balance exploration of new possibilities against exploitation of what they already hold, and the returns to exploitation are nearer, faster and more certain. Levinthal and March (1993) described the failure trap that catches perpetual explorers: a new approach underperforms at first because competence has not yet formed, the underperformance is read as proof the approach was wrong, and the team moves on again, accumulating switching costs and shallow skill in everything. A consistent field observation matches the theory: teams that commit to the stack they have and work it hard routinely outperform teams of equal ability who are forever certain the grass is greener. Constraint does real work here. The bricolage literature (Baker and Nelson, 2005) documents teams building substantial capability precisely by refusing to treat their resource base as inadequate, and the mechanism is the same one that makes exploitation compound: depth of understanding in a committed stack is an asset that churn never accumulates.

The implication is that the target condition is not openness, it is calibration. An organisation can fail in either direction, and the two failures feed each other: the churners' wreckage hands the guarders their evidence, and the guarders' obstruction hands the churners theirs. The diagnostic question for any specific objection is therefore not whether it resists the new, but whether it prices a real constraint. Four tells separate the two:

• Constraint-pricing is specific (a named security control, a named integration, a costed gap); guarding is general and shifts when answered.

• Constraint-pricing comes with stated conditions for changing position; guarding has none.

• Constraint-pricers invest in the incumbent they defend; guarders let it rot while blocking its replacement.

• Constraint-pricing appears up front, in written criteria; guarding arrives late, after the evidence does.

The intelligence question

A consistent field observation across several decades of consulting and leadership work: the more genuinely intelligent the person, the less they exhibit these behaviours. The ablest people encountered are the quickest to adopt a better method, the least precious about their existing knowledge, and the most generous in transferring it. The guarding behaviours cluster at the level below: people with real but narrow expertise, whose standing depends on a specific stock of knowledge.

The research literature appears, at first pass, to contradict this. Stanovich and West (2008) found that psychometric intelligence correlates weakly or not at all with susceptibility to most cognitive biases, and that myside bias in particular is essentially independent of cognitive ability. Stanovich coined dysrationalia for the resulting condition: high intelligence, poor rational performance. Kahan et al. (2017) went further, showing that on identity-charged questions, more numerate subjects used their skill to reach the congenial answer, not the correct one. On this evidence, raw ability should not protect anyone from NIH or the Semmelweis reflex, and can arm the defence.

The contradiction dissolves once the terms are unpacked, and the phrase actual real intelligence is doing the unpacking. What a practitioner recognises in the field as genuine intelligence is never a test score. It is a compound: high ability, plus the epistemic traits the rationality literature measures separately, chiefly actively open-minded thinking (Baron, 1993), need for cognition, cognitive reflection (Frederick, 2005) and intellectual humility. Those traits do predict resistance to bias, strongly and replicably. The field observation is therefore correct, and the literature tells us which ingredient is doing the work: not g, but the disposition to treat one's own beliefs as objects to be tested rather than possessions to be defended, a disposition that in genuinely able people tends to be present because it is how they got able.

Two further mechanisms reinforce the effect, and both run through the drivers above rather than through cognition.

First, secure competence removes the threat. The behaviours in this paper are mostly defences, and a defence needs a vulnerability. A person whose capability is broad, demonstrated and portable loses nothing when a specific method is obsoleted; their asset is the capacity to master the next thing, not the stock of the last thing. The person whose entire standing rests on one system has everything to lose. Guarding tracks insecurity of position, and insecurity of position tracks the gap between reputation and underlying capability. This also predicts the observed exception: a highly able person in a hostile or zero-sum environment will hoard like anyone else, because the threat is then real.

Second, breadth counteracts Einstellung. Bilalic, McLeod and Gobet (2008) showed that even expert chess players suffer the Einstellung effect, but that susceptibility falls as skill rises relative to the problem: the strongest players were the ones who kept looking after finding a good move. Deep-and-broad expertise behaves differently from deep-and-narrow expertise. The narrow expert has one hammer and an identity invested in it; the broad expert has a workshop and an identity invested in solving the problem.

The caveat matters as much as the observation. Ability without the epistemic traits does not produce neutrality, it produces the most sophisticated resistance in the building: the architect who can generate an unanswerable-sounding technical objection to any external proposal in real time. Intelligence amplifies whatever epistemic character it is attached to. The selection implication follows directly: hiring and promotion should weight demonstrated updating behaviour (times the person changed their mind against their own interest, transferred their territory, or adopted an outside idea over their own) at least as heavily as demonstrated brilliance, because brilliance is common at the senior levels where these behaviours do their damage, and the updating disposition is not.

Depth of intervention

The central design error in practice is depth mismatch: applying an informational intervention to a motivated behaviour. Awareness training is the canonical example. It assumes the person resists because they do not understand, when in fact they resist because they understand perfectly what the change costs them. Training a motivated behaviour produces compliance theatre at best and better-camouflaged resistance at worst, because you have just taught the defender the vocabulary of the reformers.

Three depths of intervention exist, and each reaches a different class of driver.

Level 1: Informational. Training, demonstrations, evidence, documentation, exposure. Operates in weeks. Reaches only the unmotivated mechanisms: habit, unfamiliarity, and the cheap end of Einstellung. Necessary almost everywhere, sufficient almost nowhere. If an informational intervention works on its own, the problem was never knowledge-guarding, it was an actual skills gap.

Level 2: Structural. Incentives, role design, process, staffing, and measurement. Operates in quarters. This is the level that reaches power, security and loss aversion, because it changes what the guarding behaviour pays. If documentation is unpaid overhead, it will not happen; if bus factor is a tracked delivery risk and reducing it is a promotable achievement, it will. If the only reward in the system is for invention, NIH is being purchased; rewarding adoption and reuse at parity with invention changes the purchase. Structural work is where most of the leverage sits, and it is the level most organisations skip, because it requires changing things managers own rather than things employees attend.

Level 3: Identity and culture. Psychological safety, leadership modelling, and the redefinition of what an expert is. Operates in years, and only through sustained behaviour at the top. This is the only level that reaches competence threat, the Semmelweis reflex and defensive routines, because those defend the self, and the self only stands down when error stops being dangerous. Argyris was precise about why this is hard: the defensive routines that block learning are themselves protected by defensive routines, so the organisation cannot discuss why it cannot discuss things. The intervention is leaders repeatedly and visibly being wrong in public without cost, adopting outsiders' ideas over their own, and promoting people who transfer their territory. Nothing said at this level counts; only behaviour is evidence.

The matching rule is simple: the more the behaviour protects the self rather than the task, the deeper the required intervention. Reactance is mostly a Level 1 and 2 problem (it is created by the change process itself and can be designed out). Territoriality is squarely Level 2 with a Level 3 component (security must be real before territory is surrendered). The Semmelweis reflex and defensive routines are Level 3 problems wearing Level 1 costumes, which is exactly why they absorb unlimited amounts of evidence and training without moving.

One sequencing principle governs all three levels: security before change. The self-affirmation literature (Cohen and Sherman, 2014) shows that people evaluate threatening information more objectively when their standing is affirmed first. Practically: confirm the expert's value, future and status before asking them to open their territory, not after. Stripping territory from an insecure expert produces the fiercest resistance available in organisational life; the order of operations is not a nicety, it is the mechanism.

Approaches that work

The table maps interventions to mechanism and depth. None of these are novel individually; what fails in practice is deploying them unmatched to mechanism, unsequenced, or at the wrong depth.

Four programme-level principles sit above the table.

Diagnose before prescribing. Spend time establishing which mechanisms are active, using the behavioural signatures in this paper rather than the stated objections. A programme aimed at NIH when the live mechanism is territoriality will fund evaluations forever and transfer nothing.

Sequence by security. Affirmation and structural safety come before any request to open territory or admit error. Reversing the order converts a solvable Level 2 problem into an entrenched Level 3 one.

Change the exchange rate, not the person. The behaviours are locally rational, so the durable fix is making sharing and adoption pay better than guarding, in money, status and security. Exhortation leaves the payoff matrix untouched and therefore changes nothing that lasts.

Select for the trait you cannot train. Actively open-minded thinking is far cheaper to hire and promote for than to install. Weight evidence of updating behaviour in selection and advancement, and treat a brilliant candidate with no record of ever having changed their mind as the risk they are. Over time this is the only intervention that lowers the base rate rather than managing the symptoms.

When the resisters are right

Two corrections keep this paper honest. First, an objection that looks like NIH is sometimes just true. Second, the opposite bias exists, is every bit as motivated, and in the field does at least as much damage.

Legitimate constraint is not NIH. A government case illustrates it. A proof of concept concluded that product X should replace incumbent product Y. The POC validated functionality and performance, and it did so competently. It did not validate against the ISM control set or the accreditation path. At go-live the gap surfaced: meeting the controls meant roughly two years of work and significant investment, and the adoption stalled exactly where the local team had said it would. Their "our environment is different" was not a defence, it was information. In regulated environments (ISM, IRAP, DISP, safety cases) the environment frequently is different, and a POC that excludes the binding constraints is not evidence, it is theatre, and the motivated reasoning in that story belonged to the evaluators, not the resisters. The corollary for POC design in constrained environments is blunt: the constraint set is the POC. A functionality comparison answers a question nobody is asking. Whether the product can be accredited, integrated and operated within the control framework at acceptable cost is the question, and a POC that cannot answer it should not be permitted to conclude.

The discriminator between NIH and legitimate constraint is behavioural, consistent with the rest of this paper:

The grass is not greener. Guarding has six names; chasing has names too. Shiny object syndrome, magpie development, and what March (1991) formalised as the exploration-exploitation trade-off: organisations must balance exploiting the knowledge and assets they hold against exploring what they might acquire, and both extremes fail. NIH is pathological exploitation. Perpetual adoption is pathological exploration, and it loses just as reliably, for three reasons: switching costs are systematically underestimated, the defects of the external solution are invisible until you own them, and every switch resets the local learning curve that was quietly producing the returns.

A second field observation belongs alongside the intelligence one: teams that commit to making what they have work routinely outperform teams permanently scanning for a better elsewhere. The literature supports it. Bricolage, producing outcomes by recombining the resources at hand, is a documented driver of performance in constrained settings (Baker and Nelson, 2005), and the engineering version is the boring technology argument (McKinley, 2015): an organisation holds a small number of innovation tokens, and spending them on commodity problems is how delivery dies. Deep exploitation compounds. Serial exploration resets.

The synthesis is that the target state is not pro-adoption, it is calibrated evaluation. Knowledge-guarding and grass-is-greener are symmetric motivated biases: one defends identity and territory, the other chases novelty and dodges the unglamorous grind of mastering what is already owned. The behavioural test from the intelligence section applies in both directions: the people to trust with an adopt-or-persist decision are the ones with a record of deciding against their own stated preference, in both directions.