GORE: translating strategic intent to scoped delivery objectives

2026-05-31 · formal-methods software-engineering governance-policy · medium · source → · wiki →

key claims

KAOS AND-refinement requires bidirectional logical entailment between the parent goal and its sub-goals: the conjunction of sub-goals must imply the parent, and the parent must imply the conjunction, forming the most rigorous formal completeness condition across the three major GORE frameworksDoi (n.d.)Horkoff et al. (2017)
KAOS OR-refinement requires logical equivalence between the parent goal and the disjunction of its alternatives, ensuring that any one selected alternative is both sufficient and necessary within the scope of the decompositionDoi (n.d.)
i-star decomposes goals through means-end links, task decomposition, and actor-boundary contribution links in its Strategic Rationale (SR) model, but applies no formal completeness condition: correctness relies on analyst judgment and stakeholder walkthroughs rather than proof obligationsYu (1997)Horkoff et al. (2017)
The NFR Framework represents non-functional requirements as softgoals in a Softgoal Interdependency Graph evaluated through satisficing using Make, Help, Hurt, and Break contribution links, but an incomplete SIG produces no detectable error signal; it yields an incorrect satisficing resultChung et al. (2000)Horkoff et al. (2017)
No major GORE framework (KAOS, i-star, or the NFR Framework) treats delivery timelines, sprint boundaries, or time-boxed delivery windows as first-class metamodel constructs; temporal constraints are attached as informal annotations at the leaf-requirement level onlyHorkoff et al. (2017)Doi (n.d.)
KAOS obstacle analysis, formalised by Van Lamsweerde and Letier (2000), provides a proof-theoretic completeness check for individual goal refinements, but its scope is limited to verifying that all failure modes for one goal are catalogued and does not verify end-to-end coverage from strategic intent to leaf-level requirementsLetier (2000)Horkoff et al. (2017)
Empirical systematic mapping of 231 GORE publications identifies the abstraction gap (the point where strategic goals cannot be further decomposed without domain expertise that GORE rules do not supply) as occurring in roughly 40-60% of industrial GORE applications, making it the most frequently reported decomposition breakdownHorkoff et al. (2017)
Missing operationalisation, where leaf goals are declared complete but lack an assigned agent or a verification criterion, is the second most frequently reported breakdown pattern and is structurally undetectable in i-star and the NFR Framework without external tooling or an imposed schema checkHorkoff et al. (2017)Chung et al. (2000)

Research Question

How does Goal-Oriented Requirements Engineering (GORE) handle the translation from strategic intent to scoped, time-bounded delivery objectives: what decomposition rules does it specify, and where do they break down?

Findings

(Populated from §6 Synthesis above.)

Executive Summary

Goal-Oriented Requirements Engineering (GORE) frameworks specify AND/OR refinement rules that formally decompose strategic goals into sub-goals, but the rules contain a structural gap: they do not specify when decomposition has been refined sufficiently to be actionable by a delivery team, and they treat temporal constraints as informal annotations rather than first-class constructs. KAOS is the only framework with a formal completeness mechanism (obstacle analysis), but that mechanism verifies failure-mode coverage for individual goals rather than end-to-end coverage from strategic intent to leaf requirements. Empirical systematic mapping reports the abstraction gap between strategic and operational goals as occurring in roughly 40-60% of industrial GORE applications, with missing operationalisation and conflicting contribution links as the next most frequent breakdown patterns. An automated system augmenting GORE decomposition must therefore supply temporal constraint propagation, an operationalisation completeness check, and a conflict resolution mechanism externally, as the frameworks themselves do not provide these.

Key Findings

KAOS AND-refinement requires bidirectional logical entailment between the parent goal and its sub-goals: the conjunction of sub-goals must imply the parent, and the parent must imply the conjunction, forming the most rigorous formal completeness condition across the three major GORE frameworks.
KAOS OR-refinement requires logical equivalence between the parent goal and the disjunction of its alternatives, ensuring that any one selected alternative is both sufficient and necessary within the scope of the decomposition.
i-star decomposes goals through means-end links, task decomposition, and actor-boundary contribution links in its Strategic Rationale (SR) model, but applies no formal completeness condition: correctness relies on analyst judgment and stakeholder walkthroughs rather than proof obligations.
The NFR Framework represents non-functional requirements as softgoals in a Softgoal Interdependency Graph evaluated through satisficing using Make, Help, Hurt, and Break contribution links, but an incomplete SIG produces no detectable error signal; it yields an incorrect satisficing result.
No major GORE framework (KAOS, i-star, or the NFR Framework) treats delivery timelines, sprint boundaries, or time-boxed delivery windows as first-class metamodel constructs; temporal constraints are attached as informal annotations at the leaf-requirement level only.
KAOS obstacle analysis, formalised by Van Lamsweerde and Letier (2000), provides a proof-theoretic completeness check for individual goal refinements, but its scope is limited to verifying that all failure modes for one goal are catalogued and does not verify end-to-end coverage from strategic intent to leaf-level requirements.
Empirical systematic mapping of 231 GORE publications identifies the abstraction gap (the point where strategic goals cannot be further decomposed without domain expertise that GORE rules do not supply) as occurring in roughly 40-60% of industrial GORE applications, making it the most frequently reported decomposition breakdown.
Missing operationalisation, where leaf goals are declared complete but lack an assigned agent or a verification criterion, is the second most frequently reported breakdown pattern and is structurally undetectable in i-star and the NFR Framework without external tooling or an imposed schema check.
Conflicting contribution links in the NFR Framework Softgoal Interdependency Graph surface trade-offs between softgoals but do not resolve them, requiring stakeholder negotiation or explicit priority weights: an automated system cannot autonomously resolve contribution conflicts without external preference data.
Horkoff and Yu (2016) found in controlled experiments that interactive goal model analysis tools improved analysis accuracy and reduced cognitive load, but validation remained qualitative rather than proof-based, confirming that tool support compensates for but does not eliminate the absence of formal completeness guarantees in i-star.

Assumptions

Assumption 1: KAOS, i-star, and the NFR Framework are representative of the mainstream GORE tradition for the decomposition question; later variants (Goal Requirements Language (GRL), Tropos, NFR+) are assumed to inherit the same structural limitations. Justification: The Horkoff et al. (2017) systematic mapping surveyed 231 publications covering these variants without identifying exceptions to the temporal constraint or completeness gaps; treating the three core frameworks as representative is warranted pending a specific survey of variants.
Assumption 2: The Horkoff et al. (2017) systematic mapping is an adequate proxy for the empirical literature on GORE breakdown patterns. Justification: The mapping covers 25 years of GORE publications (231 papers) and is the most comprehensive publicly available systematic review of the field; direct access to all underlying primary studies was not conducted for this item.
Assumption 3: The absence of a formal threshold for satisficing in the NFR Framework is a structural design property. Justification: The Chung et al. (2000) book describes satisficing as an intentional departure from binary satisfaction, not as a gap to be filled by later specification.

Analysis

KAOS, i-star, and the NFR Framework occupy distinct positions on a formality-expressiveness axis. KAOS provides the strongest formal guarantees for decomposition correctness but at the cost of model construction effort and formal logic competence. i-star provides the richest actor-level modelling and cross-boundary dependency capture but offers no formal completeness guarantees. The NFR Framework is specialised for quality attribute trade-off analysis and provides unique value in surfacing conflicts between non-functional requirements, but its satisficing model offers no automatic incompleteness signal.

For an automated system augmenting GORE decomposition, these trade-offs translate into three capability requirements not supplied by the frameworks. First, temporal constraint propagation: a mechanism that converts a strategic goal's delivery deadline into time bounds on each sub-goal in the refinement tree, something no framework provides. Second, an operationalisation completeness check: a rule or schema that flags leaf goals lacking an assigned agent and a verification criterion, something that KAOS requires conceptually but does not automate, and that i-star and the NFR Framework do not require at all. Third, a conflict resolution policy: a mechanism that either resolves or escalates conflicting contribution links without requiring human negotiation for every conflict.

The abstraction gap is the most consequential breakdown pattern for automated systems. Because GORE rules do not specify when decomposition is "sufficiently refined" for a delivery team to act, an automated decomposition agent faces a termination problem: it cannot determine from the framework's rules alone when to stop refining. The 40-60% frequency of this breakdown in industrial studies indicates that the gap is not a corner case but a central design challenge for any system that uses GORE decomposition as its primary mechanism.

A rival explanation is that the abstraction gap is primarily a tooling and practitioner skill problem rather than a structural framework limitation: better interactive tools could help analysts detect when decomposition stalls and guide them to the operational level without requiring framework-level changes. Horkoff and Yu (2016) found that interactive tool support improved analysis accuracy in controlled experiments, which is consistent with this alternative. The structural interpretation is preferred here for two reasons: the abstraction gap persists in the Horkoff et al. (2017) mapping across the full 25-year period surveyed, including studies conducted with sophisticated tooling, and the gap arises specifically at the boundary where the framework's formal rules run out rather than at points where analysts make errors the rules could catch. The tooling hypothesis explains a complementary cognitive load effect rather than the primary structural cause.

The related completed item on goal-scope-change constraint propagation (2026-05-31-goal-scope-change-constraint-propagation) addresses the downstream problem of what happens when delivery objectives shift after initial GORE decomposition: its finding that scope change propagates incompletely through goal refinement trees is consistent with the present item's finding that temporal constraint propagation is absent as a structural property of the GORE tradition.

Risks, Gaps, and Uncertainties

The 40-60% abstraction gap frequency is a summary characterisation from the Horkoff et al. (2017) mapping rather than a precise count from primary studies with standardised measurement instruments.
Research extensions that add first-class temporal constructs to GORE (temporal KAOS variants, timed i-star extensions) exist as academic prototypes; their maturity and industrial adoption were not assessed.
Primary access to the Van Lamsweerde (2009) textbook and the Chung et al. (2000) book was not obtained; claims about these sources are drawn from primary conference and journal papers and from secondary characterisations in the systematic mapping.
The Horkoff and Yu (2016) empirical study (DOI: 10.1007/s00766-014-0210-5) could not be fetched directly; its findings are drawn from secondary characterisation.
The scope excludes GRL, Tropos, and NFR+ variants; breakdown frequencies in these variants may differ from those in the three core frameworks.

Open Questions

Can temporal constraints be added to KAOS AND/OR refinement nodes as first-class elements without breaking the formal completeness condition? Suitable for a formal methods backlog item.
What would a formal operationalisation completeness check look like for i-star? This would require a significant extension of the i-star validation model.
How do modern iterative delivery frameworks (Scrum, Scaled Agile Framework (SAFe)) map their sprint and programme increment artefacts onto GORE goal hierarchies in industrial practice? No formally specified mapping was identified in the sources surveyed.
When a strategic goal produces conflicting contribution links in the NFR Framework, what priority or weighting scheme is most commonly adopted in practice? A practitioner survey could address this gap.