COM-B Model
Michie, van Stralen & West, Implementation Science, 2011
Behavior = Capability × Opportunity × Motivation. If any factor is zero, no behavior.
In plain language
COM-B is a diagnostic tool. When someone isn't doing the thing you want them to do, it's almost always one of three things: they can't (Capability), they don't have the chance (Opportunity), or they don't want to (Motivation).
It comes from health-behavior research: Susan Michie and colleagues built it to explain why public-health interventions succeed or fail. It has since become the standard framework for implementation science across sectors.
Unlike Fogg B=MAP which is a composition model, COM-B is a diagnostic model. B=MAP tells you how to design a behavior; COM-B tells you why your design didn't work.
How Maxim applies it
- Maxim's Compliance Shield pack (L1.4) uses COM-B to support regulated behavior. Operator Capability comes from loading the relevant framework (GDPR, HIPAA, etc.) into context automatically. Opportunity comes from routing regulated work to security review mid-workflow, not after it ships. Motivation comes from visibility: work is flagged when a required control is missing, so the gap cannot pass unseen.
- Maxim's install experience is also COM-B-tuned. Capability: one command. Opportunity: the 90-day Pro Trial activates on install, so the moat is available without a second decision. Motivation: the moat shows up on the very first output, so the reader doesn't have to take it on faith.
- The /mxm-health command runs a COM-B check on your Maxim install: capability (all commands installed), opportunity (Worker reachable, license valid), motivation (confidence rubric active). If any factor is missing, /mxm-health tells you which.
What generic LLMs get wrong
Generic compliance advice tells you the rule ('GDPR says...') without checking whether the operator has the capability to apply it, the opportunity to apply it mid-workflow, or the motivation to apply it when the deadline is tight. COM-B-designed compliance review routes regulated work to review automatically and flags missing controls, so the check does not depend on the operator remembering it under pressure.