Anchor case study domains
This book will be known, above all, for two empirical domains that force the argument to become doctrinally testable and operationally specific: first, benefits determinations in the administrative state, because they foreground due process as lived procedure rather than as abstract legitimacy talk; second, procurement and vendor attestations, because they foreground how institutions externalize verification costs through documents and disclaimers, then try to convert fluency into reliance without supplying accountable warrant. These two domains jointly fix the doctrinal center of gravity in administrative law and contract, while giving the contestability cost index a credible cross domain measurement target rather than leaving it as a metaphor.
Introduction: The synthetic record problem is a legitimacy problem
1. The documentary substrate of authority
Modern institutions do not govern primarily by issuing commands in person, and they do not allocate burdens and benefits by revealing a full interior deliberation; they govern by producing documents that function as speech acts with allocative consequences, and the decisive fact is that these documents are then treated as reasons in the world, capable of justifying action, defeating complaint, surviving managerial turnover, and traveling downstream into audits, appeals, litigation, and secondary use. In that sense, the documentary record is not a shadow of authority; it is one of authority’s main instruments, because the record is what can be reviewed, what can be contested, and what can be used to allocate liability when governance fails. Administrative law makes this premise explicit by treating judicial review as a review of the record and the reasons it can support, and by authorizing courts to set aside agency action that is arbitrary or capricious or taken without required procedure. (Administrative Procedure Act 5 U.S.C. § 706; Motor Vehicle Mfrs. Assn. v. State Farm Mut. Auto. Ins. Co. 463 U.S. 29). Contracting and procurement, for their part, instantiate the same logic through reliance and warranty, because counterparties are asked to act as if institutional utterances were grounded in defensible procedure even when the utterance is produced through layered templates, approvals, and now generative drafting.
The arrival of fluent generative text does not merely raise familiar questions about truth, misinformation, or persuasion; it changes the economics of institutional speech in a way that directly pressures the conditions under which contestation is practically possible. In the classic administrative law formulation, an agency must examine relevant data and articulate a satisfactory explanation for action, and a reviewing court may not supply a reasoned basis that the agency itself has not given, because the point of review is to test the agency’s own justification rather than a later lawyerly reconstruction. (Motor Vehicle Mfrs. Assn. 463 U.S. 29; SEC v. Chenery Corp. 332 U.S. 194). When institutions can cheaply produce polished reasons at scale, that premise becomes fragile, not because courts or auditors forget the doctrine, but because the record that doctrine presupposes becomes saturated with plausible text that is weakly coupled to identifiable responsibility and weakly coupled to the evidentiary substrate that would make the reasons contestable.
2. The new asymmetry: language is cheap, contestability is expensive
Generative drafting collapses the marginal cost of producing reasons, but it does not collapse the marginal cost of challenging them, and that asymmetry is the governance shock around which this book is organized. The institution can generate notices, letters, narratives, summaries, performance assessments, vendor responses, and internal justifications faster than any affected person can read them, much less test their evidentiary basis, find the responsible decision procedure, locate the applicable policy version, and mount a credible challenge within deadlines. Even where the law nominally supplies process, the practical ability to use that process can be hollowed out by the sheer volume and rhetorical completeness of the synthetic record.
Due process doctrine is often discussed as balancing, and it is, but it is also a practical theory of error, burden, and the allocation of contestation costs. In the benefits context, the Supreme Court emphasized that termination of welfare benefits required procedural protections because the stakes were immediate and severe and the risk of error was not abstract. (Goldberg v. Kelly 397 U.S. 254). Later, the Court articulated a balancing test that explicitly considers private interest, risk of erroneous deprivation under existing procedures and the probable value of additional safeguards, and the government interest including fiscal and administrative burdens. (Mathews v. Eldridge 424 U.S. 319). Generative drafting inserts itself directly into that balancing frame: it can reduce administrative burden while increasing the risk of error through reason laundering and record flood, and it can shift the real cost of contestation onto the person who is least able to pay it, thereby changing the effective procedure without formally changing the rules. The result is not only more documents, but weaker due process in practice, because contestability becomes a luxury good.
This book names that degradation precisely: a synthetic record problem is a legitimacy problem because legitimacy in document governed institutions depends on whether reasons can be contested at reasonable cost and traced to accountable procedure. When text becomes abundant, institutions can satisfy superficial expectations of explanation while undermining the deeper requirement that a reason be examinable, attributable, and tethered to evidence in a way that survives cross examination rather than collapsing into organizational plausible deniability. That, in turn, creates a second order institutional risk: if no one can locate who is accountable for why the institution said what it said, then liability allocation becomes noisy, governance becomes cynical, and internal learning breaks, because the record no longer reliably indicates what decisions were actually made and on what grounds.
3. Reason laundering as a predictable institutional behavior
The central behavioral failure mode in this environment is reason laundering, by which an institution produces rhetorically adequate reasons whose provenance is intentionally diffused across tools, templates, prompts, approvals, and committee language such that no accountable agent can be examined about the operative justification. This need not involve malice; it can arise from throughput pressure and defensive documentation norms that treat having a reason shaped document as synonymous with having a defensible reason. Yet administrative law has long rejected post hoc rationalization as a substitute for contemporaneous justification because the rule of law is not compatible with reasons that appear only after the fact, reconstructed to survive review. (SEC v. Chenery Corp. 332 U.S. 194; Motor Vehicle Mfrs. Assn. 463 U.S. 29). The synthetic record makes post hoc rationalization easier to perform at scale and harder to detect, because it can be done not only by lawyers after litigation begins, but by everyday workflows that rewrite and polish language continuously until it looks review ready.
A second failure mode follows: responsibility diffusion. Once the record is assembled from model outputs, policy snippets, prior memos, and committee edits, it becomes unclear who is the institutional speaker for purposes of accountability. That ambiguity matters because contestation requires an interrogable agent or, at minimum, an interrogable procedure. If no one can say, “This claim was produced by this decision procedure, under this policy version, relying on this evidence,” then a challenge becomes a fight with a fog machine, and legitimacy becomes a performance.
4. Thesis and contributions
The thesis of this book is severe but narrow: when institutions speak primarily through documents, generative drafting collapses the marginal cost of producing reasons, enabling reason laundering, responsibility diffusion, and record saturation; legitimacy therefore requires treating institutional utterances as procedure bound artifacts with verifiable chains of custody for reasons, including attributed responsibility, evidence links, and contestability guarantees, while constraining provenance so it cannot become surveillance.
From that thesis follow three contributions. The first is conceptual: it reframes authenticity as a property of attributable procedure rather than as a metaphysical property of text, so that institutional speech can be legitimate even when assisted by machines, provided that the procedure that produced the utterance is specified, bounded, and verifiable. This is the core move that separates the problem from nostalgia, because the point is not to restore “human authored” prose; the point is to restore the ability to test whether the institution’s speech is the output of a defensible decision procedure.
The second contribution is doctrinal and governance oriented: it proposes a doctrine of documentary due process that treats the chain of custody for reasons as a requirement proportional to stakes in administrative and contractual settings, aligning practice with existing demands for record based review and reasoned decisionmaking. (Administrative Procedure Act 5 U.S.C. § 706; Motor Vehicle Mfrs. Assn. 463 U.S. 29). The claim is not that courts must adopt a new metaphysics of machine speech, but that existing procedural demands should be interpreted to require verifiable reason custody when machine mediated drafting or decision support meaningfully participates in the production of the record.
The third contribution is technical and institutional: it specifies a minimal “utterance provenance” architecture that can verify procedure, attribution, and evidence linkage without expanding inference scope into personal interiors. This privacy constraint is not ornamental; it is a condition of legitimacy. Information systems that intensify the capture and centralization of personal data can themselves become threats that overwhelm the goods they were built to protect, and the Supreme Court has repeatedly confronted the distinct dangers posed by centralized, persistent data systems even where the underlying information is generated for ordinary purposes. (Whalen v. Roe 429 U.S. 589; Carpenter v. United States, slip opinion, Supreme Court of the United States, 22 June 2018). The design target, therefore, is verification without maximal capture, and accountability without turning provenance into a general purpose surveillance substrate.
5. Evaluative target: contestability at reasonable cost
The book’s evaluative target is operational: an utterance is legitimate when it is contestable at reasonable cost, attributable to a decision procedure, and linked to evidence adequate for the stakes. This triad is intentionally austere, because it avoids conflating legitimacy with rhetorical quality, brand trust, or generalized transparency talk. Contestability, in this sense, is not merely the formal availability of appeal, arbitration, or complaint; it is the practical ability to mount a challenge that can compel the institution to answer to its own procedure and evidence. Attribution is not merely a signature line or a corporate letterhead; it is an accountable mapping between decision roles and the claims asserted. Evidence linkage is not merely a citation to policy; it is a stable pointer to the underlying evidentiary substrate that could be examined, audited, or disputed under the appropriate confidentiality constraints.
These criteria align with long standing administrative review logic. Courts review the reasons an agency actually gave and the record that supports them, and they police failures where an agency failed to consider an important aspect, relied on impermissible factors, or offered an explanation that runs counter to evidence. (Motor Vehicle Mfrs. Assn. 463 U.S. 29). They also align with basic evidentiary logic: for any record to do work in adjudication, it must be authenticable, meaning there must be evidence sufficient to support a finding that the item is what it is claimed to be. (Fed. R. Evid. 901). The novelty of the synthetic record is that it can satisfy surface expectations while making these deeper requirements harder to meet in practice, unless the institution adopts explicit procedural bindings.
6. Method spine: doctrinal, technical, institutional
The method of this book is tripartite in a disciplined sense. It is doctrinal because it begins from primary legal authorities that already demand reasoned procedure and record based review, then specifies what those demands imply when drafting becomes machine mediated. (Administrative Procedure Act 5 U.S.C. § 706; Motor Vehicle Mfrs. Assn. 463 U.S. 29; SEC v. Chenery Corp. 332 U.S. 194; Goldberg v. Kelly 397 U.S. 254; Mathews v. Eldridge 424 U.S. 319). It is technical because contestability and attribution are not achieved by aspiration; they require explicit threat models, trust boundaries, and verifiable primitives analogous to the way evidence is authenticated and handled in other high stakes contexts. (Fed. R. Evid. 901). It is institutional because adoption will fail if it merely adds new paperwork, and will succeed only if it changes operating models so that review rituals generate evidence rather than text.
The book therefore avoids two seductive but inadequate strategies. The first is prohibition, which imagines that banning generative drafting restores legitimacy, ignoring that institutional reason laundering predates machine text and that human authored bureaucracy can also saturate the record. The second is maximal transparency, which imagines that logging everything solves accountability, ignoring that maximal capture can create new power asymmetries and new privacy harms, and that institutions can drown oversight in data just as easily as they can drown it in text. The design problem is narrower and harder: to create an utterance layer in which the institutional record becomes verifiably attributable and contestable without becoming a pretext for surveillance.
7. Why benefits determinations and procurement anchor the book
Benefits determinations and procurement are not selected because they are convenient examples, but because they force the theory into contact with the institutional mechanisms that matter. Benefits determinations anchor the book in due process as an everyday technology of legitimacy: notices, reasons, records, and the practical ability of a person to challenge a deprivation that can affect survival. (Goldberg v. Kelly 397 U.S. 254; Mathews v. Eldridge 424 U.S. 319). Procurement anchors the book in the contract and reliance dimension of documentary authority: attestations, representations, and the systematic externalization of verification work onto counterparties through boilerplate that presumes trust while disclaiming responsibility. Together they reveal the same asymmetry in two guises: the institution’s ability to produce reasons faster than they can be tested, and its ability to shift the costs of testing onto those with weaker bargaining power.
These domains also discipline the contestability cost index. If the index cannot detect contestability degradation in benefits notices, or cannot detect verification offloading in procurement attestations, then it is not a useful instrument, and the book’s normative claims would be underdetermined. The index is therefore designed to behave like a measurement harness rather than a moral slogan, and Part V will subject it to adversarial scrutiny in these contexts before extending it to workplace discipline and clinical and social service documentation.
8. Roadmap: escalating constraints rather than escalating rhetoric
The book proceeds as a sequence of escalating constraints. Part I diagnoses the collapse of documentary scarcity and introduces reason laundering and contestability costs as the central governance variables. Part II builds a theory of the institutional utterance as a procedure bound artifact and specifies chains of custody for reasons, while explicitly confronting the privacy risk that provenance infrastructure becomes surveillance. Part III translates the theory into doctrine and governance, arguing for documentary due process in administrative and contractual settings and developing the concept of epistemic warranty as a tool for allocating verification economics. Part IV specifies the systems design: threat models, minimal primitives, evaluation harnesses, and an institutional operating model that can be audited without generating more text. Part V forces specificity through case studies, using the contestability cost index to compare baseline workflows to redesigned ones under strict privacy constraints. Part VI proposes the utterance commons as public infrastructure and closes by returning to the asymmetry that motivated the book, insisting on a settlement that is neither nostalgic nor permissive: language may be cheap, but legitimate institutional speech must remain procedure bound, attributable, and contestable.
Chapter One: From Authored Memo to Synthetic Record
Institutions rule by writing because writing makes power portable. A benefits denial, a procurement disqualification, a termination notice, a licensing condition, a compliance finding, and a settlement offer all operate as institutional speech acts whose practical force comes from their documentary form, meaning that the words are not commentary about authority but the vehicle through which authority is exercised, recorded, defended, and made reviewable. That is why documentary failure is never just a communications problem. It is a procedural problem that changes who can contest, at what cost, and with what probability of actually altering an outcome.
To call a document institutional speech is to make a precise claim about what documents do. J. L. Austin’s core insight was that many utterances are not descriptions but performances, acts accomplished in language under recognizable conventions and conditions of felicity, so that what matters is not only semantic content but whether the act was properly performed by an authorized speaker in an appropriate procedure (Austin). When an institution issues a notice of adverse action, it performs, not reports, and the legitimacy of that performance is downstream of procedure rather than prose polish. In public law, this procedural anchoring is explicit: judicial review is built around the idea that an agency must be judged on the grounds it invoked and must state those grounds with enough clarity that a reviewing tribunal is not forced to guess at the theory of decision (Securities and Exchange Commission v. Chenery Corp. 197). The Administrative Procedure Act makes the same commitment operational by requiring courts to review “the whole record” and to set aside agency action that is arbitrary or capricious, contrary to law, or unsupported in the relevant sense (Administrative Procedure Act sec. 706). The point is not that every decision requires maximal explanation, but that authority becomes legitimate by being contestable through a record whose reasons can be interrogated.
A second, equally structural commitment sits beneath the first: the record is not optional. Federal records law imposes an affirmative duty to “make and preserve records” that adequately document the agency’s functions, decisions, and procedures, in part to protect the legal rights of persons directly affected by agency action (Federal Records Act sec. 3101). This is not mere archival piety. It is an institutional commitment that a decision’s effects must be traceable to the decision process that produced it, so that accountability can be allocated and review can occur without relying on institutional memory or post hoc narrative. That commitment becomes more, not less, necessary as the scale of documentation grows, because volume is not the same thing as documentation; a record can be immense and still fail to connect outcomes to accountable reasons.
Generative drafting changes this environment by collapsing the marginal cost of producing plausible institutional language while leaving contestability expensive. The documentary substrate of authority is premised on scarcity in at least three senses: scarcity of authorship, scarcity of revision cycles, and scarcity of institutional attention. A memo that takes time to write concentrates responsibility because the time cost forces explicit selection of claims, evidence, and rationale; it also creates friction that discourages record inflation for its own sake. Generative tools reverse the pressure. They make it easy to produce more words, more versions, more supporting rationales, and more “complete” files, including files that look procedurally mature even when the underlying decision is thin. The result is what this book calls the synthetic record: an institutional file whose surface fluency and internal coherence are no longer reliable indicators of attributable procedure, evidence linkage, or stable authorship, even when every sentence is grammatically correct.
The synthetic record is not primarily the risk of factual error, although factual error matters. The deeper risk is procedural decoupling: the growing gap between the reasons an institution can produce and the reasons it can responsibly stand behind under contest. Administrative law already treats that gap as a central legitimacy defect. Chenery is the canonical form, warning that a reviewing court may not affirm administrative action by substituting a more adequate basis than the one the agency actually invoked, precisely because that substitution would transfer decision authority from the agency to the court (Securities and Exchange Commission v. Chenery Corp. 196). State Farm generalizes the obligation by insisting that an agency must examine relevant data and articulate a satisfactory explanation with a rational connection between facts found and choice made, which becomes a test for whether “reasoned decisionmaking” occurred rather than a test for how elegant the writing looks (Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co. 43). Generative drafting increases the feasibility of writing that appears to satisfy these demands while quietly weakening the connection to actual deliberation, and it therefore expands the opportunity space for what later chapters name reason laundering.
This shift matters because contestability is a due process value long before it becomes an aesthetic one. Goldberg v. Kelly treated welfare termination as a high stakes speech act that demanded a meaningful opportunity to be heard at a meaningful time, not because government must narrate itself beautifully but because the affected person must be able to challenge the basis of action before deprivation becomes irreversible in practice (Goldberg v. Kelly 267). Mathews v. Eldridge refined the analysis into a balancing framework that asks about the private interest at stake, the risk of erroneous deprivation under existing procedures, the probable value of additional safeguards, and the government’s interest in administrative burden, thereby making “how contestable is the decision” a structured question rather than a moral intuition (Mathews v. Eldridge 335). The synthetic record changes the risk profile of erroneous deprivation because it changes how easily an institution can generate a formally complete justification relative to a person’s ability to interrogate it. Under saturation, the person’s costs rise, not necessarily because any single document is worse, but because the relevant record becomes harder to bound, the theory of decision becomes easier to shift across versions, and accountable authorship becomes easier to diffuse.
A final element completes the chapter’s diagnosis: authenticity and integrity are not the same thing. Evidence law captures this with unusual clarity. Rule 901 requires “evidence sufficient to support a finding” that an item is what the proponent claims it is, which makes authenticity a matter of supported attribution rather than confident assertion (Fed. R. Evid. 901). In institutional settings, the analog is straightforward: it is not enough for a document to be internally consistent, because internal consistency can be manufactured at scale; what matters is whether there is sufficient support to treat the document as the output of a defined decision procedure carried out by authorized roles under known constraints. When the marginal cost of producing coherent text drops sharply, institutions will predictably lean on coherence as a substitute for custody unless countervailing design constraints exist. That is why later chapters insist on chains of custody for reasons, not as bureaucratic ornament, but as the documentary analog of authentication: a structured way to show that the utterance is what the institution claims it is.
The chapter would be incomplete if it did not confront the obvious objection: perhaps a synthetic record is still better than a thin record because more documentation can make decisions more legible, reduce inconsistency across caseworkers, and lower the cost of explaining outcomes to affected parties. In many contexts, those benefits are real, and refusing them on principle would be both impractical and ethically questionable. Moreover, some of the worst historical failures of due process were failures of documentation, where decisions were made with little written trace and thus could not be contested, audited, or corrected. The ability to draft quickly could, in the best case, expand notice quality, standardize explanations, and reduce arbitrary variation across similarly situated people, aligning with the procedural values that Goldberg and Mathews sought to protect (Goldberg v. Kelly 268; Mathews v. Eldridge 335).
The response is not to deny the value of improved documentation, but to insist on the condition under which documentation improves legitimacy rather than simulating it. More words help only when they are coupled to attributable procedure and stable evidence linkage, because contestability is a function of bounded records and examinable reasons, not a function of verbal abundance. A saturated file that allows an institution to select among multiple generated rationales after the fact can undermine the very reviewability doctrines that administrative law treats as foundational, including the requirement that reasons be the agency’s reasons, stated clearly enough for others to evaluate without guesswork (Securities and Exchange Commission v. Chenery Corp. 197). In other words, generative abundance can increase legibility while simultaneously increasing deniability, and the second effect can dominate the first unless the system explicitly preserves custody for reasons.
This is also where privacy enters the picture earlier than many technical discussions admit. To rebuild attribution, an institution may be tempted to log everything: prompts, drafts, deliberations, identity trails, and tool interactions. Whalen v. Roe recognized, in a now familiar register, the privacy threat implicit in the accumulation of vast amounts of personal information in computerized databanks, even while acknowledging that government functions often require collecting and preserving large quantities of data (Whalen v. Roe 605). The lesson for an utterance commons is direct: the cure for synthetic records cannot be maximal capture, because maximal capture expands inference scope and creates new forms of vulnerability for the very persons whose contestability interests the system is supposed to protect. This chapter therefore sets the boundary condition that the rest of the book must honor: authenticity infrastructure must be designed to authenticate institutional speech without becoming a general purpose surveillance layer, a constraint that later chapters treat as an architectural requirement rather than a rhetorical commitment (Whalen v. Roe 605; Carpenter v. United States 1).
If the chapter’s diagnosis is accepted, the operational change is clear. Institutions must stop treating documents as inert outputs whose quality is measured by fluency, completeness, or consistency, and must instead treat institutional utterances as procedure bound artifacts whose legitimacy depends on whether they can be contested at reasonable cost through attributable reasons and evidence links. The remaining risk is equally clear: absent explicit design constraints, generative drafting will predictably produce record saturation and responsibility diffusion, which can make outcomes harder to challenge even while making files look more professional. The next chapter therefore turns from description to behavior, explaining how reason laundering emerges as a strategic pattern under ordinary incentives, including incentives held by well meaning actors operating under throughput pressure.
Chapter Two: Reason Laundering as a Strategic Behavior
Institutions do not usually set out to evade accountability, and yet they repeatedly drift into documentary practices that make accountability hard to locate even for insiders. The stakes of that drift rise sharply when fluent drafting becomes cheap, because the institution can now produce reasons at scale while leaving the burden of testing those reasons on the person who must live under them. This chapter names the central behavioral pattern that emerges in that environment, reason laundering, and argues that it should be treated as a predictable outcome of ordinary incentives and organizational limits rather than as a pathology limited to bad actors.
Defining Reason Laundering
Reason laundering is the production of rhetorically adequate reasons whose provenance is diffused across tools, templates, prompts, and approvals such that the institution gains procedural cover while shedding examinable authorship. The definition is intentionally spare. It does not require deception about facts, and it does not require a conspiracy to mislead; it requires only that the organization be able to point to a finished justification while making it difficult to identify, and therefore difficult to examine, the decision procedure that actually generated the justification. In that respect, reason laundering is less like fabrication and more like what administrative law already treats as procedurally disqualifying, namely rationales that do not reliably reflect the agency’s own contemporaneous grounds for action. Chenery’s insistence that a reviewing court may not uphold agency action on grounds other than those invoked by the agency is a doctrinal expression of this deeper legitimacy requirement: reasons must be the institution’s reasons in a procedurally attributable sense, not merely a set of plausible words that could have justified the outcome (Securities and Exchange Commission v. Chenery Corp. 196 to 197). State Farm’s demand for a rational connection between facts found and the choice made similarly presupposes that the explanation offered is tethered to a real decision process rather than produced as an after the fact varnish for an already chosen result (Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co. 43).
Reason laundering therefore names an institutional failure mode that sits between two familiar categories. It is not simply error, because an error can be corrected without changing the documentary ecology that created it, and it is not simply dishonesty, because the pattern can arise even when every participant believes they are acting responsibly. It is, instead, a strategic behavior in the technical sense used by organizational theory: a stable pattern of conduct that is instrumentally rational for the institution given constraints, incentives, and bounded cognitive capacity, even if it undermines the institution’s legitimacy when challenged. Herbert Simon’s foundational claim that decision making is the heart of administration and that real organizational choice proceeds under bounded rationality is not an abstract psychological aside; it is an explanation for why institutions rely on routines, decision premises, and simplifications that make action possible under pressure (Simon). March and Simon sharpened the point by showing how organizations stabilize action through standard operating procedures, constrained attention, and goal displacement, thereby producing outputs that are often less the product of singular deliberation than of routinized selections among acceptable alternatives (March and Simon). Once generative drafting enters this environment, the production of acceptable rationales becomes even easier to routinize, and the diffusion of provenance becomes even easier to normalize.
Why Reason Laundering Does Not Require Bad Intent
To see why reason laundering can arise without malice, consider the daily conditions under which many institutional utterances are produced. Street level bureaucrats operate under chronic scarcity of time, information, and attention, and they are pushed to resolve cases at scale while managing uncertainty and public accountability (Lipsky). Managers and counsel are pushed to reduce variance, reduce litigation exposure, and maintain throughput, which encourages the use of templates, shared language, and pre approved rationales that are administratively legible even when they are thin as accounts of individual circumstances. When a generative system is added, it can produce a full sounding narrative that conforms to policy language and anticipates plausible objections, and it can do so from fragmentary inputs. That can improve clarity, but it also enables a subtle substitution: the narrative becomes the reason, and the organization begins to treat the existence of a narrative as evidence that a defensible reason exists. The institution does not have to be cynical for this substitution to occur. It is enough that the organization is overloaded and risk averse.
This is the core incentive structure that produces reason laundering as a strategic behavior. The institution benefits from producing text that appears to satisfy procedural expectations, because procedural expectations are often evaluated through documents rather than through direct observation of deliberation. At the same time, the institution benefits from keeping the provenance of those reasons diffuse, because diffused provenance reduces the likelihood that any one person can be cross examined about the chain of inference that led from evidence to conclusion. In Simon’s terms, the organization searches for a satisfactory justification under constraints, and once it finds a satisfactory justification, it stops searching, because the marginal benefit of further search is low relative to the marginal cost of time and exposure (Simon). In March and Simon’s terms, the organization selects among available reasons that are compatible with existing decision premises and organizational routines, and it reinforces those premises by repeating the language that has proven safe in prior rounds of oversight (March and Simon).
The result is a structural transformation of the record. In a world where reasons are costly to write, reasons often function as a proxy for effort, attention, and responsibility. In a world where reasons are cheap to generate, reasons can function as a proxy for nothing at all unless the institution also commits to procedural bindings that keep reasons coupled to evidence, roles, and constraints.
The Core Mechanisms of Reason Laundering
Reason laundering is not a single act. It is an ecology of mechanisms that reinforce one another, and the purpose of naming them is not moral condemnation but governance diagnosis.
One mechanism is record flood. When the institution can rapidly generate memos, notices, supplemental explanations, and narrative summaries, it can saturate the file to such an extent that the affected person cannot reasonably identify which claims are decisive and which are ornamental. The record becomes heavy, but the pathway to contestation becomes narrow, because the person must spend time and expertise simply determining where the institution’s operative theory of decision lives. This interacts with administrative review in an especially corrosive way. Judicial review under the Administrative Procedure Act is record based and reason based, and it relies on the possibility that a challenger can identify the grounds invoked and test them against the record (Administrative Procedure Act sec. 706). A flooded record can satisfy formal completeness while increasing the risk that review becomes a search problem rather than a legality test.
A second mechanism is plausible deniability through provenance diffusion. The organization can assemble a final utterance out of fragments generated by tools, edited by multiple roles, and approved through workflow gates, and the resulting text can be simultaneously authoritative and unowned. The manager can say the language came from policy. The policy team can say it was a standard template. The analyst can say the model drafted it. The counsel can say they reviewed for tone and risk but did not supply the rationale. Each statement can be true, and yet the collective outcome is that no accountable agent can be examined about why the institution said what it said. This is a direct threat to the legitimacy function that Chenery protects, because Chenery is not only a doctrine about judicial restraint; it is a doctrine that presupposes that an institution’s grounds are knowable as the institution’s grounds (Securities and Exchange Commission v. Chenery Corp. 196 to 197).
A third mechanism is post hoc rationalization through narrative elasticity. When drafting is easy, the institution can keep revising the explanation until it appears adequate, and the line between contemporaneous justification and later reconstruction becomes blurry inside ordinary workflows, not only in litigation. This is especially likely when the initial decision is made quickly under pressure and the narrative is written later, at which point the narrative can be shaped to fit policy language and anticipated oversight rather than shaped to reflect the actual deliberation that occurred. State Farm’s insistence on a rational connection between facts and choice is violated in spirit when the explanation is reverse engineered to connect to the facts in a way that was not actually the basis for the decision (Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co. 43). The organization may not experience this as wrongdoing; it may experience it as good practice, because the goal is to produce an explanation that survives review. Yet the institutional effect is the conversion of review into a test of rhetorical adequacy rather than a test of reasoned decisionmaking.
A fourth mechanism is procedural completion as a substitute for justification. Organizations frequently evaluate compliance through the completion of steps, and steps are often evidenced by documents. Merton’s classic account of bureaucratic dysfunction highlights how rule following can become a goal in itself, producing rigidity and ritualism when compliance with procedure displaces substantive purpose (Merton 560 to 568). In the generative era, procedural completion can be satisfied by generating the required text artifacts, which makes it even easier for the organization to treat documentary outputs as proof that the underlying reasoning occurred. The institution can then point to the file as evidence of care while the file is, in fact, a collection of fluent outputs that were never constrained to preserve a chain of custody for reasons.
Taken together, these mechanisms show why reason laundering is not a rare moral lapse. It is an equilibrium that institutions can slide into when text is cheap, oversight is text mediated, and accountability is costly.
Why This Matters for Benefits and Procurement
Reason laundering is a general pattern, but it matters differently across domains, and the book’s anchor domains force that specificity.
In benefits determinations, the danger is that a person’s right to challenge becomes nominal because the reason offered is not reliably examinable. Due process doctrine is not satisfied by the mere existence of notice. It is aimed at meaningful opportunity to be heard and at procedures that reduce risk of erroneous deprivation in light of stakes (Goldberg v. Kelly 267 to 268; Mathews v. Eldridge 335). When reasons are laundered, the person cannot identify what to challenge, cannot identify what evidence would rebut the rationale, and cannot identify which decision procedure must be questioned, and the contestation burden rises even if the letter reads more clearly.
In procurement and vendor attestations, the danger is that institutions externalize verification costs while retaining reliance benefits. A procurement file filled with fluent attestations can appear to satisfy diligence while actually functioning as boilerplate that no one can defend under audit. The risk is not only fraud by vendors. It is the institution’s own capacity to treat documentary completeness as proof of reliability, thereby converting a saturated record into a liability shield rather than an accountability tool. This is where later chapters will develop epistemic warranties, because the cure is not moral exhortation to verify more, but enforceable allocation of who must bear verification cost and what happens when provenance fails.
Counterargument and Response: Is This Just How Organizations Work
A serious counterargument begins by insisting that provenance diffusion is not laundering but collective work. Institutions, especially large ones, make decisions through distributed labor, and insisting on singular authorship misunderstands how organizational responsibility actually functions. In many settings, templates and shared language reduce arbitrary variance and help frontline workers comply with complex requirements, which can support equality and predictability. Moreover, requiring traceable reasoning might chill candid deliberation, might expose privileged communications, and might create discovery risks that cause counsel to prohibit tools entirely, thereby forfeiting the genuine clarity and consistency gains that generative drafting can bring. Finally, a strong version of the objection claims that what matters is the legality of the outcome, not the provenance of the prose, and that insisting on procedural custody for reasons risks elevating form over substance.
This objection is correct about the realities of distributed work, and the book’s proposal will fail if it treats organizations as if they were single minds. Yet the objection fails as a response to reason laundering because it confuses distributed responsibility with unaccountable speech. Organizations can distribute labor while still being able to specify which procedure produced a claim, which roles owned which inferences, and which evidence the institution relied upon, just as evidence law can authenticate items that moved through many hands by showing an adequate chain of custody rather than by demanding a single author (Fed. R. Evid. 901). The point is not to demand a diary of internal thought. The point is to make institutional speech contestable by making it attributable to a bounded procedure, so that review does not collapse into a test of fluency and the affected person is not forced to fight a fog. Chenery’s logic again matters: if an institution’s grounds cannot be located as its grounds, then review becomes substitution, and substitution is a transfer of authority away from lawful procedure and toward whoever can write the most plausible justification after the fact (Securities and Exchange Commission v. Chenery Corp. 196 to 197).
The privacy and chilling concerns are also real, and they are reasons for minimalism, not reasons for abandonment. A chain of custody for reasons, as this book will develop it, is not a demand to log prompts, drafts, or personal interiors by default. It is a demand to preserve verifiable links among claims, procedures, accountable roles, evidence pointers, and versioned constraints, with selective disclosure calibrated to stakes. Whalen’s recognition of the distinct risks posed by centralized, persistent databases is a warning against treating provenance as an excuse to build comprehensive dossiers (Whalen v. Roe 605). The design problem is therefore to prove enough for contestation without capturing more than is justified, and later chapters will treat that as a non negotiable constraint rather than as an afterthought.
Closing
If this chapter’s diagnosis is adopted, institutions gain a practical lens for governance under fluent drafting. Instead of treating documentary abundance as a sign of care, they treat reason laundering as a predictable equilibrium produced by ordinary incentives, and they evaluate documentary practice by whether it preserves examinable authorship and stable evidence linkage. The remaining risk is that, without an explicit measurement harness, organizations will respond to reason laundering by producing still more text about process, thereby deepening the flood and worsening contestability. That is why the next chapter turns to contestability as the scarce resource and introduces the contestability cost index as the backbone for evaluation, because legitimacy claims that cannot be tested against the cost of challenge tend to become theater.
Chapter Three: Contestability Is the Scarce Resource
Institutions can now generate reasons faster than anyone can interrogate them, and that changes the real distribution of power even when formal rules remain unchanged, because the right to challenge is only as strong as the practical conditions of challenge. A person does not lose due process merely because an appeal pathway still exists on paper; a person loses due process when the time, expertise, access, and evidentiary work required to mount a credible challenge become so high that the pathway is functionally unusable, and the institution can then treat procedural availability as a substitute for procedural meaningfulness (Goldberg v. Kelly 267; Mathews v. Eldridge 335). This chapter makes the book’s central evaluative move: it treats contestability as the scarce resource under fluent drafting, and it introduces the contestability cost index as the measurement harness that will discipline every later proposal.
What Contestability Means in Documentary Institutions
Contestability, as used in this book, is not a synonym for disagreement, nor is it the vague assurance that someone can complain. Contestability is the practical capacity of an affected person or oversight actor to identify what claim is operative, identify what evidence and policy the claim depends on, identify the accountable decision procedure that produced it, and then compel a reasoned response within the system’s own timelines and standards. Administrative law embeds this conception, even when it does not use the word. The Administrative Procedure Act makes the administrative record the object of review, and it authorizes courts to set aside agency action when the record cannot support the action under the governing standard, which presupposes that a challenger can locate the theory of decision and test it against the record (5 U.S.C. § 706). Chenery reinforces the point by insisting that agency action must stand or fall on the grounds the agency invoked, because review that supplies alternative rationales is not review of the agency’s reasons at all (Securities and Exchange Commission v. Chenery Corp. 196 to 197). State Farm then makes the burden substantive by requiring a reasoned explanation with a rational connection between facts found and choice made, which is not an aesthetic requirement but a contestability requirement, since without that connection the challenger cannot know what to contest and the reviewer cannot know what to evaluate (Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co. 43).
These doctrines reveal a stable procedural truth. Documentary institutions govern by producing reasons in records, and the legitimacy of that governance depends on whether those reasons are examinable as reasons rather than treated as final language artifacts whose internal coherence is mistaken for defensibility. Under generative saturation, the threat is not only that reasons become more numerous; it is that they become more difficult to pin down as attributable grounds for action, which increases the cost of contestation and decreases the probability that contestation can change an outcome.
Why Contestability Becomes Scarce Under Fluent Drafting
The book’s diagnosis is that generative drafting collapses the marginal cost of producing plausible reasons while leaving the marginal cost of challenging reasons largely intact, and scarcity therefore migrates from language to contestability. What used to constrain institutional speech was not virtue but friction: writing, revising, and coordinating a record took time, and time concentrated responsibility. When that friction weakens, the institution can produce more explanations, more supplemental rationales, more narrative reconstructions, and more procedural looking artifacts, and the challenger must spend more effort simply determining which of these texts is operative and which is decorative. This is the core asymmetry of the synthetic record environment.
The asymmetry interacts with due process doctrine in predictable ways. Goldberg treated the welfare recipient’s interest as urgent and treated the ability to contest as a real time safeguard against erroneous deprivation, not merely a later corrective (Goldberg v. Kelly 264 to 268). Mathews then made explicit that procedure must be calibrated to risk of error and value of safeguards, and it treated administrative burden as relevant but not decisive (Mathews v. Eldridge 335). A contestability analysis in the generative era therefore must ask a question the classic doctrine often leaves implicit: how much work must the affected person do, and how much specialized capacity must they have, to obtain meaningful review of a documentary decision. If the answer grows sharply because the record is saturated and reasons are laundered, then the system’s effective procedure has changed, even if formal rules have not.
The Contestability Cost Index
The contestability cost index is a measurement framework that quantifies how much time, expertise, access, and evidentiary work is required to challenge an institutional utterance credibly. It is not a moral score and it is not a claim that rights can be reduced to numbers; it is a governance instrument designed to prevent this book from drifting into slogans about transparency or accountability that cannot be tested. The index exists because institutions are prone to a specific self deception: they treat the presence of documents as evidence that a decision is contestable. The index forces the opposite discipline. It asks what it costs to contest, in practice, and it treats rising costs as a procedural failure mode.
The index is built around four variables that are deliberately chosen because they show up across domains without requiring surveillance to measure.
Time cost is the amount of time required to identify the operative claim, assemble the relevant record, understand the institutional standard, and prepare a challenge that the institution is obligated to answer rather than dismiss. Time cost matters because time is the universal bottleneck for affected persons, and because deadline driven systems convert time scarcity into forfeiture.
Expertise cost is the degree of specialized knowledge required to interpret the record, locate the applicable policy and procedural standard, and frame objections in the recognized idiom of the forum, whether that forum is an agency appeal, an internal review board, an arbitral process, or a procurement protest. Expertise cost matters because expertise scarcity converts contestation into a market good.
Access cost is the practical difficulty of obtaining the record elements and evidence pointers needed to test the institution’s claims, including the accessibility of citations, the availability of underlying data, and the existence of barriers such as confidentiality designations, redactions, or proprietary systems. Access cost matters because a right to challenge without access to the basis of action is often a right to plead.
Evidentiary burden cost is the amount of evidentiary work required to rebut the institution’s asserted rationale, including the need to locate external evidence, the need to obtain expert review, the need to respond to shifting rationales, and the need to meet standards of proof that may be opaque or inconsistently applied. Evidentiary burden matters because it is where reason laundering becomes operational: the institution can increase the challenger’s burden by producing multiple plausible rationales, and the challenger must then defeat several stories rather than interrogate one accountable ground.
The index produces a score not by pretending that these dimensions are commensurable in a philosophical sense, but by making them comparable in an operational sense. Each dimension can be scored on an anchored scale defined by what a reasonably capable person without specialized counsel can do within system deadlines, and the composite score can then be used to compare workflows before and after adoption of chain of custody for reasons. The point is to make contestability costs visible to decision makers who otherwise experience contestation failure only as external noise, complaints, or litigation risk.
How the Index Will Be Measured Without Building Surveillance
A measurement system can become a capture system if it is built carelessly, and the index is designed to avoid that drift. The index should be measured primarily through structured sampling of cases and adversarial testing of workflows, not through continuous monitoring of individuals. Sampling can examine a representative set of institutional utterances, reconstruct the steps required to contest them, and measure time and access barriers using documented process artifacts, without logging personal prompts or tracking individual behavior. Adversarial testing can simulate the challenger’s standpoint, attempting to identify the operative rationale, obtain the relevant evidence pointers, and force an accountable response, thereby measuring contestability as a system property rather than a personal trait.
This approach aligns with the deeper privacy constraint that the book has already committed to. Whalen recognized the distinct danger posed by centralized databases that accumulate sensitive information in durable form, including the risk of disclosure and the risk of future misuse even when present use is lawful (Whalen v. Roe 605 to 606). Carpenter similarly emphasized that systems of persistent data collection can alter the relationship between person and state by enabling comprehensive reconstruction of life patterns, a structural shift that cannot be treated as a minor increment in ordinary recordkeeping (Carpenter v. United States 11 to 13). A contestability measurement program that requires logging individual drafting behavior at fine granularity would therefore replicate the very legitimacy failure it is meant to repair. The design principle is strict: measure contestability at the level of utterances and procedures, not at the level of personal interiors, unless law and stakes clearly justify more.
What the Index Reveals in the Anchor Domains
The index is introduced here, rather than later, because it makes clear what the book is trying to change.
In benefits determinations, the index will reveal whether a denial is contestable for an ordinary claimant without counsel, not in the abstract, but in the concrete sense of whether the claimant can identify the operative rule, the evidence relied upon, and the accountable decision step in time to mount a response that the system must answer (Goldberg v. Kelly 267; Mathews v. Eldridge 335). A fluent denial letter that cites policies without stable pointers to the evidence, that shifts its theory across iterations, or that routes the claimant into opaque evidentiary demands will score as high cost even if the prose is exemplary.
In procurement and vendor attestations, the index will reveal whether a claim of compliance is testable without heroic effort, and whether the institution has shifted verification work onto counterparties through boilerplate that is rhetorically complete but procedurally thin. Here contestability is not only a vendor’s ability to protest, but also an auditor’s ability to evaluate whether claims in an RFP response, a security attestation, or a compliance narrative are grounded in verifiable procedure rather than in fluent text. When attestations cannot be tested without bespoke discovery or invasive access, the system has created an epistemic asymmetry that later chapters will address through evidence packets and contractual warranties.
Counterargument and Response: Can Rights Be Measured
A serious objection to the index is that it risks turning procedural justice into a metric, thereby inviting managerial optimization rather than genuine legitimacy, and it risks privileging what can be counted over what matters, especially the dignity and experiential dimensions of being heard. The objection continues that any index will be gamed, that institutions will learn to lower the score without meaningfully improving contestability, and that quantification can become a new form of compliance theater rather than an antidote to it.
These concerns are valid and must be conceded as constraints rather than dismissed as misunderstandings. Yet the objection fails as a reason to avoid measurement, because the alternative to explicit measurement in complex institutions is implicit measurement by proxy, and the proxies are usually worse. Organizations already measure what they care about, often by throughput, resolution time, or document completion, and those measures can directly undermine contestability by rewarding speed and rhetorical completeness rather than examinable grounding. Merton’s analysis of bureaucratic ritualism describes precisely how procedural means can displace substantive ends when organizations are judged by rule compliance rather than by the purpose the rules were meant to serve (Merton 563 to 566). The index is designed to reverse that displacement by making the end itself, practical contestability, the measured object.
The book’s response is therefore to treat the index as a necessary but insufficient instrument, and to bind it to adversarial testing and doctrinal review. A falling contestability score is not proof of legitimacy; it is evidence that contestation has become cheaper, which is a condition of legitimacy. A rising score is an alarm that the institution is producing reasons that cannot be effectively challenged, which should trigger governance controls such as stronger chain of custody requirements, clearer evidence pointers, or narrower theories of decision. The index does not replace legal standards. It makes it more likely that legal standards will be satisfiable in practice, because it reveals when procedural promises have become impracticable.
Closing
If this chapter’s proposal is adopted, the book’s project becomes testable. Institutions will no longer be able to claim legitimacy improvements merely by producing more documentation, because the contestability cost index will reveal whether the affected party’s ability to challenge has actually improved. The remaining risk is that the index itself becomes an object of optimization divorced from its purpose, or that measurement encourages intrusive monitoring. The remedy, which the rest of the book will insist upon, is to keep measurement anchored in procedure bound artifacts and adversarial tests, to keep privacy constraints explicit, and to use the index as an accountability instrument that forces design proposals to demonstrate contestability gains rather than promise them.
Chapter Four
The Institutional Utterance as Procedure Bound Artifact
An institution does not merely describe the world in its documents. It acts. It allocates benefits, terminates employment, denies claims, triggers investigations, sets prices, and routes people into and out of protections by issuing utterances that the surrounding system treats as authoritative. When generative drafting collapses the marginal cost of producing reasons, the institution gains a new capacity to speak fluently at scale while quietly severing the coupling between what it says and any accountable procedure that can be examined; legitimacy then fails in a familiar way, not because the prose is wrong, but because contestability becomes infeasible for the person who must live under the utterance. The central claim of this chapter is therefore austere and operational: authenticity is not a metaphysical property of text, and it is not an aesthetic property of “human sounding” language; authenticity is a property of attributable procedure, meaning the ability to show that an utterance was produced by a defined decision process, within defined constraints, with role aligned responsibility and evidence linkage adequate to the stakes, and with a disclosure boundary that does not turn verification into surveillance.
Authenticity Is a Procedural Predicate, Not a Stylistic One
A legal system that has had to decide whether records are what they purport to be has never relied on fluency as its foundation. The Federal Rules of Evidence define authentication as a sufficiency showing, requiring “evidence sufficient to support a finding that the item is what the proponent claims it is” (Fed. R. Evid. 901(a)). The rule’s illustrative examples are revealing because they do not fetishize authorship as a romantic interior fact; instead, they treat authenticity as something established through methods, context, and procedures, including evidence describing a “process or system” and showing that it “produces an accurate result” (Fed. R. Evid. 901(b)(9)). The 2017 amendments that added streamlined self authentication pathways for electronic evidence move the same way: they do not declare digital material reliable because it is widely used or because a corporation says it is, but because a qualified person can certify that an electronic process or system “produces an accurate result,” and because data copied from a device can be authenticated by a process of digital identification (Fed. R. Evid. 902(13)–(14)). Even where the doctrine is about admissibility rather than governance, the epistemology is the same one institutions should internalize for legitimacy: if you want your utterance to carry force, you must be able to defend the procedure that produced it, not merely the surface coherence of the sentence.
This point becomes sharper once we acknowledge what generative drafting changes. If an institution can produce ten distinct, well formed “reasons” for a decision in the time it used to take to produce one, then the institution can saturate the record with plausibility while leaving the affected party to pay the full contestability cost of sorting, disproving, and re attributing. Under those conditions, authenticity cannot sensibly mean “a human wrote this” because the institutional problem is not whether a person touched the keyboard; it is whether any identifiable decision procedure can be examined under challenge, and whether the institution can be held to the reasons it offered as reasons, rather than treating those reasons as interchangeable rhetoric. The procedural concept of authenticity is therefore a governance constraint: it forces the institution to commit to a specific pathway of production that can be tested.
The Institutional Utterance as a Procedure Bound Artifact
In this book’s terms, an institutional utterance is a document, notice, letter, record entry, or explanation that functions as an institutional speech act with allocative consequences, relied upon for enforcement, liability allocation, or justification. If that is true, then the utterance should be treated as a procedure bound artifact: an output whose legitimacy depends on demonstrating its linkage to a bounded process, rather than an output treated as valid so long as it is coherent and internally consistent.
The phrase “procedure bound” matters because it disallows a common failure mode that becomes tempting under generative conditions: the institution produces text first and only later decides what the text is supposed to mean, who is supposed to own it, and what evidence it is supposed to be grounded in. A procedure bound artifact reverses the direction of travel. The institution defines the authorized decision procedure in advance, defines the constraints that govern drafting and review, and produces the utterance as the terminal artifact of that procedure, with minimal but sufficient metadata for contestability. The point is not maximal transparency and it is not a demand to expose deliberation; the point is a stable linkage between claims and accountable production steps.
This procedural framing is not novel in the world of security engineering, and that is part of its usefulness here. Certificate Transparency was designed precisely because relying on assertions of authority without publicly auditable procedure created systemic risk; the protocol’s aim is to “publicly log” the existence of certificates in a way that enables auditing and detection of suspect issuance, shifting trust from private assurances to verifiable publication and inclusion proofs (Laurie, Langley, and Kasper, RFC 6962, Abstract). The Time Stamp Protocol similarly treats time claims as something to be bound to an operational procedure with security requirements for the time stamping authority, rather than as a story a system tells about itself after the fact (Adams et al., RFC 3161, Abstract). These infrastructures are not perfect analogies to institutional speech, but they are instructive: where the cost of forgery or post hoc alteration is high, mature systems move toward append only logs, attestations, and independently checkable proofs, precisely because language about integrity is not integrity.
The normative leap of this chapter is to say that institutional utterances need the same maturity, adapted for governance and bounded by privacy. An utterance is authentic, in the only sense that matters for legitimacy, when the institution can show that it was generated by a defined decision procedure, within defined constraints, with traceable responsibility and evidence linkage appropriate to the stakes, and with a disclosure boundary that preserves interior life.
Integrity, Provenance, Attribution, and Warranty Are Distinct Layers
One reason modern compliance regimes drift into theater is that they collapse different questions into one word, then treat that word as solved when any one layer is partially satisfied. The procedural model requires separating four layers that are often conflated: integrity, provenance, attribution, and warranty.
Integrity answers a narrow but indispensable question: has the artifact been altered in an unauthorized way since it was finalized. In technical systems, integrity is established through cryptographic hashing, signing, and tamper evident logs, all of which bind an artifact to an unambiguous fingerprint and make alteration detectable. The point of Certificate Transparency logs and related mechanisms is not to prove benevolence; it is to make equivocation and undetected alteration harder by making publication auditable (Laurie, Langley, and Kasper, RFC 6962, Abstract). For institutional utterances, integrity mechanisms matter because a person cannot contest what they cannot stably reference; contestation requires that the utterance the person received is the utterance the institution will later be held to.
Provenance is different. Provenance answers how the artifact was produced, under what constraints, and via which controlled steps. In the software supply chain world, SLSA treats provenance as “verifiable information about software artifacts describing where, when and how something was produced,” with stricter requirements at higher assurance levels (SLSA, “Provenance”). The institutional analog is not to log every keystroke or capture private deliberation; it is to provide a minimal map of production that makes it possible to ask the only questions that matter under challenge: which approved procedure produced this utterance, which policy constraints governed drafting, which evidence pointers were required, and what review steps occurred. Provenance is the backbone of contestability because it tells the challenger where to look and what claims are being made about process, not merely about outcomes.
Attribution is narrower than provenance and is often misunderstood. Attribution answers who is responsible for the act of issuance in a way that can carry legal and institutional consequences. Electronic transactions law makes the concept explicit: an electronic record or signature is “attributable to a person if it was the act of the person,” and the act may be shown “in any manner,” including by the efficacy of a security procedure used to determine to whom it is attributable (815 ILCS 333/9(a)). Federal law similarly contemplates records formed through “electronic agents” so long as the action of the agent is “legally attributable to the person to be bound” (15 U.S.C. § 7001(h)). The institutional lesson is direct: attribution is not defeated by automation, but it must be engineered. If the utterance is consequential, the institution must be able to identify accountable roles who own the issuance and can be examined about the procedure, even if they did not personally draft every sentence. Otherwise, responsibility diffuses into a cloud of tools, templates, and approvals, and contestability collapses into ritual.
Warranty is distinct from all three. Warranty answers what the institution promises about the utterance and what remedies attach if that promise fails. This is the layer that converts “trust us” into enforceable obligation and will become central in the later chapters on contractual reliance, but it already matters here because it clarifies a common category error: a signed artifact with impeccable integrity can still be untrustworthy if the institution is unwilling to warrant anything about how it was produced or what evidence it rests on. The Uniform Commercial Code’s express warranty concept is one canonical way law translates representations into enforceable commitments: an affirmation of fact or promise that becomes part of the basis of the bargain creates an express warranty that the goods shall conform (U.C.C. § 2-313). In our setting, the relevant move is not to force institutions to warrant the truth of every sentence, but to warrant the procedure classes of utterances must satisfy, and to attach remedy triggers when the institution cannot produce the promised chain of custody for reasons.
Once these layers are separated, a pervasive failure becomes visible. Many institutions attempt to substitute integrity for provenance, and provenance for attribution, and attribution for warranty. They will sign the final PDF, retain it in a system of record, and call the problem solved, even though no one can say which procedure generated the reasons, which evidence was required, who is accountable for the decision, or what remedy exists if the utterance is procedurally defective. The procedural model treats this substitution as illegitimate because it preserves surface legitimacy while abandoning contestability.
Procedure as the Source of Authenticity in Machine Mediated Drafting
If authenticity is a property of attributable procedure, then machine mediated drafting becomes governable, not by banning tools or insisting on human purity, but by binding drafting to defined procedures that produce contestable artifacts. This has three immediate implications.
First, institutions must treat the final utterance as the only artifact that needs to be integrity protected at maximal strength, while treating intermediate drafts as controlled inputs whose retention is governed by privacy and necessity. The chain of custody for reasons will later formalize this distinction, but the intuition is already present in evidence doctrine: what matters is the ability to authenticate the item offered, not the ability to replay every internal step of thought (Fed. R. Evid. 901(a)).
Second, provenance should be minimal, explicit, and stake sensitive. The engineering world provides a helpful caution: provenance that tries to capture everything becomes a new attack surface and a new burden, while provenance that captures too little becomes decorative. SLSA’s emphasis on verifiable predicate structures rather than narrative summaries is instructive here because it aims to standardize what must be asserted to enable verification while avoiding an unbounded capture of development interiors (SLSA, “Provenance”). The institutional analog is a constrained set of fields, later specified in Appendix B, that identify procedure, role accountability, evidence pointers, and policy constraint versions, without logging sensitive prompt contents unless law and stakes require it.
Third, attribution must be engineered as a governance decision, not treated as a natural byproduct of workflow software. UETA’s attribution rule is permissive on methods but strict on the requirement that the act be attributable and showable (815 ILCS 333/9(a)). That is a blueprint for institutions: decide which roles are legally and operationally bound by the utterance, require their attestation at defined points, and ensure that the institution can show the efficacy of its security procedures in establishing attribution. This is how you prevent reason laundering without demanding impossible mind reading about “who really wrote” a sentence.
Counterargument: Procedure First Authenticity Creates Bureaucracy and Surveillance
The most serious objection to treating institutional utterances as procedure bound artifacts is that it risks creating exactly what the book refuses to romanticize: thicker bureaucracy that produces more documentation rather than more contestability, and authenticity infrastructure that becomes surveillance infrastructure. The concern is not hypothetical. If institutions respond by logging every prompt, storing every draft, identifying every contributor, and recording every micro decision to defend themselves, then the utterance layer becomes a high resolution map of interior work, a tempting substrate for monitoring, retaliation, and secondary uses. A second version of the objection is practical rather than moral: procedural authenticity may slow decisions, increase compliance costs, and invite litigation over technical defects, thereby reducing institutional capacity to act.
These objections deserve to stand in full strength because they identify the chief danger of this book’s project. A procedural notion of authenticity can be perverted into a regime of maximal capture, and the language of accountability can become a pretext for building dossiers.
The response is not to abandon procedure, but to specify procedural minimalism and selective disclosure as non negotiable design constraints. Evidence law already distinguishes between what must be sufficient to support a finding and what must be exhaustively documented (Fed. R. Evid. 901(a)). Technical identity systems similarly show that verification can be designed around claims and proofs without demanding the full underlying narrative of the person, as the Verifiable Credentials model explicitly frames credentials as claim sets secured against tampering with attention to privacy considerations such as correlation risks and data minimization (Sporny et al., “Verifiable Credentials Data Model v2.0,” sec. 8). The governance translation is straightforward: store and protect the final utterance with strong integrity guarantees; store minimal provenance fields necessary for contestability; store attribution in role based terms; and explicitly prohibit retention of sensitive drafting internals by default, escalating retention only when stakes, legal obligations, or active disputes justify it. If an institution cannot articulate why a piece of internal drafting data is necessary for contestability or compliance, it should not be collected.
As for the fear of technical defect litigation, the answer is to design the procedure layer so that it is legible and testable, not ornate. The procedural aim is to reduce contestability costs by making challenge pathways clearer and narrower, not to create new, fragile formalities. Where defects occur, the remedy should often be procedural correction rather than substantive defeat, a principle that later chapters will tie to doctrinal and contractual mechanisms. The point is that authenticity is a procedural predicate for legitimacy, not a trap door to invalidate every institutional act.
Closing: What This Chapter Changes, and What Remains Risky
If the institutional utterance is treated as a procedure bound artifact, the institution can no longer hide behind fluent reasons that cannot be traced to accountable procedure, and the affected party gains a more realistic path to contestation because the challenge is directed at a bounded chain rather than at an ocean of text. This reframes the legitimacy problem from an argument about whether generative drafting is good or bad to an argument about what must be true of an utterance for it to carry force: integrity for stable reference, provenance for procedural examinability, attribution for responsibility, and warranty for enforceable obligation.
What remains risky is the central tension that will structure the next two chapters: provenance can become surveillance, and minimalism can become theater. The way forward is to formalize the chain of custody for reasons as a structured relation that is minimal but sufficient, paired with explicit disclosure boundaries and selective verification mechanisms. That is the work of the next chapter.
Chapter Five
Chains of Custody for Reasons
In documentary institutions, the fight is rarely over whether a document exists, because documents proliferate; the fight is over whether the document can be treated as the institution’s accountable speech in a way that permits meaningful challenge. When fluent drafting becomes cheap, the institution can generate reasons at scale while leaving the burden of testing those reasons on the person who must appeal, protest, grieve, or litigate, and the system’s legitimacy then depends less on the elegance of any single letter than on whether the institution can prove, at reasonable cost and without expanding surveillance, that its utterance was produced by a bounded decision procedure linked to evidence. This chapter proposes the core infrastructure that makes that proof possible: a chain of custody for reasons.
A chain of custody for reasons is a structured linkage among claim, decision procedure, accountable roles, evidence pointers, and versioned constraints that makes an institutional utterance contestable. The phrasing is intentionally severe. It does not say that the institution must disclose everything it thought, every draft it produced, or every prompt it typed. It says something narrower and more enforceable: the institution must be able to show that a consequential utterance is what it purports to be, namely the output of a defined procedure under defined constraints, and it must be able to show this in a form that allows the affected party and the reviewer to identify the operative theory of decision and test it against the evidentiary substrate. That is the documentary analog of authentication, which in evidence doctrine is not a vibe and not a branding exercise, but a sufficiency showing that an item is what the proponent claims it is (Fed. R. Evid. 901(a)). The point of importing this epistemology is not to turn governance into trial practice, but to insist that legitimacy in text mediated authority requires a parallel discipline: documents that do things must be procedurally identifiable as the products of accountable doing.
The chain of custody concept also clarifies a common confusion in administrative governance, especially under generative saturation. The Administrative Procedure Act commits review to “the whole record” and authorizes courts to set aside action that is arbitrary or capricious or otherwise unlawful (5 U.S.C. § 706). Yet the record is only reviewable when the grounds invoked are stable and attributable as the institution’s grounds, a requirement Chenery makes explicit by refusing to allow courts to affirm agency action on rationales the agency did not invoke (Chenery 196 to 197). In a saturated record, the mere existence of more text does not guarantee that the grounds are stable. It can instead create a fog in which multiple plausible rationales coexist, and the institution can slide among them. A chain of custody for reasons forces the institution to commit to one accountable pathway from evidence and policy to claim, which is the condition under which review and challenge can remain meaningfully bounded.
A chain of custody for reasons must be designed as a minimal map, not as a maximal diary, and that design choice is where the concept becomes operational rather than aspirational. The artifact that expresses this minimal map is what this book calls a reason graph. A reason graph is not a transcript of deliberation. It is the minimal structured representation of the institution’s asserted pathway from evidentiary inputs and governing rules to the operative claims in the utterance. It should separate, as a matter of schema rather than rhetoric, three kinds of content that organizations routinely blur: observations, inferences, and judgments. Observations are what the institution asserts it saw or received, such as a document submission, a time stamped event, a policy status, a measured value, or a witness account. Inferences are the transformations applied to observations, such as eligibility calculations, risk scoring, compliance determinations, or causal attributions. Judgments are the institutional choices and normative conclusions, such as denial, termination, disqualification, sanction, or approval. Reason laundering thrives precisely where these layers are merged into fluent narrative, because narrative can hide which parts are evidence, which parts are inference, and which parts are discretionary judgment; a reason graph makes the separations explicit so that contestation can target the correct layer.
The reason graph must also encode what the institution is committing to as operative. The document itself may contain background explanation, empathy language, and anticipatory responses to anticipated objections, all of which may be helpful, but contestability requires an explicit identification of the claims that actually carry the decision’s force and the rule and evidence dependencies of those claims. This requirement is not a stylistic preference. It is what makes Chenery’s constraint workable in practice under fluent drafting, because without an identified operative rationale the institution can always say, under pressure, that it meant something else (Chenery 196 to 197). It is also what makes State Farm’s demand for a rational connection between facts and choice testable as a procedural property rather than a literary one, because the graph can show what facts were treated as decisive and how they were connected to the outcome (State Farm 43).
A chain of custody for reasons, however, is not only a conceptual schema. It is a custody system. Custody in this context means two things that must be kept distinct. The first is integrity custody: the ability to show that the final utterance and its reason graph have not been altered in an unauthorized way since issuance. The second is procedural custody: the ability to show that the utterance was produced through a defined sequence of authorized steps under specific constraints. Integrity custody is relatively mature in engineering, and it can be achieved without logging personal interiors, because it can focus on final artifacts rather than on every intermediate trace. The security world’s move toward transparency logs is instructive here because it shows how a system can make certain claims auditable by committing to append only publication and independently checkable inclusion proofs. Certificate Transparency version 2.0 describes a protocol for publicly logging the existence of TLS certificates so that anyone can audit issuers and logs and notice suspect issuance (Laurie et al., RFC 9162, sec. 1). The institutional analog is not to publish people’s benefit decisions to the world, but to use the same pattern inside trust boundaries: final utterances can be sealed to the affected party and appropriate oversight bodies while still being committed to an append only integrity mechanism that prevents quiet revision after the fact.
Procedural custody is more delicate because it is where authenticity infrastructure can become surveillance infrastructure. The temptation, especially for legal defensibility, is to retain everything: drafts, prompts, internal chat, meeting notes, and tool traces. That temptation must be constrained, both because it creates new harms and because it can defeat contestability by producing yet another flood. The design objective is instead to retain minimal, verifiable procedure events that are sufficient to establish that required steps occurred, that accountable roles attested at the right points, that governing constraints were in force, and that evidence pointers existed and were stable. NIST’s guidance on log management, while written for security operations rather than governance legitimacy, is useful precisely because it emphasizes that logs are records that must be managed with clear retention, integrity, and access controls, not piles of data collected by default without purpose (Kent and Souppaya, SP 800 92, sec. 2). The parallel lesson for documentary due process is that procedure logs must be scoped, protected, and justified as evidence of procedure, not as a behavioral telemetry system.
The most conceptually important element of procedural custody, and the one institutions most often neglect, is versioned constraints. If an utterance is produced with machine mediated drafting, the institution must be able to say what constraints governed the drafting and decision process at the time, including the policy version, the template version, the decision rubric version, and the model or tool policy constraints that were applicable. Otherwise, the institution can shift the meaning of its own reasons by retroactively shifting the constraints that allegedly governed them. This is the same structural logic that software supply chain security now treats as essential: provenance is verifiable information about an artifact describing where, when, and how it was produced, and higher assurance requires stricter provenance requirements (SLSA, “Provenance”). The governance translation is direct: an utterance cannot be contestable if the affected party cannot know what rule set it was produced under, and oversight cannot be meaningful if the institution cannot prove which constraint set was operative when the utterance was issued.
The question that immediately follows is what must be visible to the affected party and what can remain private. The chain of custody for reasons is not a demand for maximal transparency. It is a demand for calibrated disclosure that makes contestation possible. At minimum, the affected party must be able to see the operative claims, the governing rule identifiers, the evidence pointers that the institution relied upon, the accountable issuance roles, the contest pathway, and the stability commitments that prevent post issuance rationale drift. What can often remain private are the drafts, the internal deliberation, and the raw tool interactions, so long as the system can still produce a verifiable reason graph and custody trace sufficient for challenge. The conceptual machinery for this calibrated disclosure is already present in modern credential standards that attempt to make claims verifiable while respecting privacy and minimizing correlation. The Verifiable Credentials Data Model provides a way to express and cryptographically secure claims while explicitly addressing privacy considerations, including correlation risks and the need for selective disclosure patterns (Herman et al., Verifiable Credentials Data Model v2.0, sec. 8). The institutional use of this idea is not to turn every decision into an identity credential, but to adopt the principle that one can prove procedural facts about an utterance without exposing everything about the people involved or the internal drafting process.
The strongest objection to a chain of custody for reasons is that it will either be gamed into theater or expand into surveillance. The theater risk is real: institutions can generate formal looking reason graphs that are vacuous, or they can comply by attaching pointers that lead nowhere, or they can overwhelm challengers with structured noise rather than narrative noise. The surveillance risk is also real: a custody system can become a comprehensive monitoring layer that captures sensitive drafts, personal data, and private thought under the banner of accountability, recreating the databank dangers Whalen treated as distinct even where the state had legitimate administrative aims (Whalen 605 to 606). The response is to treat minimalism, stake sensitivity, and selective disclosure as enforceable requirements rather than as ethical hopes. The chain of custody must be defined so that it is auditable against concrete tests: can a challenger identify the operative rationale, retrieve the evidence pointers, and force a reasoned response without extraordinary effort. If the answer is no, the chain is defective, regardless of how beautiful the schema looks. At the same time, the custody system must be bounded so that it does not create durable dossiers of personal interiors, and it must explicitly prohibit retention of sensitive drafting internals absent a defined legal or high stakes justification, because the temptation to capture everything is itself a governance hazard in a world of cheap storage and expensive trust.
If this chapter’s proposal is adopted, the institution’s documentary posture changes in a specific way: it stops treating the document as the thing that carries legitimacy, and it starts treating the document plus its custody for reasons as the minimum unit of authoritative speech. The affected party gains a more usable pathway to contestation because the institution has committed to an operative rationale that is bounded, attributable, and evidence linked, and the institution gains a defensible way to use machine mediated drafting without turning fluency into a substitute for accountability. What remains risky, and what the next chapter addresses directly, is the privacy boundary: how to build verification that is strong enough to defeat reason laundering while narrow enough to avoid becoming a generalized surveillance substrate. The chain of custody for reasons is therefore not the endpoint of the theory of utterance. It is the bridge that makes contestability a property of systems rather than a privilege purchased by those with time, counsel, and stamina.
Chapter Six
Privacy and Interior Life as a Design Constraint
The project of making institutional speech verifiable fails the moment it makes institutional observation total. An utterance commons that proves who said what, and why, by capturing everything that was thought, typed, drafted, and inferred will not repair legitimacy; it will relocate legitimacy into a technical apparatus that expands institutional power while calling the expansion accountability. The stakes are not rhetorical. When provenance becomes a general purpose memory, verification ceases to be a due process support and becomes a life management substrate, and the person who must challenge the institution is forced to pay for contestability with exposure of interior life. This chapter therefore states the book’s strongest counterposition as a design constraint: authenticity infrastructure can become surveillance infrastructure, and a legitimate chain of custody for reasons must make verification possible without requiring maximal capture of persons.
The constraint has deep roots in constitutional privacy doctrine even where the doctrine is not framed as a general “right to informational privacy.” Whalen, in allowing New York’s controlled substances database, still recognized that privacy includes an interest in avoiding disclosure of personal matters, and it treated the danger of accumulated dossiers as structurally distinct from isolated disclosures, emphasizing the risks of storage, retrieval, and secondary use in computerized systems (Whalen 599 to 600; 605 to 606). Carpenter sharpened the same structural insight for the modern sensorium: the problem is not a single data point but a comprehensive chronicle, where persistent collection creates an architecture capable of reconstructing life patterns, thereby changing the practical meaning of privacy even when each fragment might look innocuous in isolation (Carpenter 12 to 13). The institutional translation is direct. If the utterance layer is built as a persistent, high resolution reconstruction engine for drafting behavior, internal deliberation, and personal data, then the very system meant to make authority contestable will make persons legible in ways that chill challenge, amplify power asymmetries, and intensify the cost of dissent.
The central move of this chapter is therefore a reversal that must remain explicit throughout the rest of the manuscript. The goal is not to make institutions know more. The goal is to make institutions prove more, in bounded ways, about their consequential utterances. Proof is narrower than knowledge. Knowledge wants the full story. Proof needs only what is sufficient to support a finding that the thing is what it purports to be, which is the logic evidence law uses when it treats authentication as a sufficiency showing rather than a demand for exhaustive disclosure (Fed. R. Evid. 901(a)). When applied to institutional speech, this means a chain of custody for reasons must be constructed to provide sufficiency for contestation, not completeness of institutional memory.
To make that constraint operational, the chapter adopts a privacy engineering vocabulary that treats privacy as a system capability problem rather than a compliance aspiration. NISTIR 8062 introduces privacy engineering objectives precisely to bridge the gap between policy commitments and implementable system behavior, naming predictability, manageability, and disassociability as objectives that help engineers build systems that implement privacy requirements and reduce privacy risk (Brooks et al. 1 to 2; 12 to 14). The NIST Privacy Framework then incorporates these objectives into an enterprise risk framing, explicitly positioning privacy risk as an organizational risk that arises from data processing and can be managed through capabilities and governance rather than after the fact assurances (NIST, Privacy Framework 35 to 36). These objectives provide a disciplined way to describe what the utterance commons must do if it is to remain legitimate.
Predictability, in this context, means that individuals should be able to reasonably understand how and why information about them is processed in relation to institutional utterances, which in practice requires that chains of custody for reasons do not smuggle in hidden capture of prompts, drafts, or personal data under the guise of verification. Manageability means that the institution must be able to provide granular controls, including access, correction, retention limits, and purpose constraints, so that the procedural evidence needed for contestability does not become an uncontrolled archive available for internal fishing expeditions. Disassociability means the system should be able to process the procedural facts needed for verification while reducing unnecessary linkability to identified persons, thereby limiting correlation and secondary use (Brooks et al. 12 to 14). In other words, the utterance commons must be built so that the institution can demonstrate that an utterance is procedurally authentic while refusing the institutional temptation to turn procedure evidence into behavioral telemetry.
A privacy constrained chain of custody for reasons therefore requires a strict separation between what must be proven and what must not be captured. What must be proven is that the utterance was produced by a defined decision procedure, under defined constraints, with accountable roles, and with stable evidence pointers adequate to the stakes. What must not be captured by default are the internal drafting interiors that are not necessary to that proof, especially raw prompts, drafts, and free form deliberative notes that can encode sensitive personal information about claimants, employees, patients, or internal dissenters. The difference is not philosophical. It is architectural. A system that stores drafts and prompts by default creates a durable reservoir of sensitive content that will predictably be repurposed, whether for performance management, litigation positioning, fraud detection creep, or curiosity, because institutions are not immune to function drift. Whalen’s warning about the hazards of computerized accumulation is precisely about this drift, where the existence of stored information changes the institutional incentives around access, retrieval, and use even when the original purpose was narrow (Whalen 605 to 606).
This is where privacy preserving verification patterns become mandatory rather than optional. The chapter’s approach is to treat the chain of custody as a set of verifiable claims about procedure, not as a replay of content. The W3C Verifiable Credentials Data Model, while designed for a different problem space, articulates a useful caution: the persistence of digital information and the ease of correlating disparate sources can make machine verifiable credentials a privacy risk if privacy preserving goals are not designed in, and it explicitly frames privacy considerations as central rather than peripheral (Sporny et al., sec. 8). The analog for institutional utterances is that procedural attestations should be designed to support selective disclosure, revealing only what is necessary for the affected party to contest and for oversight to review, while withholding unnecessary correlatable detail. This does not require exotic cryptography to be conceptually valid, though later appendices will specify implementable patterns. It requires a commitment to structure: procedure identifiers rather than transcripts, constraint versions rather than raw prompts, evidence pointers rather than embedded sensitive content, and role accountability rather than identity exhaust.
The privacy boundary also requires an explicit stance on attribution. The law already contemplates that records created with electronic agents can be legally attributable to the person to be bound, which means institutions cannot evade responsibility by pointing at automation, but it also means attribution can be established through security procedures without disclosing intimate drafting content (15 U.S.C. § 7001(h)). A privacy respectful utterance commons should therefore treat attribution as a role bound attestation about issuance and review, not as a demand to identify every micro contributor or to preserve every intermediate linguistic trace. Attribution should locate responsibility where it belongs, at the level of accountable roles and decision rights, while minimizing the collection of detailed behavioral data that would transform accountability into surveillance.
In practical terms, the privacy constraint forces a stake sensitive disclosure regime. The affected party must receive enough to mount a credible challenge: the operative claims, the governing rule identifiers, the evidence pointers, the accountable issuance roles, and the contest pathway. Oversight bodies may require more, but even there the principle remains that additional disclosure must be justified by stakes and legal authority, and that the system should enable disclosure without forcing universal retention of sensitive content. Carpenter’s core warning about comprehensive chronologies is again the relevant structural constraint: when systems are built for comprehensive reconstruction, they exceed the legitimate needs of most contestation events and quietly normalize a level of visibility that changes the relationship between person and institution (Carpenter 12 to 13). The utterance commons must therefore be designed so that most challenges can be resolved with bounded procedural proofs, and only exceptional cases require escalation to deeper internal material.
The strongest counterargument to this privacy constrained approach is that it will weaken defensibility. Counsel and auditors may argue that if prompts and drafts are not retained, then the institution cannot demonstrate it acted without bias, cannot reconstruct how the decision was formed, and cannot respond to allegations that the machine mediated process introduced error or discrimination. A second argument is operational: selective disclosure and disassociability may complicate investigations, slow response to incidents, and prevent internal accountability for misuse. A third argument is that privacy constraints create an evidentiary asymmetry, where the institution is asked to prove procedural authenticity while refusing to retain the very materials that would allow maximal proof.
These arguments have force because they identify real institutional needs: error analysis, bias investigation, security incident response, and litigation defense. The response is not denial. The response is to insist on proportionality, explicit escalation rules, and purpose limitation as part of the design. The default should be minimal retention, because most utterances do not justify durable capture of sensitive drafting interiors. Where stakes are high, where legal duties require deeper reconstruction, or where an incident has been credibly alleged, the system can escalate to a higher evidentiary tier with tighter access controls, narrower scope, and documented justification, so that the exception does not become the norm. This is the difference between building a system that can support investigation and building a system whose baseline is investigatory capture. The former is compatible with legitimacy; the latter is a recipe for the surveillance inversion this chapter refuses.
If this chapter’s constraint is adopted, the utterance commons becomes a privacy constrained verification layer rather than an institutional panopticon. Contestability improves because the affected party can see the operative rationale and evidence pointers without being forced to submit to expanded capture, and institutional accountability improves because the institution can be held to a bounded procedure and constraint set rather than to narratives that shift under pressure. What remains risky is the perennial institutional temptation to treat any proof gap as a justification for collecting everything. The only durable antidote is to make the privacy boundary part of what legitimacy means, and to engineer chains of custody for reasons that prove procedural facts while leaving interior life unharvested by default.
Chapter Seven
Administrative Records and Machine Mediated Reasons
If documentary authority is how the modern state touches the world, then the administrative record is the state’s memory of why it acted, and judicial review is the disciplined practice of asking whether that memory is adequate for the stakes. Generative drafting does not simply make agencies faster at writing; it makes it easier to produce reason shaped language at scale, to retrofit rationales after the fact, and to flood the record with fluent material that increases the cost of contradiction without increasing the truth content of the agency’s explanation, so the administrative record becomes the primary site where legitimacy is either preserved or laundered.
The administrative record as the medium of lawful reasons
Administrative law already treats reasons as procedure bound, even when doctrine does not use that vocabulary. The Administrative Procedure Act requires courts to “review the whole record” and to set aside agency action that is “arbitrary” or “capricious” or taken “without observance of procedure required by law” (5 U.S.C. § 706). The important point is not the familiar incantation of standards, but the institutional design assumption behind them: the reviewing court is not meant to accept a polished narrative offered in litigation as a substitute for the agency’s contemporaneous procedural justification. In Citizens to Preserve Overton Park v. Volpe, the Supreme Court rejected the lower courts’ reliance on “litigation affidavits” because they were “not the whole record” and were an inadequate basis for review (Overton Park 419). The same architecture appears in Camp v. Pitts and its progeny: review is ordinarily confined to the existing administrative record, and when the record is inadequate, the remedy is not to build a new record in court but to require an adequate explanation or a remand (Camp 142; FPC 332).
This is why post hoc reason making has always been treated as a legitimacy problem rather than a mere evidentiary inconvenience. In SEC v. Chenery Corp., the Court held that “the validity of the order” must be judged on the grounds the record discloses as the basis for the agency’s action, and that an order cannot be upheld on grounds other than those the agency invoked (Chenery 87; Chenery 95). State Farm translates that principle into the everyday grammar of rulemaking and rescission: an agency must “examine the relevant data” and “articulate a satisfactory explanation” that shows a rational connection between facts and the choice made (State Farm 43). Fox, in turn, clarifies that when an agency changes course, it must provide a reasoned explanation that accounts for the change, and it cannot simply rely on the ease of producing new words to erase the obligation to justify the shift (Fox 515 to 516).
These cases are often taught as standards of review, but for present purposes their deeper unity matters more: they treat justification as something that must be reconstructible from the agency’s procedure, and therefore from its record, rather than from the rhetorical competence of whoever briefs the case later. In the language of this book, administrative legitimacy already depends on contestability, because a reason that cannot be challenged at reasonable cost is not a reason in the juridical sense, even if it looks like one on the page.
What changes when reasons become cheap to generate
Machine mediated drafting changes the administrative record’s risk profile in three overlapping ways that the classic cases anticipate but did not need to name. First, it lowers the marginal cost of producing plausible reasons. If the institutional incentive is to withstand review, an agency can generate many candidate rationales and select those that best match the applicable statutory factors, even when the internal reality is that the decision was driven by other considerations, including considerations that would be unlawful or politically embarrassing. Department of Commerce v. New York shows the judiciary’s sensitivity to this general pattern even without modern generative tools: the Court treated the proffered rationale as “contrived” in light of record evidence, and it permitted unusually probing inquiry because ordinary deference presupposes an administrative explanation that is not a manufactured cover story (Department of Commerce 10 to 12). Generative drafting makes the manufacture of cover stories cheaper and faster, and therefore makes the pretext problem more routine rather than exceptional.
Second, it increases the feasibility of reason laundering through diffusion of authorship and diffusion of procedural responsibility. In a machine mediated workflow, the words in the Federal Register notice or adjudication letter may be the product of templates, prior notices, staff edits, model completions, and compliance review, such that no accountable official can be examined about why the agency said precisely what it said, and the institution can treat the mere existence of well formed reasons as evidence of reasoned decision making. This is not a claim about bad faith as psychology; it is a claim about incentive compatible institutional behavior under throughput pressure and litigation risk. Under Chenery’s logic, what matters is whether the record discloses the grounds on which the agency actually acted (Chenery 87), but in a reason laundering environment, the record can be structured so that the grounds disclosed are optimized for defensibility rather than for truth.
Third, it enables record saturation as a strategic defense. If the record is enormous, if key rationales are scattered across appendices and internal memoranda, and if the final notice is rhetorically polished but thinly tethered to stable evidence pointers, then contestation costs shift to challengers. That shift is not incidental; it is a reallocation of procedural burdens accomplished by document abundance. Overton Park’s insistence on record based review was meant to prevent agencies from substituting litigation narratives for contemporaneous reasons (Overton Park 419), but record saturation produces a different failure mode: the agency can technically provide a record while functionally preventing meaningful review by making the act of locating, interpreting, and challenging the decisive grounds prohibitively expensive.
These three changes converge on a single doctrinal pressure point: administrative law’s legitimacy settlement presumes that writing reasons is expensive enough to serve as a friction against sham justification, and that compiling the record is bounded enough to keep contestability within reach. Generative drafting disrupts both presumptions simultaneously.
Documentary due process for administrative reasons
The doctrinal proposal in this chapter is deliberately conservative in form, even as it is demanding in effect: when an agency relies on machine mediated drafting or machine mediated decision support in producing an institutional utterance that will bear legal consequences, the agency must be prepared to produce a chain of custody for reasons proportionate to the stakes, as part of the administrative record, in a way that makes meaningful review feasible without converting provenance into surveillance. The proposal does not ask courts to invent a new theory of truth; it asks them to treat procedure as the substrate of authenticity, as they already do, and to recognize that machine mediated reason production changes what counts as an adequate record for judicial review under the APA and under the cases that operationalize it (5 U.S.C. § 706; Overton Park 419; Camp 142; Chenery 87; State Farm 43).
A chain of custody for reasons, in the administrative context, should be understood as a minimal, review oriented structure that links four things. It links the decisive claims in the notice or order to the statutory factors the agency says it applied. It links those claims to stable evidence pointers in the record that a challenger can actually access. It links the final utterance to accountable roles who can be examined, not as a demand for personal diaries, but as an allocation of responsibility within the agency. Finally, it links the utterance to versioned constraints on the drafting and decision workflow, meaning the agency can state, in a form suitable for record submission, what kinds of tools were permitted, what guardrails were in place, and what kinds of machine assistance were excluded for that category of action.
This structure is intentionally thinner than full transparency. It does not require disclosure of prompts, nor internal deliberations, nor staff communications that are properly protected. It requires something more modest and more demanding at once: that the agency be able to show that its reasons were produced by an attributable decision procedure, that the evidence it cites is stable and auditable, and that the record is curated to support review rather than to bury it. In other words, the agency must make it possible for review to function as review rather than as a theater of deference. This aligns closely with best practices articulated by the Administrative Conference of the United States, which treats record compilation in informal rulemaking as an essential condition for meaningful participation and judicial review, emphasizing preservation, organization, and certification practices that make the record intelligible rather than merely voluminous (Administrative Conference 2 to 4).
The administrative version of documentary due process also requires a discipline about supplementation. Department of Commerce illustrates how supplementation can be used to reshape the narrative of reasons after scrutiny begins, including through new memoranda introduced after the record is produced (Department of Commerce 13 to 15). Generative drafting increases the temptation to treat supplementation as a chance to improve the story rather than as a correction of incompleteness. A documentary due process doctrine should therefore treat late generated rationales with structured skepticism, not because later explanations are always false, but because the cost of generating later explanations has collapsed. Concretely, where an agency discloses that it used machine mediated drafting, courts should treat the chain of custody for reasons as part of what constitutes the relevant record, and should ask whether decisive rationales were present, linked, and attributable at the time of action, or whether they were assembled after challenge in a way that replicates the post hoc rationalization problem Chenery condemns (Chenery 87; Chenery 95).
This proposal also has an institutional governance counterpart that matters because doctrine alone cannot carry the whole burden. Contemporary executive guidance encourages agencies to expand and govern AI use, including generative applications, and it does so through program level requirements and risk management expectations rather than through case by case administrative record rules (Office of Management and Budget 1 to 3). The gap is predictable: enterprise governance does not automatically produce reviewable chains of custody for reasons in individual agency actions. Documentary due process closes that gap by requiring the agency, when it speaks through a consequential document, to produce a minimal reason custody artifact suitable for the record, while preserving privacy by excluding personal prompt capture and by relying on role responsibility and constraint versioning rather than on total observational logging.
Contestability costs as the operational test
Because administrative law’s central promise is review at reasonable cost, the contestability cost index provides a disciplined way to assess whether an agency’s record practices preserve or undermine that promise. Under record saturation, challengers must invest substantial time and expertise just to identify which rationales are decisive, which evidence the agency actually relied upon, and which materials are red herrings. Under reason laundering, challengers cannot identify who can explain the agency’s grounds, so examination becomes diffuse and expensive. Under machine mediated drafting without constraint disclosure, challengers cannot know whether the reasons were produced under guardrails designed to prevent confabulation, whether evidence links were checked, or whether the document is closer to an ex post justification generator than to an accountable statement of agency grounds. The chain of custody for reasons lowers these costs by making the structure of justification legible without demanding the surveillance of human interiors.
Counterarguments and limits
The strongest counterargument is institutional and doctrinal: courts are not free to impose new procedural requirements beyond those specified by statute and duly promulgated rules, and Vermont Yankee stands as a warning against judicially invented procedural expansions (Vermont Yankee 524 to 525). If documentary due process is framed as a new procedural obligation, it risks being dismissed as exactly what Vermont Yankee disallows. A related counterargument is practical: agencies already face resource constraints, and requiring additional artifacts may slow rulemaking and adjudication, inviting both delay and opportunistic litigation. Finally, a privacy objection is unavoidable: any provenance requirement, if implemented lazily, can become a prompt logging regime that chills internal deliberation and increases the state’s capacity to infer personal beliefs and vulnerabilities from drafting traces.
The response begins with doctrinal humility and then becomes demanding. Documentary due process should not be treated as an extra procedural layer added on top of the APA; it should be treated as an interpretation of what “whole record” review and reasoned explanation require when the cost structure of producing reasons has changed (5 U.S.C. § 706; Overton Park 419; State Farm 43). Overton Park already insists that courts cannot rely on litigation affidavits as a substitute for the record, and Chenery already bars upholding agency action on grounds not invoked by the agency (Overton Park 419; Chenery 95). When machine mediated drafting makes after the fact improvement of rationales easier, insisting that the record include a minimal, attributable structure that links grounds to evidence is not an invention of new procedure so much as an enforcement of existing constraints against post hoc rationalization and against record gamesmanship.
On burden, the appropriate comparison is not between a chain of custody artifact and an idealized past; it is between minimal structure now and escalating litigation and distrust later. ACUS’s work on record compilation already reflects the institutional recognition that intelligibility is part of the record’s function, and that agencies can adopt best practices to reduce downstream conflict (Administrative Conference 2 to 4). A reason custody artifact, if properly minimal, should reduce rather than increase the total documentary load by shifting effort from producing more text to producing better evidence linkages and clearer attribution of responsibility.
On privacy, the doctrine must include a hard line: the chain of custody for reasons is not a demand for capturing prompts, nor for storing raw model interactions, nor for turning staff cognition into an auditable resource. The artifact can be constructed from role based attestations, stable evidence pointers, and versioned constraint statements that describe permitted tooling without preserving personal drafting traces. This is consistent with contemporary federal AI governance guidance that emphasizes safeguards and risk management, including privacy, while encouraging adoption (Office of Management and Budget 1 to 3). The legitimacy settlement fails if provenance becomes surveillance, so documentary due process must treat privacy as part of the definition of legitimacy rather than as an external compliance add on.
Closing: what changes, what remains risky
If administrative law absorbs the reality that fluent reasons are now cheap to produce while meaningful contestation remains expensive, then the administrative record must become more explicitly procedure bound in the only sense that matters for legitimacy: the record must disclose not merely that the agency has words, but that the agency has attributable grounds linked to evidence through a process that can be examined at reasonable cost (5 U.S.C. § 706; Chenery 87; Camp 142). Documentary due process, implemented as a chain of custody for reasons proportionate to stakes, would reduce contestability costs by preventing record saturation from functioning as a defensive weapon, by making post hoc rationalization harder to launder into the record, and by restoring the coupling between institutional speech and accountable procedure. The remaining risks are real: institutions may implement the artifact as a superficial compliance veneer, courts may hesitate to treat these structures as part of the relevant record, and poorly governed provenance systems may drift into surveillance. The work of the next chapters is to specify the reliability and evidentiary implications of these artifacts, and to show, in concrete domains, how contestability can be strengthened without demanding total capture of persons.
Chapter Eight
Evidence, Reliability, and the Problem of Synthetic Documentation
When institutional utterances become litigated facts, the evidentiary system becomes the last procedural membrane that decides whether fluent text will be treated as knowledge or merely as language. Generative drafting and other machine mediated documentation tools do not only increase the quantity of records; they change the epistemic posture of records by producing artifacts that can look complete, official, and internally coherent while being weakly coupled to observation, to accountable authorship, and to stable methods of preparation. The legal system already has categories for these problems, including authentication, hearsay, expert reliability, and the business records trustworthiness requirement, but those categories were shaped in an era when producing plausible language was costly enough that fluency itself was a weak signal of work performed. Under synthetic documentation, fluency becomes abundant, and the operative question becomes procedural: can the proponent show that the document is what it purports to be, and that its claims are reliable in a way calibrated to the stakes, without converting provenance into a surveillance regime.
The threshold move in evidence doctrine is authentication. Rule 901 sets a deliberately minimal gate: the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is (Fed. R. Evid. 901(a)). The concept is procedural, not metaphysical. A document is not “authentic” because it has the right tone, the right letterhead, or the right rhetorical form. It is authentic because there is a sufficient showing, using some combination of witness knowledge, distinctive characteristics, process evidence, or other mechanisms, that the item is what it is claimed to be (Fed. R. Evid. 901(b)). Machine mediated documentation stresses this baseline because it expands the number of plausible looking items that can be produced without any corresponding increase in the reliability of their linkage to procedure. That pressure is not confined to deepfakes or obvious forgeries. It includes ordinary institutional documents such as eligibility letters, denial notices, compliance attestations, clinical notes, and internal performance summaries that may be generated or edited by systems whose internal operations are not visible to the factfinder, and whose outputs may include inferred content that reads as observation.
The immediate institutional temptation is to treat authentication as solved by certification. The Federal Rules have been moving in that direction for years, including through the 2017 addition of Rules 902(13) and 902(14), which permit certain electronic evidence to be authenticated by certification rather than live testimony. This is, in one sense, a contestability improvement: it reduces the expense and inconvenience of producing a foundation witness where the real dispute is not about whether a file exists but about what it means. Yet certification is also a liability hiding place if it becomes an institutional substitute for reliability. A 902 certification can establish that a record was generated by a process or copied from a device, but it does not establish that the content is accurate, that inferences were warranted, or that the document reflects a bounded decision procedure rather than a narrative composed to withstand scrutiny. Rule 902 speaks to authenticity, not to epistemic warranty, and in a world of synthetic documentation, treating authenticity as equivalent to reliability is a category error with predictable consequences.
Hearsay doctrine sharpens the problem further because it asks not only whether an item is what it purports to be, but whether the asserted content can be treated as a reliable substitute for in court testimony. Rule 803(6), the business records exception, is especially important for institutional utterances because it is the primary doctrinal pathway by which routine bureaucratic records enter evidence without the producing employees appearing in court. Rule 803(6) is explicitly conditional. It allows admission only when record making is regularized and contemporaneous in the relevant sense, and it authorizes exclusion when “the source of information or the method or circumstances of preparation indicate a lack of trustworthiness” (Fed. R. Evid. 803(6)(E)). That trustworthiness clause is the doctrinal hinge on which synthetic documentation should turn. It creates a formal channel for the argument that a record generated under throughput pressure by machine mediated drafting tools may be less trustworthy than its format suggests, particularly if the system invites confabulation, imports plausible but unverified assertions, or collapses the distinction between observed facts and inferred conclusions. The point is not to announce that all machine assisted documentation is untrustworthy. The point is to insist that the method and circumstances of preparation are now the central evidentiary facts, because surface fluency no longer correlates with the diligence of the underlying process.
This same logic extends beyond business records to the residual exception, which now emphasizes trustworthiness as a function of the totality of circumstances and corroborating evidence, rather than as a vague invitation to judicial discretion (Fed. R. Evid. 807(a)). In synthetic documentation disputes, the residual exception can become a temptation to admit persuasive language that lacks a stable procedural foundation, especially when a party cannot produce the human declarants behind an institutional process. The trustworthiness emphasis should therefore be read as an instruction to ask, in a disciplined way, for procedural facts: what evidence the system had, what constraints governed generation, what verification steps occurred, what role attested to issuance, and what was intentionally not captured. This aligns with the book’s chain of custody for reasons concept because it makes the admissibility question hinge on verifiable procedure rather than on rhetorical adequacy.
Expert evidence doctrine supplies the most developed judicial vocabulary for reliability screening, and it provides the closest existing analog to what synthetic documentation requires. Daubert framed the judge as a gatekeeper responsible for ensuring that expert testimony is grounded in reliable principles and methods, not in the mere authority of credentials or the persuasive confidence of the witness (Daubert 589 to 595). Kumho extended the same gatekeeping obligation beyond narrowly “scientific” testimony to other forms of expert and technical knowledge, emphasizing that reliability is the governing principle even when the relevant expertise is experiential or methodological rather than laboratory scientific (Kumho 147 to 149). The modern point is straightforward. A great deal of machine generated content that enters courts is functionally expert output, even when it arrives as a document rather than as testimony, because it embeds predictions, classifications, reconstructions, and inferences that an ordinary witness could not responsibly make without specialized method. That is exactly why the judiciary has begun to consider a new Federal Rule of Evidence 707 for machine generated evidence, which would import Rule 702 style reliability screening for machine generated outputs offered without a sponsoring expert, while exempting basic scientific instruments. Whether or not that proposal becomes law, the proposal itself is an institutional recognition that the evidentiary categories of authenticity and hearsay are insufficient when the contested feature of the evidence is the reliability of machine inference embedded in an otherwise authentic artifact.
The doctrinal proposal of this chapter is therefore a procedural reliability standard for synthetic documentation, framed as a clarification of how existing doctrines should operate under changed production conditions. The standard is simple to state and demanding to apply. When an institutional utterance is offered as evidence, its admissibility and weight should depend on the verifiability of the procedure that produced its operative claims, including a chain of custody for reasons appropriate to the stakes, rather than on surface fluency, institutional branding, or certification alone. This does not require courts to become model auditors. It requires courts to do what evidence law already asks them to do, namely to distinguish authenticity from reliability, to enforce trustworthiness conditions where the rules require them, and to treat method as a factual predicate when content is inferential. Rule 901 supplies the minimal “what is it” threshold (Fed. R. Evid. 901(a)). Rule 803(6) supplies the “should we trust this record given how it was prepared” screen (Fed. R. Evid. 803(6)(E)). Rule 702 supplies the gatekeeping posture for inferential claims presented as knowledge rather than as argument (Fed. R. Evid. 702). The proposed Rule 707 supplies a contemporary blueprint for integrating those postures when machine generated content is presented without a human expert who can be examined.
Once the procedural reliability standard is stated, the practical question becomes what the proponent must show and what the opponent must be allowed to test. The answer must remain aligned with the book’s privacy constraint. The proponent should not be required, by default, to disclose raw prompts, drafts, or private deliberative interiors, because that would turn evidentiary accountability into a generalized capture regime with the structural privacy risks described by the Supreme Court in its broader warning about comprehensive chronicles. Instead, the proponent should be required to provide bounded procedural facts: which decision procedure produced the utterance, which accountable role attested to its issuance, which evidence pointers were treated as decisive, which constraint versions governed the machine mediated process, and what verification steps occurred to ensure the utterance did not import unsupported assertions. These procedural facts are precisely the content of a chain of custody for reasons. They are also exactly the kind of “sufficient to support a finding” showing that evidence rules routinely accept without demanding full reconstruction of cognition (Fed. R. Evid. 901(a)).
A serious counterargument insists that this procedural posture either collapses into theater or forces discovery fights that courts cannot manage. On the theater side, one can imagine pro forma “procedural attestations” that say all the right words while revealing nothing about whether evidence was actually checked or whether the tool produced confabulated content. On the discovery side, one can imagine opponents demanding source code, model weights, prompt logs, and internal communications, arguing that without such access they cannot test reliability, while proponents reply that such demands are disproportionate, privileged, or impossible. These are not speculative concerns. They describe the predictable institutional economy of contested evidence.
The response is to treat proportionality, burden allocation, and testability as enforceable design requirements rather than as after the fact judicial improvisation. First, procedural attestations must be defined so that they are falsifiable. A chain of custody for reasons that cannot be tested against stable evidence pointers and constraint versions is not a chain; it is a story. Second, reliability disputes must be tethered to specific contested claims in the utterance. If the contested content is inferential, the court should treat it with a Rule 702 posture even when it arrives in a document, because the heart of the dispute is methodology, not mere authenticity (Daubert 589 to 595; Kumho 147 to 149). Third, preservation and spoliation doctrine should not be allowed to force surveillance by accident. Institutions will argue that they must log everything in order to preserve evidence and avoid sanctions. Rule 37(e), however, is explicit that sanctions require findings tied to reasonable steps and irremediable loss, and it does not create a free standing duty to preserve every possible trace. The correct inference is that an utterance commons should define what must be preserved for contestability, and then preserve that bounded set with integrity protections, rather than defaulting to maximal capture that will later be repurposed.
If this chapter’s proposal is adopted, the law of evidence gains a stable way to resist the collapse of reliability into fluency. Institutional utterances will still enter the record, but their authority will increasingly depend on whether their procedural foundations are verifiable, whether their trustworthiness is supported by method rather than by brand, and whether machine generated inferences are screened with a gatekeeping posture appropriate to their epistemic role. What remains risky is the institutional tendency to translate every reliability concern into a demand for more capture, which is the exact inversion this book refuses. The settlement must therefore remain procedural and minimal: prove enough to make challenge feasible, preserve privacy by default, and treat the chain of custody for reasons as the evidentiary bridge between documentary authority and lawful contestation.
Chapter Nine
Contractual Reliance and the Rise of Epistemic Warranty
Contracts are one of the core places where institutional utterances become operative power because the document does not simply describe a relationship but constitutes enforceable allocation of risk, responsibility, and remedy. When fluent drafting becomes cheap, the classical problem of quality uncertainty becomes easier to exploit through documentation itself, since persuasive representations, compliance attestations, and “standard” clauses can be produced at scale without a corresponding increase in verification, so counterparties, especially weaker ones, are asked to rely on language that is rhetorically competent while procedurally underdetermined (Akerlof 488 to 490). The consequence is not only more disputes, but a predictable redistribution of contestability costs: the party harmed by a defective representation must now prove, against an engineered paper reality, that the institution’s utterance was not merely false but ungrounded in any defensible procedure, even as the contract’s boilerplate often makes that proof difficult to obtain and expensive to litigate.
The proposal in this chapter is that modern contracting needs an explicit instrument that makes procedural credibility enforceable without demanding maximal surveillance. I call that instrument an epistemic warranty: a warranty not merely about the substantive truth of a representation, but about the procedure that produced the representation, including the decision pathway that authorized it, the evidence pointers treated as decisive, the constraints that governed drafting or generation, and the remedies that attach when those procedural commitments fail. The epistemic warranty is not a moral request for honesty. It is a contractual technology for rebalancing verification economics by converting contestability into a bargained for entitlement rather than an after the fact struggle.
Reliance, warranty, and what the law already makes possible
Contract doctrine already contains a surprisingly strong foundation for epistemic warranties, because warranty law treats certain assertions as enforceable commitments once they become part of the bargain, even when the recipient does not experience reliance as belief. Article 2 of the Uniform Commercial Code provides that an express warranty can be created by an affirmation of fact or promise that “becomes part of the basis of the bargain,” and by a description of the goods that becomes part of that basis (U.C.C. § 2-313(1)(a) to (b)). The emphasis on the bargain rather than on subjective belief is not an academic nuance. It is the legal mechanism by which representation becomes enforceable allocation.
CBS Inc. v. Ziff Davis Publishing Co. makes the point with unusual clarity in the context of a negotiated acquisition. The New York Court of Appeals rejected the view that a buyer’s doubts about accuracy defeat a breach of warranty claim, holding instead that the relevant “reliance” is reliance on the warranty as a term of the bargain, not reliance on the truth of the warranted facts in the psychological sense (CBS 503 to 504). That distinction is central for this book because it shows how institutions can be held to utterances even when counterparties are skeptical and even when the utterance functions as procedural cover. The buyer’s insistence that the seller stand behind a representation is, in effect, an insistence on contestability ex ante. Epistemic warranties generalize that move for an era in which documents can be produced at scale and in which representations are increasingly mediated by tools, templates, and machine drafting.
At the same time, the UCC also shows how easily modern contracting can erase contestability unless the parties intentionally design against that outcome. Disclaimers and warranty negations are permitted but constrained. To exclude or modify the implied warranty of merchantability, the language must mention merchantability and be conspicuous, and to exclude an implied warranty of fitness the exclusion must be in writing and conspicuous (U.C.C. § 2-316(2)). Remedy limitation clauses are generally allowed, but they are not absolute; when an exclusive or limited remedy fails of its essential purpose, the Code permits the injured party to access other remedies, and consequential damages limitations can be policed for unconscionability (U.C.C. § 2-719(2) to (3)). More broadly, unconscionability doctrine gives courts the power to refuse enforcement, sever, or limit clauses that produce unconscionable results (U.C.C. § 2-302(1); Restatement (Second) of Contracts § 208). These are doctrinal levers for preventing institutions from selling trust while contractually stripping the buyer of any meaningful mechanism for challenge.
Misrepresentation doctrine supplies another foundation that matters for machine mediated contracting because it clarifies when a contract is voidable due to induced assent. The Restatement defines misrepresentation as a false assertion of fact (Restatement (Second) of Contracts § 159), and provides that a contract is voidable when assent is induced by a fraudulent or material misrepresentation upon which the recipient is justified in relying (Restatement (Second) of Contracts § 164(1)). Under generative saturation, the practical difficulty is not that misrepresentation law disappears, but that proof becomes harder because the institution can produce polished narratives, layered disclaimers, and diffuse chains of authorship that obscure who asserted what, on what basis, and under what constraints. The epistemic warranty is designed to reduce that proof burden by specifying, in advance, what must be true about procedure and what evidence must exist to demonstrate compliance.
Why machine mediated drafting intensifies quality uncertainty in contracts
Akerlof’s account of quality uncertainty describes how markets can degrade when buyers cannot reliably distinguish high quality from low quality, allowing low quality to drive out high quality (Akerlof 489 to 490). In institutional contracting, the analogue of “quality” is not only the underlying product or service but the credibility of representations about security, compliance, performance, and risk controls. When the cost of producing sophisticated contractual language collapses, documentation becomes a cheap signal, and cheap signals invite opportunism because they can be manufactured without changing reality. The result is an institutional version of lemons dynamics in which sophisticated promises proliferate while the evidentiary substrate needed to justify them remains thin, internal, or inaccessible, and the counterparty pays for verification through expensive audits, litigation, or operational failure.
The most dangerous version of this dynamic is not the obvious lie but the plausible, formally correct representation that is weakly coupled to procedure. A vendor attests to controls, a service provider warrants compliance posture, a company issues a standard notice of determination, and each document is fluent and legally shaped, yet none is linked to a verifiable chain of custody for reasons. In this setting, reason laundering becomes an ordinary contract production pattern: a representation is assembled through templates, compliance reviews, and tool assisted drafts until it meets the rhetorical threshold for signature, while accountability for evidentiary grounding is diffused across roles and artifacts. The contract then becomes a mechanism for transferring the cost of discovering the truth to the party that relied on the representation.
The epistemic warranty as a contractual instrument
An epistemic warranty binds an institution’s utterance to a procedure, not by demanding disclosure of interior deliberation, but by requiring a minimal, verifiable structure that makes contestation feasible at reasonable cost. It has four elements, each aligned to doctrines the law already recognizes as legitimate objects of contracting.
First, it specifies the class of representations covered, which often includes security, compliance, performance metrics, eligibility criteria, and risk assessments, meaning any utterance whose practical function is to induce reliance.
Second, it specifies the decision procedure that authorizes issuance and the accountable roles who can be examined about that procedure, which operationalizes the core idea from earlier chapters that authenticity is a property of attributable procedure, not a metaphysical property of text.
Third, it specifies evidence pointers and evidence packet obligations that are stable and auditable, which converts “trust us” into enforceable documentary due process in the private ordering context.
Fourth, it specifies remedy triggers that attach when provenance fails, including rescission, fee clawback, service credits, or narrowed limitations of liability, and it pairs those triggers with dispute mechanisms that preserve contestability rather than destroying it through procedural walls.
The last element is where private ordering can most easily sabotage legitimacy. Modern mass contracting frequently relies on assent mechanisms and dispute resolution clauses that reduce contestability by design. ProCD is often read as validating shrinkwrap contracting where terms are presented after purchase and accepted by use, subject to ordinary defenses (ProCD 1452 to 1453). Specht, by contrast, emphasizes that enforcement depends on reasonable notice and unambiguous manifestation of assent, rejecting the idea that users silently assent to submerged terms (Specht 20 to 23). These cases matter here because epistemic warranties are only meaningful if the counterparty’s assent to warranty limitations and dispute mechanisms is procedurally legitimate, and if the contract architecture does not bury the very terms that allocate verification burdens. Even where assent is clear, procedural clauses can still eliminate effective challenge. Carnival Cruise enforced a forum selection clause in a consumer ticket contract, emphasizing efficiency and predictability despite the obvious hardship to the plaintiffs (Carnival Cruise 593 to 595). Concepcion, operating through the Federal Arbitration Act’s strong enforcement baseline, treated state limits on class waivers as preempted in the arbitration context, making it harder for diffuse harms to be contested collectively (AT and T Mobility 339 to 352; 9 U.S.C. § 2). The upshot is not that arbitration or forum selection is always illegitimate, but that dispute architecture is now a primary driver of contestability costs, and therefore a central design target for epistemic warranties.
If the institutional goal is legitimate contracting under generative text, then the warranty must travel with a contestability preserving dispute design. An epistemic warranty that is paired with a process that makes enforcement practically impossible is, in this book’s terms, an utterance that appears to allocate responsibility while in fact laundering it. Unconscionability doctrine exists in part to police that gap between formal assent and substantive deprivation, allowing courts to refuse enforcement or limit application to avoid unconscionable results (U.C.C. § 2-302(1); Restatement (Second) of Contracts § 208). The epistemic warranty approach therefore treats remedy and dispute architecture as inseparable from the promise itself.
Privacy constrained provenance in private ordering
The strongest objection to epistemic warranties is that they invite expansive audits and intrusive capture. If a counterparty demands proof of how representations were produced, the institution may respond by logging everything, including prompts, drafts, internal chats, and individual employee activity, either as a defensive posture or as a claimed necessity for compliance. This is exactly the surveillance drift the book rejects. The correct response is to treat privacy as a hard constraint on what the warranty requires, and to design the warranty so that verification is possible through minimal procedural facts, stable evidence pointers, and accountable role attestations rather than through comprehensive capture.
This is where the chain of custody for reasons becomes directly portable to contracts. The goal is not to reveal internal cognition. The goal is to preserve enough structured linkage that the counterparty can test whether the representation was produced by the promised procedure and supported by the promised evidence, and to do so without granting broad rights to pry into personal interior traces. That means the contract should specify what is intentionally not logged except under heightened stakes or legal compulsion, and it should narrow audit rights to the minimal evidence packet necessary to evaluate the covered representations. Later appendices will formalize these clauses, but the doctrinal logic belongs here: epistemic warranties are an anti surveillance instrument precisely because they prevent the institution from claiming that maximal capture is the only route to credibility.
Counterarguments and limits
A serious counterargument insists that epistemic warranties will increase transaction costs, slow procurement, and invite opportunistic litigation by giving counterparties new hooks for breach even where substantive performance is adequate. That argument gains force in low value transactions and consumer settings where negotiation is unrealistic, and it gains further force because sophisticated parties can already negotiate bespoke representations and warranties, so the proposal may appear redundant for those who have bargaining power. A second counterargument is that machine mediated drafting can improve quality by standardizing terms, reducing ambiguity, and lowering the cost of memorializing agreement, so tying legitimacy too tightly to provenance might discourage helpful automation. A third counterargument is doctrinal and pragmatic: since many disputes are pushed into arbitration and away from class aggregation, enforcement of epistemic warranties may be uneven, and the parties may end up litigating procedure rather than resolving substantive failures.
The response is to treat epistemic warranties as a targeted instrument for contexts where verification burdens are otherwise offloaded and where representational quality uncertainty is structurally dangerous. The proposal is not that every contract becomes an audit regime, but that high leverage representations, particularly those that concern safety, security, eligibility, and compliance, should be warrantied as procedure bound commitments with defined evidence packets and remedy triggers. The costs are real, but they are also the point: the institution that makes profitable use of fluent, scalable drafting should bear the cost of making those utterances contestable, rather than shifting that cost onto the weaker party through document saturation and procedural constraints. The warranty is also designed to be compatible with automation rather than hostile to it. If machine assistance improves drafting, the institution should be able to comply more easily because the same tooling that produces text can produce constraint versions, evidence pointer structures, and issuance attestations. Finally, arbitration and forum selection do not make the proposal meaningless. They make it more necessary, because when procedural channels limit collective challenge, ex ante allocation of verification and remedies becomes one of the few remaining mechanisms for legitimacy (AT and T Mobility 352; Carnival Cruise 593 to 595).
Closing: what changes, what remains risky
If epistemic warranties become a normal feature of consequential contracting, the private ordering landscape changes in a specific way that matters for the book’s central asymmetry. Language remains cheap, but contestability becomes partially prepaid, because the institution commits, in the contract itself, to verifiable procedures, stable evidence pointers, and enforceable remedies when provenance fails. Express warranty doctrine already permits parties to treat representations as enforceable terms of the bargain even when belief is not the relevant reliance posture (U.C.C. § 2-313(1)(a); CBS 503 to 504). The remaining risks are also specific. Institutions can attempt to disclaim, limit, or proceduralize away the warranty’s practical value through conspicuousness games, remedy limitations, and dispute design, and weaker parties may still lack the leverage to insist on meaningful terms. Doctrines such as unconscionability and failure of essential purpose remain vital backstops, but they are not substitutes for contractual design that makes contestability feasible without surveillance creep (U.C.C. § 2-302(1); U.C.C. § 2-719(2); Restatement (Second) of Contracts § 208). The next chapters will therefore tighten the bridge between warranties and governance by specifying how evidence packets, provenance primitives, and contestability measurement can be operationalized across domains, so that contractual legitimacy becomes measurable rather than merely asserted.
Chapter Ten
Employment, Benefits, and Internal Governance as High Stakes Speech
An institution does not need a courtroom to exercise authority. It needs a file, a form, a notice, a determination letter, a performance summary, a procurement disqualification memo, a credential revocation, or a benefits denial, because for most people the first encounter with allocative power is not a trial but a document that tells them what the institution will do next, and why. When drafting becomes machine mediated and fluent reasons become cheap, internal governance can start to resemble a self sustaining documentary weather system in which every decision is accompanied by plausible language while the pathway from observation to inference to judgment becomes harder to locate and harder to challenge. The stakes of this chapter are therefore practical: the domains most likely to be harmed by reason laundering are the ones most likely to be treated as ordinary operations rather than as due process sites, even though the consequences are often life shaping.
The workplace record as a jurisdiction of power
Employment governance is frequently taught as private ordering plus statutory overlay, but in lived institutional reality it is also an adjudicative regime that runs on documents. A warning becomes a future termination basis. A performance improvement plan becomes an evidentiary scaffold. An investigation summary becomes the institution’s official memory. In public employment, constitutional due process doctrine already recognizes that termination from a for cause position implicates procedural requirements, and Loudermill makes explicit that a public employee with a property interest in continued employment must receive notice and an opportunity to respond before termination (Loudermill 542 to 546). What matters for the argument here is not the familiar pretermination meeting itself, but the doctrinal presupposition behind it: a consequential institutional act must be contestable through a procedure that is both attributable and timely, which necessarily depends on a record that discloses the grounds in a form the employee can meet.
The private sector does not replicate constitutional due process, but it does not escape the governance problem. Collective bargaining regimes and labor law create procedural footholds that treat investigatory interviews and discipline processes as structured encounters rather than as managerial monologues. Weingarten recognizes that in unionized workplaces employees have a right, upon request, to representation at an investigatory interview the employee reasonably believes may lead to discipline, precisely because contestability requires that the employee not be forced to navigate a high stakes interrogation alone (NLRB v. J. Weingarten, Inc. 256 to 260). Even where that right does not apply, the logic remains instructive: a disciplinary process that denies procedural footholds increases the risk that documentation will become the primary weapon, and once machine mediated drafting enters the process, the probability of record inflation and narrative laundering rises.
The analytic point is that internal governance decisions are institutional utterances in the book’s sense because they function as speech acts with allocative consequences, relied upon for enforcement, liability, and justification. If those utterances are not tethered to verifiable procedure and evidence pointers, then the institution can produce polished accounts that cannot be effectively challenged, and the person who bears the harm pays the contestability cost.
Benefits determinations as internal adjudication
Benefits determinations are the clearest site where private institutions already operate with quasi administrative due process obligations, and they are therefore a natural bridge between the administrative law chapters and the systems design chapters that follow. In the public benefits context, Goldberg treated welfare benefits termination as requiring an evidentiary hearing before termination, in part because the risk of wrongful deprivation and the dependency stakes make procedure part of legitimacy rather than an optional courtesy (Goldberg 264 to 271). Mathews reformulated the analysis into a balancing framework that weighs the private interest, the risk of erroneous deprivation under existing procedures, and the government’s interest, including the burdens of additional procedure (Mathews 335). The doctrinal forms differ across contexts, but the shared structural insight is that when stakes rise, reasons must be contestable through procedure, and the record must support that contestation.
In the private benefits context, ERISA and its implementing regulations formalize minimum procedural requirements for claims and appeals. The claims procedure regulation sets forth minimum requirements for benefit claims processing, including standards for notices of adverse benefit determinations and review procedures (29 C.F.R. § 2560.503 1). The governance insight is that the regulation implicitly recognizes documentary due process as the medium of contestation. A claimant cannot challenge what cannot be located, and cannot appeal what cannot be articulated as a stable rationale. When machine mediated drafting enters benefits letters and internal claim notes, the procedural hazard is that the institution can generate compliant sounding explanations that are thinly grounded in the operative evidence, and can do so at scale, thereby shifting contestability costs onto claimants who often have the least capacity to bear them.
This is the point where the chain of custody for reasons becomes directly actionable in an internal governance domain without waiting for doctrinal innovation. A benefits denial letter should not be treated as adequate because it contains the correct headings and statutory citations. It should be treated as adequate when its operative claims are linked to stable evidence pointers in the claim file and to the plan provisions and interpretive constraints actually applied, and when accountable roles can attest that the described procedure was followed, all while keeping the privacy boundary intact by not logging personal interiors or unnecessary drafting traces.
Internal procurement and compliance sanctions as organizational courts
Procurement disqualification, vendor suspension, internal compliance sanctions, and credential revocations sit in an institutional zone that often escapes public attention because they are framed as operational risk decisions, but their consequences can be decisive for vendors, employees, and counterparties. They are speech acts that determine access to markets, livelihoods, and reputations. They are also domains where documentation is frequently used as a liability shield, which creates incentives for reason laundering even without bad faith, because the institution wants an artifact that looks reviewable while minimizing exposure. Under machine mediated drafting, that desire can be satisfied by producing text that anticipates objections, cites policy, and narrates the institution’s diligence, even when the evidentiary substrate is weak or the decision was driven by considerations that would not withstand contestation.
The proposal of this chapter is that internal governance must adopt internal documentary due process obligations even when not legally required, because legitimacy in practice is the difference between compliance that survives on paper and governability that survives in human relationships. The relevant test is the one the introduction established: an utterance is legitimate when it is contestable at reasonable cost, attributable to a decision procedure, and linked to evidence adequate for the stakes. In internal governance, this becomes an operating requirement rather than a constitutional command.
Machine mediated human resources and the new surface area of discrimination and surveillance
The employment domain is also where machine mediated tools are rapidly expanding the surface area of potential discrimination and privacy harm. The EEOC has repeatedly emphasized that existing civil rights frameworks apply to software, algorithms, and artificial intelligence used in employment selection procedures, including disparate impact analysis under Title VII and related compliance expectations (EEOC, “What is the EEOC’s role in AI” 1 to 2; EEOC, “Select Issues” 1 to 3). Separately, the EEOC has warned that wearable technologies and biometric monitoring can raise discrimination risks and can implicate the ADA’s limits on medical examinations when employers track biometric data in ways that are not job related and necessary, and when such monitoring is selectively applied or used for adverse actions (Reuters). These developments matter for the book’s argument because they show how easily authenticity and accountability infrastructure can drift into surveillance, particularly when institutions treat monitoring as the natural way to produce defensible records. If the internal governance system responds to litigation risk by logging everything, the institution will acquire a capability for inference into health, disability, and other sensitive traits that can reshape power even when no one intends abuse.
The chapter’s insistence therefore remains aligned with Chapter Six: verifiable procedure must be achieved through minimal, stake sensitive procedural facts rather than through total capture. A chain of custody for reasons can prove that required steps occurred and that accountable roles attested to decisions, without preserving granular biometric or drafting traces except under narrowly defined escalation conditions.
Internal documentary due process as an operating model
The operative proposal is that high stakes internal governance must treat its consequential documents as procedure bound artifacts with verifiable chains of custody for reasons, and that it must do so through a minimal set of structured commitments rather than through narrative inflation. Concretely, internal governance utterances should separate observation, inference, and judgment in the reason graph, because that separation is what allows a challenger to target the correct layer of contestation and prevents the institution from laundering inference as observed fact. The utterance should identify the governing policy or plan provisions applied, the evidence pointers treated as decisive, the constraint versions in force, and the accountable roles who issued and reviewed the decision, because those are the procedural facts that make contestation possible without forcing disclosure of interior deliberation.
The chapter also insists on a measurable aim that will later become the evaluation harness: internal documentary due process should lower contestability costs by reducing the time and expertise required to locate the operative rationale, retrieve the decisive evidence, and obtain a reasoned response to a challenge. If the new system increases the amount of text without lowering those costs, it has not improved legitimacy, it has only increased record saturation.
Counterarguments and limits
The most serious objection is that internal governance cannot be run like a court without undermining managerial discretion, agility, and confidentiality. Institutions will argue that discipline and compliance decisions often depend on sensitive witness statements, trade secrets, privileged investigations, and risk judgments that cannot be fully disclosed, and they will also argue that requiring structured custody artifacts will slow decision making, increase adversarialism, and invite strategic appeals. A related objection is that formalizing contestability inside firms will increase legal exposure by generating discoverable materials that plaintiffs can use, and by locking institutions into procedural commitments that become litigation hooks. Finally, there is a privacy objection that cuts both ways: if internal documentary due process requires more structure, institutions may respond by collecting more data to support their structure, creating the very surveillance creep this book rejects.
The response is to treat internal documentary due process as minimal, stake sensitive, and privacy bounded rather than maximal and judicialized. Loudermill is not a demand that every employment decision becomes trial practice; it is a reminder that even modest pre decision process can be constitutionally necessary when stakes and property interests are present, and that the core demand is notice plus an opportunity to respond, not exhaustive disclosure (Loudermill 545 to 546). The same principle can be adopted as internal design without importing all the apparatus of litigation. The chain of custody for reasons is designed precisely to avoid generating more documents in place of evidence, because it focuses on stable evidence pointers and accountable role attestations rather than on sprawling narratives and exhaustive logs. On confidentiality, selective disclosure is not an evasion but an implementation tactic: the affected person must receive enough to contest the operative rationale, while sensitive information can be protected through redaction and tiered access, and oversight can be enabled without broad distribution. On legal exposure, the long run risk is not that institutions will have procedures, but that they will have procedures that cannot be defended because they are performative rather than verifiable; procedural clarity often reduces rather than increases dispute volume because it lowers uncertainty and makes early correction possible.
On the privacy risk, the chapter returns to the nonnegotiable boundary. Verification must not default to maximal capture. The evidence that should be preserved is the bounded set needed to prove procedure and to support contestation, and the system should explicitly define what is not logged, including raw prompts and personal biometric telemetry, except under narrow, justified escalation pathways consistent with employment law limits and privacy risk management principles reflected in current regulatory attention to algorithmic tools (EEOC, “Select Issues” 1 to 3; Reuters).
Closing: what changes, what remains risky
If internal governance is treated as a domain of high stakes institutional speech, then the institution’s legitimacy no longer depends on producing polished documents that appear complete, but on producing contestable utterances that are attributable to defined procedures and linked to evidence adequate for the stakes. Public law doctrines such as Loudermill, Goldberg, and Mathews illustrate that when deprivation stakes rise, procedure becomes part of lawful authority rather than an optional add on, and private governance regimes such as ERISA claims procedure rules show that documentary due process can be operationalized as minimum requirements for notice, appeal, and consistency (Loudermill 542 to 546; Goldberg 264 to 271; Mathews 335; 29 C.F.R. § 2560.503 1). What remains risky is the predictable institutional drift toward surveillance in the name of defensibility, and the predictable drift toward theater in the name of compliance. The next part of the book therefore turns from doctrine to systems design, because only a precise threat model and minimal primitives can keep the utterance commons from either collapsing into paperwork or mutating into a comprehensive capture machine.
Chapter Eleven
Threat Model and Trust Boundaries for Institutional Speech
The systems problem that follows from the doctrinal chapters is not the abstract possibility of fake documents, but the operational reality that modern institutions can lose the coupling between what they say and why they are entitled to say it, because text is now easy to manufacture while contestation remains costly. A defensible utterance commons therefore begins with a threat model that treats institutional speech as an attack surface, not only for external adversaries who forge or tamper with records, but also for internal incentive structures that generate record saturation, diffuse responsibility, and enable post hoc rationalization as ordinary workflow.
What the threat model must treat as the asset
In security practice, risk is typically analyzed as a function of threat sources and threat events acting on vulnerabilities under predisposing conditions, producing impacts whose significance is defined by the mission and the stakes. NIST frames risk assessment in exactly these terms, emphasizing that threat, vulnerability, likelihood, impact, and predisposing condition are the primary risk factors that must be documented and decomposed as needed. For an utterance commons, the protected asset is not simply the confidentiality of documents, nor even the integrity of stored files, but the legitimacy function that documents perform: an institutional utterance must remain attributable to a defined decision procedure, bound by constraints that can be stated and audited, and linked to evidence in a way that keeps contestation feasible at reasonable cost. If the institution can no longer prove that linkage, then the document can remain “authentic” in the superficial sense that it was issued, signed, and stored, while failing the deeper requirement that its reasons are contestable and responsibility bearing.
This redefinition of the asset changes what counts as an attack. Under a classic integrity lens, the adversary aims to alter a record without detection. Under a legitimacy lens, the more common adversary goal is to preserve the appearance of justification while breaking the pathway that would allow someone to test it. That is why record flood and reason laundering must be treated as first class security concerns, even though they can be produced by compliant behavior inside a process rather than by illicit tampering.
The adversary set is not only external
A conventional threat model begins with external attackers, and there is no reason to neglect them. Institutional utterances travel through email, portals, APIs, and shared drives, and the simplest failure mode is that an attacker forges a notice or modifies an attachment and exploits the recipient’s trust in institutional form. Yet the more structurally dangerous adversary is internal, because internal actors can generate legitimate looking records through approved workflows while still defeating contestability by saturating the record, shifting rationales across versions, or routing evidence pointers into inaccessible systems.
MITRE ATT&CK is useful here not because the book is about cyber intrusion in the narrow sense, but because ATT&CK forces analysts to model adversary behavior as a sequence of tactics and techniques observed in real operations, rather than as a vague list of bad things that might happen. If we treat institutional speech as the target, then the relevant “tactics” include access to drafting surfaces, manipulation of evidence inputs, control of issuance channels, and persistence through policy layers, and the relevant “techniques” include the bureaucratic equivalents of lateral movement, such as leveraging templates, approval gates, and policy citations to move a weakly grounded rationale into an official artifact that becomes difficult to challenge. The intent is not to import cybersecurity metaphors for rhetorical effect, but to adopt the discipline: assume an adaptive adversary, including an adversary who is the institution’s own throughput pressure.
Trust boundaries in a machine mediated utterance pipeline
A threat model becomes actionable when it defines trust boundaries, because boundaries are where evidence must be captured, where attestation must occur, and where responsibility must be assigned. In an utterance commons, the minimal trust boundaries typically separate the human decision authority from the drafting mechanism, the drafting mechanism from the evidence substrate, the issuance surface from the event log, the internal record from the disclosure view provided to the affected party, and the institution’s internal tooling from third party model or platform providers. Each boundary creates a distinct failure mode that cannot be addressed by generic “security best practices,” because the risk is not only data theft but legitimacy collapse.
The boundary between decision authority and drafting is where reason laundering begins. If a model completion or template can write the rationale before the decision procedure has actually completed the evidentiary checks it claims, the organization creates a structural temptation to treat language as completion. This is the internal version of post hoc rationalization, now made cheap and operationally convenient. The boundary between drafting and evidence is where hallucinated or imported assertions enter, not as deliberate lies but as plausible completions that appear to be summaries of a file the model did not actually read or did not have access to. That is why, in NIST’s AI risk framing, maintaining provenance and supporting attribution to relevant data sources is described as a pathway to transparency and accountability, because without provenance the institution cannot distinguish a reason grounded in evidence from a reason that is merely well formed text.
The boundary between issuance and logging is where accountability is either preserved or lost. If the final utterance is issued without a corresponding append only record of which procedure steps were completed, which constraint versions applied, and which accountable role attested to issuance, then the institution will later attempt to reconstruct those facts by narrative, which is exactly what documentary due process is meant to prevent. Log management guidance has long treated logs as a core control for security operations, but the utterance commons requires a more precise use of that insight: the log is not merely for detection and response, it is the chain of custody substrate for reasons. NIST’s log management guidance emphasizes enterprise practices for collecting, retaining, and protecting logs so they remain usable and trustworthy. NIST’s control catalog similarly treats audit and accountability controls as foundational for establishing what happened, when, where, by whom, and with what outcome, because without those elements the record cannot support reconstruction.
The boundary between internal record and disclosure view is where privacy and contestability come into direct tension. The institution needs enough disclosure to allow challenge, but not so much capture that provenance becomes surveillance. This means the system must be designed for selective disclosure, where the affected party can verify that the institution’s reasons were produced by an attributable procedure and are linked to evidence pointers, while sensitive internal material, personal data, and prompt traces remain protected by default.
The boundary between institutional systems and third party model providers is a supply chain boundary. If the model, the retrieval layer, or the orchestration stack can be modified, the institution can lose control over what constraints are actually in force, and can be unable to prove later that an utterance was produced under the promised guardrails. SLSA’s provenance concept is instructive because it defines provenance as verifiable information about where, when, and how an artifact was produced, and it stresses that provenance has value only when it is verified rather than merely generated. Even though SLSA is a software supply chain framework, the underlying logic transfers: an utterance commons requires provenance for the procedure that produced the utterance, but provenance must be bound to verification practices, or it becomes another decorative artifact.
Named failure modes that must be assumed
A credible threat model must treat failures that look like ordinary operations as adversarial, because those are the failures that will persist after a first wave of controls. The first is contested attribution: nobody can say who is responsible for the decisive rationale, because authorship has been diffused across tools, templates, approvals, and model outputs, even while the institution insists the document is official. The second is contested evidence: the document cites facts or summaries that cannot be tied to stable evidence pointers, or the cited materials exist but do not support the asserted claims in the way the document implies. The third is contested constraints: the institution cannot prove which model, which retrieval corpus, which policy filters, and which template version governed the drafting at the time of issuance, so the organization cannot defend its own process beyond vague assurances. The fourth is contested versioning: the institution can produce many near identical rationales across drafts and notices, but cannot show which version was operative at the moment of decision, making it impossible to distinguish correction from rationalization.
In generative systems, the fifth failure mode must be treated as a primary adversary technique: prompt injection and other forms of instruction manipulation that cause the model to follow attacker intent through untrusted inputs, which can lead to data exfiltration, unsafe actions, or corrupted outputs. OWASP’s large language model risk taxonomy captures this category explicitly, describing prompt injection as manipulation through crafted inputs that can redirect model behavior. The relevance here is not only security in the narrow sense but legitimacy in the record: if untrusted content can alter the reasons the institution produces, then the institution cannot treat a fluent rationale as an accountable explanation unless the system can prove how it constrained and verified model behavior at issuance time.
Why the log cannot become a comprehensive capture machine
The temptation in threat modeling is to solve uncertainty with more collection. For an utterance commons, that instinct must be bounded, because the system’s legitimacy requirement includes privacy. Audit and accountability controls must therefore be designed to capture procedure facts rather than personal interiors. NIST’s audit guidance emphasizes recording what happened and the identity of subjects and outcomes, but an utterance commons must interpret “identity” as role responsibility by default, escalating to individual attribution only when stakes require it and when lawful and proportionate. The same boundary applies to model interactions: the system should be able to show the constraint version in force and the verification steps performed without storing raw prompts that may contain sensitive personal data, privileged deliberation, or intimate details that have no place in an institutional ledger.
This is where the certificate transparency analogy becomes conceptually useful, not because institutional utterances are certificates, but because certificate transparency demonstrates a governance pattern in which public logging and auditing can detect misissuance while still limiting what is revealed to what is necessary for verification. RFC 9162 describes certificate transparency as a protocol for publicly logging certificate issuance or observation so that anyone can audit certification authority activity and detect suspect certificates, and so that the logs themselves are auditable. The analogy is structural: append only logs plus verifiable inclusion proofs can create accountability without requiring the capture of everything about the requester’s interior state. An utterance commons can borrow the constraint, not the specifics: make issuance auditable through verifiable records of procedure steps and constraint versions, while keeping the system’s disclosure surface narrow and stake sensitive.
Counterarguments and limits
A serious counterargument is that treating internal incentive behavior as an adversary confuses governance with security, and that the resulting system will be over engineered, slow, and prone to false confidence, because people will treat provenance artifacts as proof of truth rather than as proof of procedure. A second counterargument is that trust boundaries are difficult to enforce in practice because modern institutions operate through messy toolchains, contractors, and shared services, so any attempt to formalize boundaries will either be ignored or will force intrusive monitoring. A third counterargument is that threat modeling generative systems remains immature, and taxonomies such as OWASP’s are not standards in the same sense as NIST publications, so building institutional governance around them risks chasing trends.
The response concedes the limits and then tightens the method. First, the system does not claim that procedural proof equals substantive truth. It claims something narrower and more defensible: without procedural proof, the institution cannot justify treating its own utterances as authoritative reasons. Second, boundary enforcement does not require omniscience. NIST risk practice emphasizes documenting risk factors and making course of action decisions based on identified risks, not eliminating all uncertainty, and that is the correct posture here. Third, the proposal deliberately anchors to durable standards for risk assessment, auditability, and provenance, using OWASP as a practical risk vocabulary for specific generative vulnerabilities, not as the normative authority. The goal is not trend compliance but an operational threat model that can be audited and evolved.
Closing: what changes, what remains risky
If institutions adopt a threat model and trust boundary discipline for institutional speech, they stop treating the record as a passive byproduct and start treating it as a controlled system whose legitimacy properties can be attacked. That shift enables the next step in the book: specifying minimal primitives that produce verifiable chains of custody for reasons, with auditability sufficient for contestation and privacy protections strong enough to prevent provenance from becoming surveillance. The remaining risk is that institutions will either collapse the model into theater by generating attestations that are not testable, or will overcorrect into maximal capture, turning internal governance into a comprehensive log of human life. NIST’s risk assessment framing, NIST’s audit and log management guidance, supply chain provenance patterns such as SLSA, and auditability analogies such as certificate transparency together point toward the disciplined middle path this book requires: capture procedure facts, verify them, disclose them selectively, and treat the ability to contest at reasonable cost as the defining success metric.
Chapter Twelve
Minimal Primitives for Verifiable Utterances
An utterance commons fails or succeeds on one question that is far less abstract than institutions usually admit: when an institutional utterance is relied upon for enforcement, allocation, liability, or justification, can the affected party or a reviewer verify, at reasonable cost, that the utterance was produced by the decision procedure the institution claims, under the constraints it claims, by accountable roles, and with evidence adequate for the stakes, without forcing the institution to record every interior draft thought or every private prompt. The point of this chapter is therefore not to design a luxuriant provenance system, but to isolate the smallest set of implementable primitives that can carry a chain of custody for reasons, resist reason laundering and record flood, and remain compatible with a privacy constraint that treats maximal capture as a governance failure rather than as a security achievement.
The design target: verifiability without surveillance
The thesis of the prior chapters implies a narrow engineering target: we need artifacts that make a final utterance contestable and attributable, and we need procedure evidence that makes the institution examinable, but we do not need to preserve every intermediate draft, nor do we need to log prompts, raw model inputs, or personal interiors as a default condition of legitimacy. This posture matches what mature audit regimes already assume about logs: logs are essential, but they must be governed, minimized, protected, and collected for a purpose rather than accumulated as an unbounded memory of persons. (National Institute of Standards and Technology, Guide to Computer Security Log Management.)
In practice, this means the utterance layer must separate three objects that are routinely conflated. First, the issued utterance as the thing that binds, notices, denies, promises, or warns. Second, the chain of custody for reasons as the minimal map from claims to procedures, accountable roles, and evidence pointers that makes review possible. Third, the system evidence that those procedures were followed under known constraints, which is an audit problem rather than an autobiography. This separation is the first privacy defense because it prevents “prove it” from becoming a mandate to capture everything.
The utterance artifact: a canonical object that can be signed without ambiguity
If an utterance is to be verifiable, it must be signable, and if it is to be signable, it must have a stable representation; otherwise the institution can sign one rendering while presenting another, and challengers can be told that mismatches are “formatting.” The minimal primitive is therefore a canonical representation for the final utterance artifact, coupled to an immutable identifier that is derived from the canonical bytes, typically by hashing. The cryptographic point is not mysticism; it is repeatability: signing and verification require that producer and verifier compute over identical bytes.
Two implementation families are already well understood. One is to serialize the utterance as a compact, unambiguous byte string and then sign that byte string using a signature container. This is the strategy that underwrites JSON Web Signature, which signs a base64url encoded payload precisely to avoid representation drift. The other is to retain a structured representation and define a canonicalization scheme that deterministically maps that structure to canonical bytes before signing, which is the role of JSON canonicalization schemes such as RFC 8785. A third approach, increasingly common in provenance systems, is to avoid canonicalizing arbitrary structured objects by placing them inside a signing envelope that binds both a declared payload type and the raw bytes as presented, which is the function of DSSE as a deliberately simple signing envelope.
For this book’s purposes, the decision rule is simple: if your utterance format is structurally complex and likely to be rendered in multiple ways, use an explicit canonicalization scheme or a signing envelope that commits to raw bytes plus a type identifier; if your utterance is already a stable byte serialization, sign the bytes directly. What matters is that the institution can specify, in a public and testable way, what counts as “the utterance” for verification, so that contestation does not collapse into a dispute about formatting.
The signature and attestation layer: separating authorship, role responsibility, and procedure claims
A signature on an utterance proves that a key holder signed bytes; it does not, by itself, prove that a lawful procedure was followed, that evidence existed, or that the signer is the accountable role rather than an automation account designed to absorb blame. The minimal primitive is therefore not only signing, but structured attestations that bind the utterance to a claim about procedure, constraints, and accountable roles, while remaining narrow enough that the system does not become a diary.
Signing formats for this layer should be treated as infrastructure choices, not as bespoke inventions, because interoperability and verification tooling are part of contestability. For JSON ecosystems, JWS provides a well specified signing container. For binary or constrained environments, COSE provides analogous structures and processing for CBOR. For credentials and assertions that need to travel across institutional boundaries while preserving cryptographic integrity claims, the W3C Verifiable Credential Data Integrity specification provides a standards based approach to expressing integrity proofs over credential like statements. For provenance style attestations, DSSE paired with an attestation schema such as the in toto statement model gives a disciplined way to bind declared statement type, subjects, and signatures without forcing every system to reinvent a container.
The key design move is to treat attestations as typed claims with explicit scope. One attestation can assert issuance: this utterance is final, this is the version identifier, these roles approved issuance. Another can assert constraints: this utterance was produced under policy version X, template version Y, model usage policy version Z, and the procedure steps named in the chain of custody for reasons were completed. Another can assert evidence linkage: the evidence pointers referenced by the utterance were present at the time of issuance and passed whatever sufficiency checks the procedure defines. These attestations do not require the system to log private deliberation; they require the system to bind public claims about procedure to verifiable artifacts.
The procedure event log: an append only record of steps, governed as an audit object
The chapter’s most common failure mode is to treat “logging” as an undifferentiated obligation, which produces either useless floods of telemetry or privacy violating capture. The minimal primitive is narrower: an append only event log of procedure steps that is designed for audit and contestation, not for omniscient reconstruction. NIST’s log management guidance treats logs as security and accountability objects whose value depends on integrity, retention discipline, and governance, not on totality. In parallel, modern security control catalogs formalize audit and accountability expectations as a family of controls rather than as an improvisation.
The event log relevant to utterance legitimacy should record procedure events at the level of decision steps, approvals, evidence checks, and constraint bindings. It should not record raw prompt contents, private narrative drafts, or the personal interior of a worker, unless a separate and explicit stakes based rule triggers that collection. The log’s integrity matters because it is the institution’s own evidence about its procedure; if it is mutable, the institution can retroactively “comply” by rewriting history. This is precisely why append only logging patterns, including transparency log designs based on Merkle trees and consistency proofs, have become the state of the art for showing that a log has not been rewritten.
In the utterance commons, the event log does not need to be globally public, but it does need to be tamper evident and independently auditable. Certificate Transparency is instructive not because the domains are identical, but because it shows an implementable mechanism: logs commit to an append only structure, and monitors and auditors can detect misbehavior through consistency proofs and inclusion proofs. The institutional analogue is to make the procedure log capable of proving that the sequence of procedure events that produced an utterance existed at issuance time, even if only a subset of those events is disclosed to an affected party.
The constraint registry: versioned policies that make “we followed policy” testable
Reason laundering thrives on ambiguity about which rules applied and when. If policy is mutable and templates drift without versioning, the institution can defend any outcome by choosing whichever rule text is most convenient after the fact. The minimal primitive is therefore a constraint registry that versions and immutably identifies the rules that governed utterance production at issuance time, including template versions, rubric versions, model usage constraints, redaction policies, and approval matrices.
This primitive is conceptually simple but procedurally decisive: an utterance must carry pointers to the exact constraint versions under which it was produced, and the chain of custody for reasons must treat those constraint versions as part of the accountable procedure, not as background. In software supply chain security, SLSA and in toto have converged on the premise that provenance is only meaningful if it binds subjects to declared processes and inputs, with versioning and distribution rules that let verifiers check claims rather than trust them. The utterance commons borrows this logic while narrowing scope: we do not need a total build pipeline record of institutional life, but we do need a stable registry of the constraint texts whose invocation is part of the institution’s justification.
Evidence pointers: stable references that preserve chain of custody without bulk capture
The chain of custody for reasons fails if evidence is referenced in ways that cannot be audited, such as “see file,” “see notes,” or “per discussion,” because those references are immune to review and therefore ideal for plausible deniability. The minimal primitive is a stable evidence pointer scheme with clear semantics: what is being referenced, where it is stored, what integrity check binds it, what access control regime governs it, and what redaction rules apply. The point is to make evidence linkage durable and examinable without requiring that all evidence be copied into the utterance artifact itself.
Technically, this often means content addressable identifiers for evidence objects, so the pointer refers to a specific object rather than to a mutable location, combined with access controlled retrieval and disclosure rules. The practical benefit is twofold. First, it prevents retroactive substitution of evidence because the pointer binds to a hash. Second, it reduces surveillance pressure because evidence does not have to be replicated into a centralized provenance blob; it can remain in governed repositories while still being referentially stable.
Selective disclosure: proving the procedure without disclosing the interior
If the preceding primitives are implemented naively, the institution can still default to over disclosure, which is how authenticity infrastructure becomes surveillance infrastructure. The minimal primitive needed to prevent that drift is a selective disclosure mechanism: a way to disclose only the portion of the chain of custody for reasons necessary for contestation at the relevant stakes, while keeping private what is not required for review. This is not a concession; it is the core privacy constraint in operational form.
One route is cryptographic selective disclosure and verifiable presentations in credential systems, where integrity proofs allow recipients to verify claims without receiving all underlying data. Another route is procedural selective disclosure, where the system produces a disclosure packet containing the utterance artifact, the minimal reason graph, and the relevant attestations, while withholding raw drafts, prompts, and personal data by default. The disclosure packet is then verifiable because it contains signatures and references that can be checked against the tamper evident event log and constraint registry, without requiring that everything be shown.
Transparency and monitoring: making misbehavior detectable, not merely punishable
A verifiable system is not only one in which an auditor can discover a problem after months of investigation; it is one in which misbehavior becomes detectable early enough that incentives change. Transparency log systems operationalize this idea by making append only commitments and by encouraging multiple monitors. Certificate Transparency explicitly relies on monitors and auditing behavior to detect misissuance and log misbehavior, while also acknowledging that such detection depends on monitoring actually being performed. Sigstore extends the same family of ideas to software artifacts, and its Rekor transparency log ecosystem places monitoring and append only assurances at the center of its trust narrative, including explicit discussion of monitoring and the Merkle tree basis of the log.
For institutional utterances, the analog is to ensure that verification is not a bespoke exercise that only a litigant can afford, but a routine capability: internal audit can run consistency checks on procedure logs, compliance can sample utterances for missing constraints and missing evidence pointers, and affected parties can receive disclosure packets that can be verified by independent tools. The contestability cost index later in the book is meant to force this monitoring posture into measurement; here the minimal point is simply that primitives must be chosen so that verification can be automated by verifiers outside the authoring chain.
Counterargument: cryptographic provenance will become a new compliance theater, and it will fail in the places that matter
A serious objection is that these primitives will be adopted performatively, producing signatures and logs that create an illusion of accountability while shifting genuine contestation costs onto affected parties who cannot interpret attestations or challenge evidence pointers. A related objection is operational: key management, signature verification, and append only logging add complexity, and complexity fails under throughput pressure, which is exactly where benefits determinations, employment disputes, and clinical documentation already struggle.
This objection must be conceded in part. Cryptography can certify nonsense, and an attestation can be a lie with a signature. The response is that the primitives here are intentionally minimal and are designed to be coupled to audit and remedy, not to symbolism. The purpose of signing is not to sanctify a reason; it is to bind the institution to an examinable claim that can trigger consequences when false. Similarly, the purpose of append only logging is not to store everything; it is to prevent retroactive rewriting of procedure evidence, which is the substrate of post hoc rationalization. Certificate Transparency is explicit that signed timestamps and logs reduce risk by enabling monitoring and detection, not by guaranteeing perfection, and it emphasizes that monitoring behavior is a necessary condition for the mechanism to deliver its promise.
The deeper answer is institutional: the primitives are not the settlement, they are the substrate on which the settlement can be enforced. In later chapters, warranties, remedies, and audit tests supply the pressure that keeps these mechanisms from decaying into theater. Without verifiable primitives, warranty language becomes aspirational. With them, warranty breach becomes testable, and therefore governable.
Closing: what changes if these primitives exist, and what remains risky
If these primitives are adopted, the institution’s utterances become harder to launder because the final utterance is bound to a canonical artifact, the artifact is bound to typed attestations about procedure and constraints, and the procedure evidence becomes resistant to retroactive rewriting through tamper evident logging and versioned constraint registries. Contestability improves because affected parties can receive disclosure packets that link claims to evidence pointers and to accountable roles without being forced to litigate basic questions of provenance. Privacy improves, not because verification is abandoned, but because verification is explicitly designed to succeed without capturing prompts and interiors as a default condition of institutional legitimacy.
The remaining risks are real. Keys can be compromised, monitors can be absent, and institutions can continue to write defensible sounding utterances that are evidentially weak, now with signatures attached. These risks do not refute the approach; they define the work that the next chapters must do: threat modeling must take compromised insiders seriously, and evaluation must measure contestability costs rather than celebrating the mere presence of signatures and logs.
Chapter Thirteen: The Contestability Cost Index as Evaluation Harness
The institutional legitimacy crisis created by fluent machine drafting cannot be answered with better rhetoric, thicker policies, or more attestations, because those responses repeat the underlying move: they add text where what is missing is contestable procedure. If the utterance commons is to be more than a new genre of compliance language, it must generate measurable changes in what it costs a person to challenge an institutional utterance in practice, at the point where delay, confusion, and document overload become the institution’s quiet advantage. This chapter therefore builds the contestability cost index as the book’s evaluation harness, not as an academic ornament, but as the instrument that lets institutions, regulators, courts, auditors, and affected parties distinguish real reductions in contestability burden from mere increases in documentary production.
The index begins from a basic observation that administrative law and institutional governance already understand, even when they do not name it as measurement: procedure is always a distribution of burdens. Due process doctrine, in its canonical balancing formulation, makes the distribution explicit by requiring attention to the private interest at stake, the risk of erroneous deprivation under the procedures used and the value of additional safeguards, and the government’s interest including fiscal and administrative burdens that added procedure would entail (Mathews v. Eldridge 335). That balancing logic is often treated as judicial rhetoric, but it is also an evaluative template: institutions must justify a design choice by showing why the contestability burdens they impose are proportionate to the stakes and the error risk, and why additional safeguards would or would not change outcomes at tolerable cost. The contestability cost index operationalizes that template for the domain this book addresses, namely institutional utterances produced under machine mediated drafting and workflow automation, where language becomes cheap while contestability remains expensive.
A second foundation comes from the administrative burden literature, which provides a disciplined decomposition of what it actually costs a person to interact with authoritative systems. Moynihan, Herd, and Harvey define administrative burden as composed of learning costs, psychological costs, and compliance costs that citizens face in their interactions with the state (Moynihan, Herd, and Harvey 43). Those categories matter here because an institutional utterance is often the gate through which a person must pass to seek review, preserve benefits, contest discipline, or challenge a denial. When the institution floods the record with fluent explanation while weakening the coupling between its claims and its evidentiary substrate, it does not remove burden; it relocates burden into the person’s learning work, their psychological exposure to uncertainty and stigma, and their compliance work of producing documentation, meeting deadlines, and navigating discretionary demands (Moynihan, Herd, and Harvey 47). The contestability cost index adapts that tripartite model to the utterance setting and adds two further dimensions that machine mediated institutions intensify: expertise dependence and access dependence. The result is an evaluative instrument that tracks whether an utterance is contestable at reasonable cost, which the book has already stated as part of the evaluative target for legitimacy.
The index is not a single number pretending to capture moral reality. It is a structured measurement framework designed to be stable enough for comparison and flexible enough to reflect domain differences. Its role is analogous to a risk assessment methodology in security and safety engineering: it creates shared variables, documents assumptions, and enables repeatable comparison across time, systems, and institutional units. NIST’s risk assessment guidance emphasizes that risk management begins by framing the assessment, including methodology, assumptions, constraints, and risk tolerance, then assessing and monitoring as part of a holistic process (NIST Special Publication 800 30 Revision 1 9 to 10; 12). The contestability cost index borrows that discipline: before measurement, the institution must declare the stakes category of the utterance, the procedural posture it triggers, the evidence classes it purports to rely on, the disclosure constraints it must respect, and the threat model that matters here, namely reason laundering, responsibility diffusion, and record flood. Only then can measurements be interpreted rather than merely collected.
The index therefore measures contestability cost across five variables expressed in auditable terms. Time cost is the total time required for an affected party, acting with reasonable diligence, to reach a state where they can challenge the utterance coherently and submit that challenge through the institution’s available channels. This includes time spent locating the operative reasons, identifying the decision procedure used, obtaining the minimum evidence necessary to contest the reasons, and completing the challenge process. This variable is not speculative, because administrative law and paperwork governance already treat time as a measurable burden. The Office of Management and Budget’s controlling paperwork rules define burden as “the total time, effort, or financial resources expended” by persons to generate, maintain, retain, or disclose information to or for a federal agency, and they enumerate subcomponents that map directly onto contestability tasks, such as reviewing instructions, searching data sources, completing and reviewing a collection of information, and transmitting the information (5 CFR 1320.3(b)(1)). The contestability cost index uses the same conceptual move, but the object is not the government’s collection of information; the object is the institution’s creation of a challenge path whose burdens can be measured.
Expertise cost is the degree to which contestability depends on specialized knowledge that an ordinary person cannot reasonably be expected to possess, including legal interpretation, technical system knowledge, or domain specific evidentiary inference. Under generative drafting, this cost often increases because the institution’s reasons become rhetorically coherent while their procedural and evidentiary basis becomes harder to reconstruct, so that a challenger must effectively reverse engineer the decision process rather than respond to a disclosed record. This is one of the characteristic harms of reason laundering: it converts what should be an accountable institutional explanation into a puzzle that requires professional decoding. The index measures expertise cost by recording what categories of expertise are required to mount a credible challenge, and by documenting what the institution did to reduce that requirement, for example by producing an utterance chain of custody for reasons that distinguishes observation, inference, and judgment, and that links claims to evidence pointers adequate for the stakes.
Access cost measures whether a challenger can obtain the relevant record materials, evidence pointers, and procedural metadata without discretionary gatekeeping, paywalls, or opaque internal systems. This is where documentary due process becomes concrete. A reason that cannot be accessed is not contestable in any meaningful sense, even if it exists somewhere inside the institution. Access cost is also where privacy constraints become decisive: the utterance commons must not answer access problems by increasing capture of personal interiors. Instead, it must provide selective disclosure of the minimal materials needed for contestation while protecting sensitive data and third party privacy. The index therefore requires the institution to document what is intentionally not disclosed, why, and what substitute contestation mechanisms exist, such as independent review channels or structured summaries that preserve the logic of the reasons without disclosing protected content.
Evidentiary cost measures the burden of producing and validating evidence necessary to contest the utterance. In ordinary litigation, proportionality doctrine already expresses the intuition that evidentiary burdens must be scaled to the needs of the case and the burdens of production, and Rule 26 frames discovery as bounded by proportionality considerations including “whether the burden or expense of the proposed discovery outweighs its likely benefit” (Fed. R. Civ. P. 26(b)(1)). The contestability cost index internalizes that proportionality logic as an institutional design constraint: if an institution makes contestation possible only by requiring a person to produce evidence that is impractical to obtain, or by forcing them into repeated documentation cycles that resemble the paperwork burdens described in administrative burden research, then contestability exists in name but not in fact. The index thus records what evidence a challenger must provide, what evidence the institution already possesses but fails to surface, and whether the institution has shifted burdens away from the person where it can do so without violating privacy or legal constraints, an approach that administrative burden research highlights when it describes shifting burdens from the citizen to the state through data systems that reduce learning and compliance costs (Moynihan, Herd, and Harvey 65).
Psychological cost is included not as sentiment but as an operational burden category that authoritative systems impose through uncertainty, stigma, and stress. Moynihan, Herd, and Harvey identify psychological costs as including the stigma of applying for programs and the stresses that arise when people depend on the state for vital resources and face uncertainty about receipt, noting that such uncertainty and frustration can elevate stress (Moynihan, Herd, and Harvey 48 to 49). In utterance systems, psychological cost is amplified when a person cannot tell whether the institution is responding to their actual situation or to a template, when responsibility is diffused so that no accountable agent can explain the basis of the utterance, and when the record becomes so saturated that the person experiences contestation as a form of exhaustion rather than a civic or contractual right. The index measures psychological cost using observable proxies, such as the number of procedural cycles required, the presence of confusing or contradictory notices, the degree of discretion left unexplained, the time windows imposed for response relative to the volume of material, and the availability of human escalation pathways that do not require additional disclosure of sensitive personal content.
Once these variables are defined, the evaluation harness requires a baseline and a post adoption measurement. Baseline measurement is performed on the institution’s current process for a given utterance class, with a small number of representative scenarios that reflect the institution’s actual caseload rather than idealized edge cases. Post adoption measurement is performed on the redesigned workflow that uses chains of custody for reasons and minimal provenance primitives. The core of the harness is comparative: the institution must show that contestability costs decreased in the dimensions that matter for legitimacy, and must also show that the decrease did not come from impermissible moves, such as shifting burden onto privacy invasive capture, or suppressing contestation by limiting access, shortening deadlines, or narrowing grounds of review.
The harness also requires that measurement be performed under an explicit threat model, because otherwise the institution can optimize for the metric while preserving the harm. In the threat model already developed in this book, the most relevant adversary is not an external forger but an internal incentive structure that rewards record flood and responsibility diffusion. A contestability harness that measures only time could be gamed by producing a shorter notice that omits the real reasons. A harness that measures only access could be gamed by exposing large volumes of irrelevant text. The index therefore treats the chain of custody for reasons as part of what is measured. If the utterance does not include attributable procedure, responsible roles, and evidence pointers proportionate to the stakes, then reductions in time or access costs are treated as suspect because they may reflect reason suppression rather than contestability improvement.
The privacy constraint is enforced inside the harness rather than appended as an ethical caveat. The index explicitly distinguishes what must be verifiable from what must be captured. The institution must be able to prove that the utterance was produced by a defined procedure, under defined constraints, by accountable roles, and with evidence pointers appropriate to the stakes, but the institution must not default to logging prompts, internal deliberations, or personal interiors as the means of proof. The point is a verifiable chain of custody for reasons, not a total archive of cognition. This distinction is why the index measures access to evidence pointers rather than access to raw internal logs, and why it evaluates selective disclosure and role based accountability as success conditions rather than as compromises.
A serious counterargument is that the contestability cost index will become another managerial instrument that displaces substantive justice with process metrics, inviting institutions to pursue improvements in what is counted while neglecting what is right. There is also a technical version of the critique: any index can be gamed, and institutions that are already inclined to reason laundering will simply launder the measurement process. Both critiques are plausible, and the book’s own diagnosis of compliance theater makes them impossible to dismiss as cynicism. The response is not to abandon measurement, because abandoning measurement simply returns power to surface fluency and institutional assertion. The response is to bind the index to adversarial testing and to external accountability. The index must be audited as a contestability instrument, not reported as a performance metric. Its inputs must be reproducible by an outsider using the disclosed utterance artifacts and the defined procedures, and its results must be interpretable in light of the threat model. In other words, the index is legitimate only when it is itself contestable. That is also why this chapter’s harness borrows from risk assessment practice, which insists on declaring assumptions and constraints, and from procedural law’s insistence that burdens and benefits be considered proportionately rather than asserted (NIST Special Publication 800 30 Revision 1 12; Fed. R. Civ. P. 26(b)(1)).
If adopted, the contestability cost index changes what institutions can claim. Instead of asserting that a system is transparent because it produces more explanation, an institution must demonstrate that affected parties can challenge institutional utterances at reasonable cost, with attributable procedure and evidence links proportionate to the stakes, and without expanding surveillance. The remaining risk is not small: institutions may still attempt to turn the index into paperwork, or to treat reductions in one dimension as permission to raise burdens elsewhere. For that reason, the index must remain tethered to the chain of custody for reasons and to privacy constraints as non negotiable, and it must be embedded in audit routines that treat reason laundering and record flood as adversarial behaviors rather than as unfortunate mistakes. The index is the harness that allows the utterance commons to be evaluated as infrastructure rather than narrated as virtue, which is the only posture in which legitimacy after fluent text can be rebuilt.
Chapter Fourteen
The Authenticity Operating Model Inside Institutions
The governance failure that this book has tracked is not that institutions will adopt generative drafting, because they will, but that they will treat institutional speech as an output of tooling rather than as an act of authority whose legitimacy depends on contestability, attributable procedure, and evidence linkage proportionate to stakes. The operating model in this chapter answers the practical question that auditors, counsel, security leaders, and front line managers will all ask in different language: who owns the utterance layer, who is accountable when the chain of custody for reasons is thin, what gets reviewed and when, what evidence must exist before a consequential utterance ships, and how the institution prevents the authenticity apparatus from becoming either a new bureaucracy that emits more text or a surveillance system that captures more life than legitimacy requires.
Ownership: the utterance layer as a governed capability, not a product feature
The institution must treat the utterance layer as a shared capability that sits alongside security, privacy, and risk, because it binds the organization’s speech acts to procedure evidence and constraint versions, and that cannot be delegated entirely to any single function without creating blind spots. NIST’s Risk Management Framework describes an organization wide process that depends on defined roles and responsibilities for categorization, control selection, implementation, assessment, authorization, and monitoring, with explicit attention to ongoing monitoring and risk response rather than one time compliance (NIST, Risk Management Framework for Information Systems and Organizations). The utterance commons requires the same posture: ownership is distributed, but accountability must be singular at the level of the decision procedure that produces the utterance.
In practice, the cleanest fit is to align utterance governance with the Three Lines Model, not as a corporate fashion but as an independence design that keeps review from collapsing into self certification. The Institute of Internal Auditors emphasizes that third line roles provide independent assurance and advice, distinct from management, and that independence is a defining characteristic of internal audit (IIA, Three Lines Model). The operating model therefore assigns primary accountability for utterance production to first line owners, meaning the business function that issues the utterance and benefits from it, while second line functions define the control expectations and monitor compliance, and third line internal audit tests whether contestability is real rather than narrated.
Decision rights: what is owned by the business, what is owned by governance
A verifiable utterance system fails when decision rights are ambiguous, because ambiguity is the administrative form of plausible deniability. The operating model must therefore separate, and then bind, five decision rights.
The first decision right is stakes classification. The business owns the decision that an utterance is being issued, but the institution owns the taxonomy that determines what chain of custody for reasons is required for that class of utterance, because stakes determine disclosure duties, evidence sufficiency thresholds, and escalation requirements.
The second decision right is procedure definition. The business owns the substantive decision procedure, including how evidence is weighed and what approvals are required, but second line governance owns the requirement that the procedure be stated in a form that can be audited, and that it include explicit checkpoints where observation, inference, and judgment are separated, because that separation is what prevents templated narrative from becoming the substitute for evidence.
The third decision right is constraint governance. The constraint registry, including template versions, model usage policies, redaction rules, and approval matrices, must be owned by a cross functional governance function, because if a single business unit can silently modify constraints, it can rewrite the institution’s own rules without friction, and then launder that change into the record. This maps to NIST’s broader posture that controls are implemented as part of an organization wide risk management process that is adaptable, testable, and responsive to diverse threats and privacy risks rather than static declarations (NIST, Security and Privacy Controls for Information Systems and Organizations).
The fourth decision right is issuance authorization. For high stakes utterances, issuance must require an accountable role attestation that the decision procedure completed and that evidence pointers exist, with the attestation bound to the utterance artifact. This is structurally analogous to an authorization decision in the RMF, where an authorizing official accepts risk based on assessment results and supporting evidence, which makes authorization a traceable act rather than a diffuse hope (NIST, Risk Management Framework for Information Systems and Organizations).
The fifth decision right is disclosure scope. Privacy and legal constraints often require withholding sensitive content, but the institution must still provide contestability through selective disclosure of the chain of custody for reasons. The disclosure scope decision must therefore be owned jointly by legal and privacy leadership, with predefined rules that avoid ad hoc gatekeeping, because ad hoc gatekeeping becomes an access tax that raises contestability costs in exactly the way this book has warned against.
Review rituals that generate evidence rather than documents
Institutions often respond to new risk by adding review meetings that produce more text. The operating model here requires the opposite: review rituals must produce evidence that the procedure was followed, and must do so with bounded capture. The practical mechanism is to make procedure checkpoints emit structured events into the procedure log and to make issuance contingent on those events, so that review becomes a question of verifying completion rather than composing additional narrative.
NIST’s log management guidance is explicit that effective log management is an enterprise practice, not a local convenience, and that logs are valuable only when they are collected, protected, and reviewed under governance that makes them usable for their intended purposes (Kent and Souppaya, Guide to Computer Security Log Management). In the utterance commons, the intended purpose is not exhaustive surveillance, but the ability to prove that specific procedural steps occurred, under known constraints, at known times, so that later contestation does not devolve into narrative reconstruction.
This is also where NIST’s AI risk governance framing provides a useful discipline. The AI RMF organizes risk management into the functions Govern, Map, Measure, and Manage, and it emphasizes governance as an organization wide set of processes rather than a one time compliance artifact (NIST, Artificial Intelligence Risk Management Framework). If the institution adopts generative drafting in consequential utterance pipelines, then the utterance layer must be governed with the same rhythm: map the utterance classes and stakes, measure contestability cost, manage by changing procedures and constraints, and govern by assigning roles, accountability, and monitoring that persists over time.
Escalation when provenance is thin and speed is demanded
High throughput environments create a predictable temptation: ship the utterance now and clean up procedure evidence later. The operating model therefore needs an explicit escalation path that treats thin provenance as an operational incident, not as a paperwork nuisance. The escalation rule is simple: when an utterance class requires a chain of custody for reasons, issuance cannot proceed unless the minimal fields exist, and any override requires an explicit recorded justification by an accountable role, with a bounded time window for remediation and an automatic sampling flag for audit.
This mirrors the RMF’s monitoring logic in which ongoing monitoring triggers risk response rather than being a passive dashboard, and in which system owners, common control providers, and authorizing officials have specified responsibilities when posture changes or deficiencies are discovered (NIST, Risk Management Framework for Information Systems and Organizations). The institutional analogue is that the utterance owner cannot silently accept provenance debt, because provenance debt is legitimacy debt that will later be paid by an affected party through increased contestability costs.
Audit routines that test contestability rather than compliance artifacts
Internal audit should not be asked to certify that the organization “has provenance.” It should be asked to test whether contestation is feasible at reasonable cost, using the contestability cost index as the evaluation harness. The Three Lines Model is explicit that internal audit provides independent assurance and advice and is not part of management’s decision making, which is precisely what is needed to keep the utterance commons from becoming self attested theater (IIA, Three Lines Model). The audit program therefore samples utterances by class and stakes, reconstructs the challenge path available to an affected party, verifies that evidence pointers resolve under the stated access rules, checks that constraint versions are present and immutable, and measures time, expertise, access, and evidentiary burden under realistic assumptions.
The second line function, which may be a combination of compliance, risk, privacy, and security, owns continuous monitoring and control performance reporting. NIST’s security and privacy control catalog is useful here not because the utterance commons is identical to information security, but because the catalog formalizes expectations for audit and accountability, including event logging and protection of audit information, as repeatable control outcomes that can be assessed and monitored (NIST, Security and Privacy Controls for Information Systems and Organizations). The operating model should treat utterance controls the same way: defined, assessable, and monitored, with failure treated as a control deficiency that triggers remediation rather than as a documentation gap to be patched with narrative.
Procurement, templates, and toolchains: integrating governance without building a new bureaucracy
The operating model will fail if it is implemented as a new committee that reviews words, because words are now cheap. The core integration move is instead to govern the constraint registry and the signing and attestation mechanisms as shared platform services, so that business units can issue utterances quickly while still emitting verifiable artifacts by default. This is also the point where vendor relationships matter. If the institution relies on external model providers, workflow platforms, or template systems, then constraints must be enforceable and attestable across that boundary, or else the institution will be unable to prove the constraints it claims governed issuance.
NIST’s Generative AI Profile, as a companion to the AI RMF, is valuable precisely because it describes risk management actions tailored to generative systems, including documentation and governance practices intended to manage risks unique to generative models, rather than implying that generic AI policies suffice (NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile). The operating model should treat procurement and platform selection as part of utterance governance: tools must support versioned constraints, event logging suitable for audit, and attestation surfaces that can be verified by independent parties.
Privacy governance: what is intentionally not logged
The most important negative requirement in the operating model is that it must clearly define what is not captured. The system must not default to storing prompts, drafts, or private deliberations as the mechanism of verifiability, because that approach expands inference scope and creates surveillance creep. Instead, the model stores procedure facts, constraint identifiers, role attestations, and evidence pointers, and it discloses selectively based on stakes. This approach fits both the log management discipline of collecting what is necessary for the intended purpose and protecting it, and the AI RMF emphasis on governance that manages risks to individuals and society rather than optimizing for institutional convenience (Kent and Souppaya, Guide to Computer Security Log Management; NIST, Artificial Intelligence Risk Management Framework).
Counterargument: the operating model will slow decisions, raise liability, and invite gaming
A realistic objection is that a formal utterance operating model will slow high volume processes, increase the cost of issuance, and create new legal exposure by generating evidence trails that plaintiffs can exploit. A second objection is that any model can be gamed: staff will learn to satisfy required fields with minimal substance, and the institution will produce attestations that are formally valid while remaining epistemically thin. A third objection is that governance will metastasize, because once the institution builds an utterance layer, every function will want to use it as a repository for everything.
The response concedes that these risks exist and then tightens the boundaries. Speed does not require ungoverned speech; it requires platformized controls that make the right behavior the default, which is why this chapter insists that the constraint registry, event logging, and attestation be built as shared services rather than as ad hoc rituals. Liability does not meaningfully increase when the institution can show it followed its own procedures under known constraints; what increases liability is the gap between what the institution asserts and what it can prove when challenged. Gaming is addressed by shifting the audit target away from presence of fields and toward measured contestability outcomes, because the contestability cost index exposes hollow compliance by showing that affected parties still cannot challenge at reasonable cost. Governance sprawl is addressed by enforcing the privacy and minimization rule as a first principle, by explicitly stating what is not logged, and by making any escalation to deeper capture a stakes based exception that is itself auditable.
Closing: what changes, what remains risky
If an institution adopts this operating model, institutional utterances stop being treated as mere documentation and start being treated as the controlled interface between power and accountability. Business owners remain responsible for decisions, but the institution becomes capable of proving procedure, constraints, and evidence linkage in a way that reduces contestability costs without expanding surveillance. What remains risky is drift. Drift toward theater occurs when attestations and logs are generated but not verified and not used to reduce contestability burdens. Drift toward surveillance occurs when leaders equate accountability with maximal capture and allow the utterance layer to become an archive of interior life. The operating model’s purpose is to prevent both drifts by assigning decision rights, enforcing minimization, and embedding independent testing, so that legitimacy after fluent text becomes an operational capacity rather than a rhetorical claim.
Chapter Fifteen
Benefits Determination and the Right to Challenge
A benefits determination is an institutional utterance whose allocative force is not metaphorical: it can terminate food, housing stability, medical care, and the basic continuity of life. In that setting, the legitimacy question is never whether the institution can produce an explanation, because an explanation can now be generated at scale, but whether the person can contest the explanation at a reasonable cost, with access to the operative reasons and the evidence those reasons rely upon, within timelines that do not convert procedural rights into exhaustion.
The doctrinal stakes are well established. In Goldberg v. Kelly, the Court treated welfare benefits as statutory entitlements whose termination triggers procedural due process, emphasizing that the recipient must receive timely and adequate notice of reasons and an effective opportunity to defend, with a decision that rests on the evidence adduced. (Goldberg 264–71). In Mathews v. Eldridge, the Court articulated the now canonical balancing test, focusing on the private interest affected, the risk of erroneous deprivation under existing procedures and the value of added safeguards, and the Government’s interest including administrative burdens. (Mathews 332–35). The important point for this chapter is not to relitigate Goldberg versus Mathews as competing moral postures, but to treat both as a procedural engineering mandate: the system must be designed so that reasons can be reviewed and challenged without making the challenger pay an unreasonable contestability tax in time, expertise, access, and evidentiary labor.
The baseline workflow and where contestability costs concentrate
To keep the case study concrete, this chapter uses the familiar structure of federal disability benefits adjudication as the baseline model, because it shows the essential procedural anatomy that repeats across benefit programs even when doctrinal details differ. The Social Security administrative review process is staged: an initial determination, reconsideration, a hearing before an administrative law judge, Appeals Council review, and then judicial review. (20 C.F.R. § 404.900). This sequence is often narrated as a ladder of protections, but in practice it is also a ladder of burdens that can render rights theoretical when the claimant cannot locate the operative reasons, cannot access the evidence, or cannot identify who is accountable for the decision procedure that produced the denial.
Under baseline operations, contestability costs concentrate in four places. First, the notice itself is frequently a compressed narrative that gestures at regulatory standards while leaving the critical inferential steps implicit, which forces the claimant to infer the institution’s reasoning from fragments. Second, evidence access is mediated by administrative systems and by practical barriers, so that “the record” exists but is not trivially usable by the affected party. Third, the procedural posture shifts across stages, so that the claimant must repeatedly translate their case into new forms, and each translation creates learning costs and compliance costs that function as silent eligibility filters. Fourth, accountability is structurally diffused: multiple staff roles touch the file, but responsibility for the decisive rationale is rarely presented in a way that permits examination, even though examination is exactly what the due process posture presupposes. (Goldberg 264–71; Mathews 332–35).
How generative drafting changes the failure modes
Generative drafting does not create the underlying asymmetry in benefits adjudication, but it intensifies it by making the institution’s language cheaper than the person’s capacity to respond. Three failure modes dominate.
The first is record flood that appears as helpfulness. When the institution can produce longer notices, more attachments, more summaries, and more “clarifications” without proportional increases in evidentiary grounding, the claimant receives more text but not more contestable reasons. In Goldberg, notice is not treated as a volume of words but as a disclosure of reasons adequate to defend against termination. (Goldberg 264–66). Record flood converts that requirement into an illusion: the institution appears transparent while the claimant’s time cost rises.
The second is post hoc rationalization at scale. State Farm is not a benefits case, but its warning is structurally relevant: agencies must supply a rational connection between facts found and choices made, and courts are wary of after the fact rationalizations that substitute for contemporaneous reasoning. (State Farm 43–44). Generative drafting makes after the fact narrative assembly operationally easy, especially when procedural metadata is thin, because the institution can produce rhetorically coherent explanations that are not reliably coupled to what decision makers actually relied upon at the time.
The third is reason laundering through diffusion of authorship. When the notice is assembled by templates, tool suggestions, and standardized paragraphs, responsibility becomes distributed across a system that no individual claims as their own reasoning, even though the utterance has allocative consequences. The claimant then faces an institutional voice that cannot be cross examined, not because the institution refuses in bad faith, but because its own process has dissolved accountable ownership.
Redesign: a chain of custody for reasons inside benefits determination
The utterance commons redesign begins by treating the benefits notice not as a letter, but as an utterance artifact with a minimal chain of custody for reasons attached. The institution issues a canonical final notice that can be verified as the operative version, and it includes a structured reason graph that distinguishes observation, inference, and judgment, because that distinction is the difference between evidence and narrative.
In the redesigned workflow, each denial or termination notice carries, at minimum, four linked components.
First, a claims map that states the decisive findings and the governing standard at the level needed for challenge, not as a regulatory collage but as a small set of propositions that can be disputed. This responds directly to Goldberg’s insistence on reasons that can be confronted. (Goldberg 264–66).
Second, stable evidence pointers that bind each decisive observation to the record item on which it depends, with integrity anchoring so evidence cannot be quietly swapped after issuance. The system does not dump the whole file into the notice. It provides a pointer scheme that makes retrieval and review feasible without bulk duplication.
Third, procedure attestations that identify, at the role level, who is accountable for the determination and which decision procedure version governed issuance. This is the central anti laundering move: it does not demand personal diaries or raw prompts, but it prevents the institution from speaking without accountable roles.
Fourth, selective disclosure rules that provide the claimant a disclosure packet proportionate to stakes, while protecting sensitive third party information and avoiding surveillance creep. The packet is designed to allow challenge without making the claimant request special access just to learn what the institution relied upon.
The procedural posture across review levels remains intact. The difference is that the institution stops forcing the claimant to reverse engineer the institution’s reasons. The chain of custody for reasons becomes the default artifact of issuance rather than an optional reconstruction performed only when litigation becomes likely. This design is directly aligned with Mathews, because it treats added safeguards as valuable when they reduce the risk of erroneous deprivation without imposing disproportionate administrative burdens. (Mathews 332–35). The crucial observation is that the additional safeguard here is not a more elaborate hearing at every step. It is a measurable reduction in the cost of understanding and contesting the institution’s stated reasons.
Evaluation using the contestability cost index
Under the baseline model, time cost is dominated by reading and interpretation work that does not move the claimant closer to the operative reasons, and by repeated procedural translation across stages. Under the redesigned model, time cost drops because the claims map identifies the decisive propositions and the evidence pointers identify where the relevant record items are, so the claimant can focus on contesting the actual basis of decision rather than guessing.
Under the baseline model, expertise cost rises because challengers need specialized knowledge to infer what standard was applied and to locate what evidence mattered. Under the redesigned model, expertise cost is reduced, not eliminated, because the system makes the inferential steps explicit and binds them to evidence pointers, which shifts some burden from legal decoding to substantive disputation.
Under the baseline model, access cost is often a function of discretionary gatekeeping and system friction. Under the redesigned model, access cost is reduced because the disclosure packet is automatically produced at issuance time with selective disclosure rules, so the claimant does not need to fight for the minimum materials required to challenge.
Under the baseline model, evidentiary cost is inflated by uncertainty about what evidence the institution treated as decisive, so the claimant over produces or misdirects their proof. Under the redesigned model, evidentiary cost becomes more proportional because the institution’s claims map and evidence pointers narrow the scope of what must be contested, which is structurally consistent with Mathews’ emphasis on reducing error risk through targeted safeguards. (Mathews 332–35).
Under the baseline model, psychological cost is intensified by opacity, uncertainty, and repetitive demands. Under the redesigned model, psychological cost is reduced insofar as the claimant can see what the institution actually relied upon and how to respond, although it is not eliminated because the stakes remain high and the lived experience of contesting authority is itself taxing.
The index also measures whether these improvements were purchased by privacy violating capture. The redesigned system explicitly does not log raw prompts, private drafts, or claimant interior details beyond what the underlying benefits process already requires. What is logged are bounded procedure facts, constraint identifiers, role attestations, and evidence pointer integrity anchors, because those are sufficient to verify procedure without converting the institution into a comprehensive surveillance machine.
What is intentionally not logged
The privacy constraint is enforced by a negative specification. The system does not store the free form drafting dialogue that produced the notice. It does not store private speculation by staff as a default. It does not store claimant communications beyond what the underlying program requires. It does not store third party sensitive details except where legally mandated and governed by existing confidentiality rules. Instead, it stores the minimum chain of custody for reasons required for contestability: which procedure version applied, which accountable roles attested, which claims were decisive, which evidence pointers support those claims, and which disclosure rules governed what the claimant could see.
This is not a moral ornament. It is a legitimacy constraint. If authenticity infrastructure becomes surveillance infrastructure, then the institution has solved a contestability problem by creating a new power imbalance, which violates the book’s settlement.
Counterarguments and limits
A serious counterargument is that benefits systems are already overloaded, and that adding chains of custody for reasons will slow issuance, increase backlogs, and reduce the institution’s capacity to deliver timely benefits. Another counterargument is that making reasons more explicit will increase litigation and strategic behavior by claimants and representatives, raising administrative burdens and potentially distorting adjudication. A third counterargument is that evidence pointers and disclosure packets may inadvertently expose sensitive information, increasing privacy risk.
The response must concede that any redesign that improves contestability can increase the rate and quality of challenges, because challenges become cheaper to mount. That is not a failure of the design. It is the revelation of previously suppressed contestation, which Goldberg already treats as a due process requirement when termination is at stake. (Goldberg 264–71). The administrative burden concern is addressed by the minimality of the primitives and by platformization: the institution is not asked to write more, but to bind what it issues to procedure evidence and evidence pointers that it already touches in the ordinary course. The privacy concern is addressed by selective disclosure rules and by the strict refusal to log prompts and drafts as default proof.
The unresolved limit is that any system can be gamed. A claims map can be made formally present but substantively empty. Evidence pointers can be provided to voluminous material that is functionally unusable. Role attestations can be assigned to functionally powerless accounts. That is why this case study must be read together with the audit test suite and the contestability cost index harness: the governance regime must test whether contestability is real, not whether artifacts exist.
Closing: what changes, what remains risky
If the utterance commons redesign is adopted in benefits determination, the notice ceases to be a narrative that the claimant must decode and becomes a verifiable utterance that the claimant can challenge without first reconstructing the institution’s hidden procedure. Contestability costs fall in the dimensions that matter because the system discloses the decisive propositions and binds them to evidence pointers and accountable roles at issuance time, which is what makes due process practically available rather than ceremonially promised. What remains risky is institutional drift toward either record flood or surveillance, and the persistent temptation to substitute formal artifacts for substantive accountability. The case study’s success condition is therefore strict: not that the institution produces more explanation, but that a person facing deprivation can understand, contest, and obtain review of the reasons at a cost proportionate to the stakes. (Goldberg 264–71; Mathews 332–35; 20 C.F.R. § 404.900).
Chapter Sixteen
Workplace Discipline and the Synthetic Performance File
Workplace discipline is where the institutional utterance becomes intimate and coercive at the same time, because it converts managerial perception into an allocative record that governs pay, promotion, exit, and reputational survivability across reference checks and internal transfers. In that setting, the central risk introduced by generative drafting is not that the institution will lie more often, but that it will be able to manufacture a coherent documentary rationale at a speed and volume that outruns any employee’s ability to contest what is being asserted, while dispersing authorship across templates, tools, and review chains such that no accountable agent can be examined about why the institution said what it said.
This case study focuses on the “performance file” as an institutional utterance layer, meaning the set of warnings, performance improvement plans, investigative summaries, and termination rationales that become the institution’s canonical account of why it acted. That file already plays a structural role in legal adjudication. In discrimination claims governed by the familiar burden shifting framework, the employer is expected to articulate a legitimate, nondiscriminatory reason for the challenged employment action, after which the employee attempts to show pretext. (McDonnell Douglas 802–05). The practical result is that documentation becomes the institution’s primary evidentiary posture, and the contest becomes, in significant part, a contest over the trustworthiness and meaning of the record.
At the same time, disciplinary and investigative interviews are themselves regulated in key contexts. For union represented employees, the right to request representation during investigatory interviews that the employee reasonably believes may result in discipline is recognized under the National Labor Relations Act as construed by the Supreme Court in NLRB v. J. Weingarten, Inc. (Weingarten 256–61). For public employees with a protected property interest in continued employment, due process requires at least notice of charges, an explanation of the employer’s evidence, and an opportunity to respond before termination, with post termination procedures providing fuller review. (Loudermill 545–46). These doctrines differ in scope and audience, but they share a design implication that becomes more urgent under generative saturation: legitimacy depends on the employee’s ability to understand and contest the institution’s stated reasons without being crushed by procedural and informational costs.
The baseline workflow and where contestability costs concentrate
A baseline disciplinary workflow in large institutions is structurally repetitive even when it is dressed in local policy language. A manager records observations and concerns, often informally at first, then escalates to documented feedback, then to a formal performance improvement plan or corrective action document, then to termination or demotion if improvement is deemed insufficient. HR and legal functions may review documentation at key points, especially as the risk of a protected activity claim or discrimination claim rises. The record is stored in human resources systems and case management tools, with fragments distributed across email, chat, ticketing systems, performance review tools, and investigation notes.
Contestability costs concentrate where the record compresses complex human activity into narrative conclusions. The most expensive step for the employee is typically not responding to a specific observation, but reconstructing what the institution is actually alleging, what evidence it considers decisive, and which inferences bridged observation to judgment. The baseline file often blurs these layers. A manager’s impression is recorded as a fact. A downstream summary treats that impression as settled evidence. A termination rationale then cites the summary, and the original observation becomes difficult to locate. This is a classic contestability trap: the employee faces a closed loop of documents that cite one another rather than citing stable underlying evidence.
Baseline recordkeeping obligations exacerbate the stakes of this file. Employers are required under EEOC recordkeeping rules to retain personnel or employment records for specified periods, including around involuntary terminations, which means the performance file is not ephemeral rhetoric but a durable evidentiary artifact. (29 C.F.R. pt. 1602; EEOC, “Summary of Selected Recordkeeping Obligations”). Once a record is durable, disputes inevitably become disputes about what the record means, who created it, and whether it can be trusted.
How generative drafting changes the failure modes
Generative drafting changes the workplace discipline risk profile by multiplying narrative capacity while leaving contestability capacity largely unchanged. Three failure modes dominate.
The first is the synthetic performance file as record flood. When managers can rapidly generate weekly “coaching notes,” summarize months of activity into crisp narratives, and produce polished rationales for escalating discipline, the file grows faster than any employee can rebut it, and the institution gains a documentary advantage that is unrelated to the underlying truth of events. The employee may be confronted not with one contested claim, but with a dense collage of plausible sounding assertions that require high time and expertise to unwind, even when the core dispute is narrow.
The second is reason laundering through template and tool diffusion. Discipline documents often originate as templates. Under generative assistance, the template becomes a prompt, the prompt becomes an output, the output becomes a revised output, and the final narrative may have passed through multiple hands that each treat the tool as the author. The result is not necessarily intentional deception, but a structural disappearance of accountable judgment. In litigation, the employer can still point to the record as its legitimate rationale, but no one can explain which observations were truly decisive or why alternative interpretations were rejected. That is precisely the kind of diffusion that makes meaningful challenge expensive.
The third is algorithmic or quasi algorithmic evaluation that becomes a selection procedure without being treated as one. Institutions increasingly use scoring, ranking, productivity analytics, and evaluative software to guide discipline, promotion, and termination decisions. The EEOC has made explicit that algorithmic decision making tools can function as employment selection procedures, and that adverse impact analysis under Title VII is implicated when such tools disproportionately exclude protected groups absent job relatedness and business necessity. (EEOC, Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence; 29 C.F.R. pt. 1607). A synthetic performance file can therefore become a vehicle for laundering a biased evaluation signal into a seemingly neutral narrative, with the narrative serving as the institution’s legitimate reason under McDonnell Douglas while the underlying selection procedure remains unexamined. (McDonnell Douglas 802–05).
A final evidentiary complication should be made explicit. Performance files often enter disputes as business records, and the trustworthiness of those records depends, in part, on whether they were made in the course of a regularly conducted activity and whether the method and circumstances of preparation indicate reliability. (Fed. R. Evid. 803(6)). If an institution floods the file with machine generated narrative detached from contemporaneous observation, it increases the likelihood that the file’s circumstances of preparation will be contested as untrustworthy, which is an institutional risk, but it is also a legitimacy risk for employees who are forced to fight the record itself rather than the underlying events.
Redesign: an utterance commons approach for discipline records
The redesign begins with a strict separation of three layers that the baseline workflow routinely collapses: observation, inference, and judgment. The redesign does not prohibit narrative, because narrative is often necessary for managerial communication, but it requires that narrative be tethered to a chain of custody for reasons that makes contestation feasible.
In the redesigned workflow, every consequential disciplinary utterance is issued as a verifiable artifact with a minimal chain of custody for reasons attached. The artifact contains a claims map that states the decisive propositions, including what conduct or performance deficit is alleged, what policy or role expectation is invoked, and what action is proposed. It then contains stable evidence pointers to the underlying observations, such as dated work products, ticket history, documented customer feedback, time bounded project outcomes, or recorded policy violations, with the evidence pointer scheme designed to be auditable and resistant to silent substitution after issuance.
The artifact also includes an explicit inference layer that distinguishes what is directly observed from what is interpreted. This matters because much of workplace dispute is not about whether a meeting occurred, but about what the meeting signified, whether delays were attributable to the employee or to systemic constraints, and whether comparable employees were treated similarly. By forcing inference to be explicit, the institution makes it possible to contest bias and inconsistency without requiring the employee to infer the institution’s inferential steps from prose.
Finally, the artifact includes a judgment attestation by accountable roles, and a procedure version identifier that specifies the constraint set under which the utterance was produced, including template version, any use of generative drafting assistance, and any evaluative tool or scoring model that materially contributed to the decision. This does not require disclosure of prompts or drafts. It requires disclosure that a tool was relied upon as part of the decision procedure, and that the tool’s use was governed by a constraint set that can be audited. Where evaluative software is used as a selection procedure, the artifact links to the institution’s validation or adverse impact assessment posture consistent with the Uniform Guidelines framework and the EEOC technical assistance posture. (29 C.F.R. pt. 1607; EEOC, Select Issues).
The employee’s contestability packet is generated at the time of issuance, not upon request. In union contexts, it is structured to support representational rights during investigatory interviews, so that the representative can examine the decisive claims and evidence pointers rather than negotiating in the dark. (Weingarten 256–61). In public employment contexts, it is structured to satisfy the minimum due process requirement of notice, explanation of evidence, and opportunity to respond in a way that is practically usable rather than ceremonially asserted. (Loudermill 545–46). In discrimination contexts, it is structured to prevent the employer’s “legitimate reason” narrative from being insulated from scrutiny by being disconnected from stable underlying evidence and from the actual procedure that produced the rationale. (McDonnell Douglas 802–05).
Evaluation using the contestability cost index
Under baseline practice, the time cost of contestation is dominated by reconstruction work. The employee must locate what the institution is actually claiming, identify what evidence it treated as decisive, and respond across multiple documents that cite each other rather than citing stable underlying materials. Under the redesigned workflow, time cost decreases because the claims map and evidence pointers compress the reconstruction burden into a bounded set of propositions and linked materials.
Under baseline practice, expertise cost is high because employees often need specialized knowledge of policy language, employment law, and organizational systems to challenge a narrative that is written in professionalized compliance prose. Under the redesigned workflow, expertise cost is reduced because the institution is required to surface the inferential steps and the evidence links, which allows a challenger to focus on substantive dispute rather than on decoding.
Under baseline practice, access cost is frequently the decisive barrier. The employee may not have access to internal tools, historical records, or comparative information that would reveal inconsistency. Under the redesigned workflow, access cost is lowered insofar as the contestability packet provides the decisive evidence pointers and preserves employee access to relevant materials for a bounded period, subject to confidentiality and privacy constraints. This does not create a right to all institutional data, but it prevents the institution from relying on evidence that is practically inaccessible to the person who is being sanctioned.
Under baseline practice, evidentiary cost is inflated because the employee cannot tell which facts matter, and therefore must overproduce rebuttal, often in emotionally charged conditions. Under the redesigned workflow, evidentiary cost becomes more proportional because the institution has committed, in the artifact itself, to what it treated as decisive, and the employee can focus their challenge on that nucleus.
The redesigned model also affects the institution’s risk posture. By strengthening the tether between asserted reasons and stable evidence, the organization reduces the probability that a record will be challenged as untrustworthy in the way contemplated by the business records reliability logic. (Fed. R. Evid. 803(6)). The point here is not to optimize for litigation, but to ensure that the institution’s own record is a contestable artifact rather than a rhetorical shield.
Privacy constraints and what is intentionally not logged
The redesign is legitimate only if it does not convert workplace governance into total capture. The chain of custody for reasons therefore excludes raw prompts, intermediate drafts, private deliberative dialogue, and broad employee surveillance streams as default proof. It does not require capture of private communications beyond what is already governed by existing workplace policies and legal constraints. It does not ingest personal health information, family circumstances, or other sensitive contextual details except where necessary for accommodation processes governed by separate legal frameworks.
What is logged is bounded: procedure events, constraint identifiers, role attestations, the claims map, and stable evidence pointers. The logic is that contestability requires proof of attributable procedure and evidence linkage, not an archive of interior life. Where algorithmic tools influence evaluative decisions, the system logs that the tool was used as part of the decision procedure and links to the institution’s adverse impact assessment posture in the manner contemplated by the Uniform Guidelines and the EEOC technical assistance framing. (29 C.F.R. pt. 1607; EEOC, Select Issues).
Counterarguments and limits
A serious objection is that discipline is an area where managers need discretion, speed, and psychological safety to document concerns candidly, and that requiring structured chains of custody will chill management speech, create procedural friction, and invite constant contestation that undermines governability. A second objection is that requiring inference separation and evidence pointers will force organizations to disclose sensitive comparative information, risking privacy of other employees and encouraging adversarial behavior. A third objection is that, in many workplaces, the legal baseline is at will employment, so requiring a documentary due process layer may appear to exceed what law requires.
The response begins by conceding that not every workplace utterance should be treated as a high stakes artifact. The operating model must be stakes sensitive, and minor coaching notes should not be transformed into formal evidence packets. The redesign applies to consequential utterances with allocative consequences, including formal warnings, performance improvement plans, investigatory findings used for discipline, and termination rationales. The second objection is met by the selective disclosure posture: contestability does not require disclosure of every comparative datum, but it does require that the institution not rely on inaccessible evidence while demanding that the employee accept the conclusion. The third objection is met by returning to the core claim of this book: legitimacy is not identical to legal minimums, and in practice institutions that cannot be contested at reasonable cost become ungovernable, because grievance, attrition, and external escalation become the only remaining accountability mechanisms. In addition, the existence of discrimination doctrine and recordkeeping obligations means that performance files will often be used as justificatory evidence regardless of the formal employment baseline, which is why the trustworthiness and provenance of those files matters both ethically and operationally. (McDonnell Douglas 802–05; 29 C.F.R. pt. 1602).
The remaining limit is gaming. Managers can still fill structured fields with strategic content. Evidence pointers can still point to voluminous material that is not meaningfully reviewable. This is why the contestability cost index remains the controlling evaluation target: the institution must measure whether the employee’s ability to challenge has improved in practice, not whether the organization has produced a new documentary form.
Closing: what changes, what remains risky
If the redesign is adopted, the performance file stops functioning as a narrative fortress and becomes a contestable utterance layer, where observation, inference, and judgment are separated, where decisive claims are linked to stable evidence pointers, and where accountable roles attest to the procedure that produced the utterance. The employee is no longer required to reverse engineer the institution’s reasons from polished prose generated under throughput pressure, and the institution no longer relies on diffuse authorship as an escape from examination. What remains risky is the institutional temptation to expand logging in the name of certainty, and the parallel temptation to satisfy formal requirements without changing the practical cost of challenge. The success condition is therefore concrete: contestability must become cheaper in time, expertise, access, and evidentiary labor for the employee, while provenance remains bounded enough that authenticity infrastructure does not become workplace surveillance. (Weingarten 256–61; Loudermill 545–46; McDonnell Douglas 802–05; Fed. R. Evid. 803(6); 29 C.F.R. pts. 1602, 1607).
Chapter Seventeen
Procurement and Vendor Attestations as Institutional Truth Claims
Procurement is one of the clearest places where institutions speak through documents rather than through persons, because the Government’s authority to obligate public funds, exclude vendors, and impose contract duties is mediated by solicitation language, representations and certifications, evaluation records, and post award administration artifacts that become the durable substrate of justification. In that setting, the core problem introduced by generative drafting is not simply that proposals become longer, but that the marginal cost of producing fluent compliance narratives collapses while the marginal cost of verifying whether those narratives are tethered to real procedures and evidence remains high, which creates a predictable governance outcome: the system drifts toward attestation theater, where vendors can satisfy documentary expectations with text that is expensive to contest and difficult to audit, and where responsibility is diffused across templates, tools, and review chains.
Federal procurement already treats vendor statements as legally consequential. Standard acquisition practice relies on consolidated representations and certifications, often completed through the System for Award Management pathway and incorporated into solicitations through provisions such as FAR 52.212 3. (48 C.F.R. § 52.212 3). In parallel, specialized representations function as bright line truth claims, such as the representation regarding covered telecommunications equipment or services in FAR 52.204 26. (48 C.F.R. § 52.204 26). Operational clauses then convert those representations into ongoing constraints and reporting duties, such as the prohibition regime in FAR 52.204 25. (48 C.F.R. § 52.204 25). Even baseline cybersecurity posture is expressed as a documentary duty through clauses like FAR 52.204 21, which requires contractors to apply enumerated safeguarding requirements to covered contractor information systems. (48 C.F.R. § 52.204 21). The structural consequence is that procurement posture becomes an utterance layer: the institution treats vendor documents as the medium through which eligibility, compliance, and risk are asserted and relied upon.
The baseline workflow and where contestability costs concentrate
A baseline procurement workflow produces truth claims in repeating patterns. The Government issues a solicitation with required clauses and evaluation factors, vendors submit proposals that include technical narratives, compliance matrices, and pricing, and vendors complete representations and certifications, sometimes annually, sometimes per offer, often through consolidated mechanisms like FAR 52.212 3. (48 C.F.R. § 52.212 3). Evaluation teams then read narratives against requirements and create an evaluation record that must later defend the award decision under internal review, protest risk, and audit scrutiny, while post award administration relies on contractor reporting and disclosure obligations, including in regimes like FAR 52.204 25 where discovery and reporting of covered telecommunications equipment or services is an explicit duty. (48 C.F.R. § 52.204 25).
Contestability costs concentrate at the interface between asserted compliance and verifiable evidence. The Government often cannot, at evaluation time, fully verify whether the vendor’s representations are grounded in operational reality, because verification is expensive, time bound, and sometimes security sensitive. Vendors, for their part, often cannot feasibly disclose detailed security or supply chain information in a public or broadly distributed procurement channel without increasing risk. The baseline therefore becomes a document exchange where the formal burden is to assert, certify, and narrate, and the practical burden of verification is deferred, diffused, or partially abandoned, except where targeted checks or later incidents force scrutiny.
How generative drafting changes the failure modes
Generative drafting intensifies three failure modes that already exist in procurement.
The first is boilerplate amplification that masquerades as diligence. Because fluent text is cheap, proposals can include extensive compliance narratives that appear responsive while providing few stable anchors to evidence. Evaluation teams then face a contestability inversion: they must either accept the narrative as a reasonable proxy for capacity, or they must incur high time and expertise costs to test claims that were cheap to produce. The system predictably selects acceptance, especially under throughput pressure, which moves procurement toward a regime where “the proposal said it” becomes the operative evidentiary standard.
The second is reason laundering through compliance matrices and templated certifications. A compliance matrix can become a laundering device when it maps requirements to vendor statements without mapping those statements to auditable artifacts, because the matrix creates a documentary appearance of completeness while dissolving responsibility for whether the mapped claim is true. This becomes more acute when generative tools are used to fill matrices and narrative sections, because the link between the claim and a responsible officer’s examined judgment becomes thinner, even as the institution’s reliance on the claim remains real.
The third is the conversion of false or weakly grounded attestations into liability events. Federal law already treats false claims and materially false statements as consequential, including through the False Claims Act, which imposes civil liability for knowingly presenting false or fraudulent claims for payment or knowingly making or using false records or statements material to such claims. (31 U.S.C. § 3729(a)). Separately, federal criminal law prohibits materially false statements or the use of false writings or documents in matters within the jurisdiction of the United States, capturing a wide range of procurement related submissions when materiality and knowledge elements are met. (18 U.S.C. § 1001(a)). Generative drafting increases the probability that an organization will submit statements that are rhetorically coherent but operationally unexamined, which can elevate inadvertent compliance posture drift into legal exposure, and it also increases the probability that Government reliance will be placed on text that no one can later defend as the product of an accountable procedure.
Redesign: evidence packets and epistemic warranties as a procurement utterance commons
The procurement case study is where evidence packets and epistemic warranties become the doctrinal and operational center of gravity, because procurement is the institutional domain where formal representations already exist, where reliance is explicit, and where consequences attach to both falsehood and noncompliance. The redesign therefore treats vendor attestations as institutional truth claims that must be procedure bound artifacts rather than fluent assertions.
In the redesigned workflow, every material representation, whether it is a consolidated certification under FAR 52.212 3 or a specific representation like FAR 52.204 26, is accompanied by a minimal chain of custody for reasons that binds the claim to accountable roles, evidence pointers, and versioned constraints that define what “compliance” means in that context. (48 C.F.R. §§ 52.212 3, 52.204 26). The evidence pointers do not require full disclosure of sensitive operational details. They require stable references to auditable artifacts such as internal policies, third party audit reports, supply chain bills of material at an appropriate abstraction level, configuration baselines, or contractual flow down documents, with integrity anchoring so the evidence cannot be silently swapped after submission.
This design uses procurement’s existing clause architecture as the natural attachment point. Consider cybersecurity. FAR 52.204 21 already specifies basic safeguarding requirements for covered contractor information systems. (48 C.F.R. § 52.204 21). Under the redesign, a vendor’s statement that it complies is not presented as a narrative paragraph, but as a contestable claim set that includes evidence pointers to the vendor’s controls implementation artifacts and to the responsible officer’s attestation that the claim was reviewed under a defined internal procedure. Consider supply chain prohibitions. FAR 52.204 25 and the associated representation regime create obligations and reporting duties around covered telecommunications equipment or services. (48 C.F.R. §§ 52.204 25, 52.204 26). Under the redesign, the vendor’s representation is accompanied by a minimal evidence packet that indicates the procedure used to assess supply chain coverage and the evidence pointers supporting that assessment, while using selective disclosure so sensitive supplier identities or system architectures are not broadly exposed.
The epistemic warranty is the contractual settlement that makes this structure enforceable rather than aspirational. The warranty is not a promise that nothing will ever go wrong. It is a promise that specified classes of representations were generated by specified decision procedures with specified evidence packets, and that remedies trigger when procedure, provenance, or evidentiary linkage fails. The conceptual analogy is express warranty doctrine in commercial law, where affirmations of fact or promises that become part of the basis of the bargain create express warranties that goods conform to the affirmation or promise. (U.C.C. § 2 313(a)). The point of invoking express warranty is not to import state sales law into federal procurement, but to make a structural claim: when procurement relies on documentary affirmations to allocate risk, the legitimacy of the exchange depends on whether those affirmations are tethered to accountable procedure and evidence, and the only durable way to achieve that tether is to convert “we certify” into “we warrant, with defined evidence and defined remedies.”
Evaluation using the contestability cost index
Under baseline procurement, the Government’s contestability costs are highest where reliance is greatest: cybersecurity posture, supply chain restrictions, subcontractor flow downs, and operational capacity claims that cannot be efficiently validated at evaluation time. Time cost rises because evaluators must read large volumes of narrative without stable evidence pointers. Expertise cost rises because testing a claim often requires specialized security, engineering, or supply chain knowledge not uniformly present in acquisition teams. Access cost rises because evidence is either unavailable or too sensitive to share broadly, which means reviewers cannot see what would actually allow verification. Evidentiary cost rises because when verification is deferred, it tends to occur only after an incident or dispute, at which point reconstructing what was true at the time of offer becomes difficult.
Under the redesigned workflow, time cost decreases because claims are submitted as bounded propositions with evidence pointers rather than as diffuse narratives, so reviewers can target scrutiny to the highest stakes claims rather than reading for rhetorical completeness. Expertise cost decreases insofar as the evidence packet makes it clear what artifacts exist and how they map to the claim, allowing specialized review to be scoped rather than open ended. Access cost decreases because selective disclosure is designed into the packet, making it possible to provide verification relevant materials without broad exposure. Evidentiary cost decreases because the chain of custody for reasons is created at submission time, so later audits and disputes do not require reconstructing procedure ex post, which is precisely the condition that enables reason laundering in the first place.
The index also measures the vendor side. Under baseline practice, vendors incur repeated narrative production costs that do not necessarily improve true compliance posture. Under the redesigned workflow, vendors shift effort from prose generation to evidence hygiene and procedural review, which is a cost, but it is a cost that improves both compliance reality and defensibility, especially when false statement and false claims liability attach to procurement submissions. (31 U.S.C. § 3729(a); 18 U.S.C. § 1001(a)).
Privacy and security constraints and what is intentionally not disclosed
Procurement verification can become its own security vulnerability if it forces vendors to disclose sensitive system architecture, detailed control implementations, or supplier relationships in ways that expand adversary knowledge or enable competitive intelligence extraction. The utterance commons approach therefore treats selective disclosure as a first order requirement rather than an afterthought. The evidence pointer scheme is designed to allow a reviewer to verify that an artifact exists, is stable, and was reviewed under an accountable procedure, without publishing sensitive contents beyond what the stakes require. The system intentionally does not require logging prompts, draft generations, internal deliberative chatter, or detailed telemetry about vendor environments. It stores minimal procedure facts, constraint identifiers, responsible role attestations, and integrity anchored evidence pointers, because those are sufficient to support contestability without turning provenance into surveillance or turning procurement into a forced disclosure pipeline.
Counterarguments and limits
A serious objection is that procurement already struggles with speed and administrative burden, and that requiring evidence packets and epistemic warranties will slow acquisition, disadvantage small businesses, and increase the cost of doing business with the Government. A second objection is that more explicit evidence linkage increases the risk of sensitive disclosure and creates new attack surfaces. A third objection is that the Government may weaponize verification rights, turning the evidence packet into a fishing expedition, thereby chilling participation and increasing market concentration.
The response must concede that any meaningful increase in contestability imposes some front loaded cost, because it replaces narrative substitution with evidence discipline. The design answer is strict minimality and stakes sensitivity: only material representations get full chain of custody treatment, and the evidence packet is bounded by predefined templates and selective disclosure rules rather than open ended discovery. The security objection is addressed by the deliberate refusal to demand raw internal artifacts when a third party attestation or hashed pointer can provide adequate verification for the stakes, and by separating public procurement artifacts from protected verification channels. The weaponization objection is addressed by narrowing audit rights to the minimum necessary to test specific representations and by coupling those rights to measurable contestability objectives, so that verification becomes a procedure bound governance function rather than discretionary leverage.
The unresolved limit is adversarial adaptation. Vendors may learn to produce evidence packet shells that meet formal requirements while remaining substantively thin, and agencies may learn to treat the mere existence of an evidence packet as proof rather than as a contestability instrument. This is why the contestability cost index must remain the evaluation harness: the regime succeeds only if it makes verification and challenge materially cheaper in practice, not if it produces a new genre of procurement paperwork.
Closing: what changes, what remains risky
If the procurement utterance commons is adopted, vendor attestations cease to be primarily rhetorical and become procedure bound truth claims with minimal chains of custody for reasons, where each material representation is linked to accountable roles, stable evidence pointers, and versioned constraints, and where epistemic warranties convert documentary reliance into enforceable allocation rather than moral expectation. The Government’s ability to verify improves without requiring maximal capture, because selective disclosure is treated as part of legitimacy rather than as an inconvenience. What remains risky is the drift toward performative compliance artifacts, the temptation to expand verification into surveillance or competitive extraction, and the persistent asymmetry that fluent text will always be easier to produce than evidence disciplined truth. The success condition is therefore operational: procurement legitimacy improves when the cost of testing and contesting vendor truth claims falls to a level proportional to the stakes, while the verification infrastructure remains privacy constrained and security sane. (48 C.F.R. §§ 52.212 3, 52.204 21, 52.204 25, 52.204 26; 31 U.S.C. § 3729(a); 18 U.S.C. § 1001(a); U.C.C. § 2 313(a)).
Chapter Eighteen
Clinical and Social Service Documentation Under Throughput Pressure
Clinical and social service documentation is a hinge point where care, eligibility, and liability converge into a single institutional utterance layer, because the note is simultaneously a coordination artifact for treatment, a billing and compliance artifact for payment, and a justification artifact for what was done, what was not done, and why. When generative drafting collapses the marginal cost of producing plausible narrative, the risk is not simply stylistic inflation, but a structural decoupling: the record can become rhetorically complete while becoming epistemically thin, which makes contestation by patients, families, and downstream reviewers more expensive at the same time that the record’s allocative consequences grow more durable and more portable across systems.
The legitimacy stakes are not abstract because healthcare records are legally and operationally designed to be accessible, transferable, and relied upon. The HIPAA Privacy Rule gives individuals a right of access to protected health information in a designated record set, subject to defined limits and exceptions. (45 C.F.R. § 164.524(a)). That right has been reinforced through agency guidance that constrains fees and rejects delay practices that convert access into a privilege of time and money. (HHS, “Individuals’ Right under HIPAA to Access their Health Information”). In parallel, modern interoperability law treats the access, exchange, and use of electronic health information as a public policy objective and defines information blocking as a practice likely to interfere with that access, exchange, or use, subject to specified exceptions. (42 U.S.C. § 300jj 52(a); 45 C.F.R. pt. 171). This combination creates a distinctive pressure: the documentary substrate of care is increasingly expected to move, to be shareable, and to be contestable, even as the clinical environment is throughput constrained and increasingly mediated by software.
The baseline workflow and where contestability costs concentrate
In baseline practice, a clinician or caseworker observes and interviews, then produces a note that compresses observation, inference, and judgment into a narrative form optimized for institutional readability and billing defensibility rather than for contestability by the patient. The note is stored in an electronic record system that supports access workflows, audit logs, and interoperability. The note then becomes the canonical account of what happened, even when underlying observation was ambiguous, time compressed, or filtered through multiple staff members. A social service record functions similarly, especially when a benefits determination, placement decision, or risk assessment is recorded as a narrative rather than as a claims map with stable evidence pointers.
Contestability costs concentrate at predictable junctions. First, patients often cannot tell which propositions in the note are directly observed versus inferred, and therefore cannot identify what, precisely, they must challenge to correct the record. Second, access is frequently delayed or shaped by format frictions even when access is legally guaranteed, which converts correction into a high effort act. (45 C.F.R. § 164.524(b); HHS access guidance). Third, sensitive subdomains have distinct confidentiality regimes, most notably substance use disorder treatment records governed by 42 C.F.R. pt. 2, which restricts disclosure absent specific conditions and thereby complicates both sharing and contestation pathways. (42 C.F.R. pt. 2). The baseline reality is that patients, advocates, and even clinicians themselves are often forced to contest a narrative artifact rather than a set of stable claims tethered to evidence, and that contest requires time, domain expertise, and access that are not evenly distributed.
How generative drafting changes the failure modes
Generative drafting intensifies three failure modes that matter because the clinical note is treated as both a care artifact and an evidentiary artifact.
The first is synthetic coherence that substitutes for grounded observation. A model can produce fluent summaries that appear clinically plausible while inadvertently adding details, smoothing uncertainty, or amplifying a clinician’s initial framing, which is a direct form of reason laundering: the note becomes rhetorically adequate in a way that is difficult to challenge because the patient must disprove a coherent story rather than correct discrete observations. The harm is not limited to immediate care. Once stored, the record can travel across systems and inform future clinicians’ priors, which means that a small narrative inflation can become a durable distortion.
The second is responsibility diffusion across toolchains. Under throughput pressure, a clinician may treat the model output as a drafting accelerator and then “sign” the final note as if authorship and judgment are intact, while reviewers treat signature as a warranty of accuracy. Yet if the institution cannot later explain how the note was produced, what constraints governed drafting assistance, and which observations were actually decisive, then the patient’s right to contest is hollow because there is no accountable speaker who can be examined about why the institution said what it said.
The third is disclosure and interoperability tension. The legal environment increasingly pushes records toward availability and exchange, while privacy law pushes toward bounded disclosure. HIPAA’s minimum necessary requirement generally requires reasonable efforts to limit protected health information to the minimum necessary for the intended purpose, subject to defined exceptions, which means that provenance and verification design cannot treat maximal capture as the default. (45 C.F.R. § 164.502(b); 45 C.F.R. § 164.514(d)). At the same time, information blocking law targets unreasonable interference with access, exchange, or use of electronic health information, and sets out exceptions that create a structured path for limiting disclosure without converting limitation into obstruction. (42 U.S.C. § 300jj 52; 45 C.F.R. pt. 171). A generative documentation regime that responds to this tension by overlogging prompts, drafts, or sensitive context will drift toward surveillance infrastructure; a regime that responds by producing fluent notes without evidence linkage will drift toward record saturation and contestability collapse.
Redesign: documentation as contestable utterance without surveillance creep
The redesign treats clinical and social service documentation as an institutional utterance that must remain care usable while becoming contestable at reasonable cost, which requires three structural changes.
First, the note must separate observation, inference, and judgment as explicit layers, not as rhetorical style. Observation is what was seen, measured, or reported, with timestamps and sources where appropriate. Inference is what the clinician concludes from observation, marked as inference rather than as fact. Judgment is the action chosen and the rationale, tied to policy or clinical guideline where relevant. This separation does not require longer notes. It requires structurally different notes, because contestation is only feasible when a patient can identify which proposition is in dispute.
Second, the note must carry a minimal chain of custody for reasons that is compatible with clinical workflows. That chain includes an accountable signer, the procedure version under which drafting assistance was used, and stable evidence pointers to the underlying sources that matter for the specific claim set, such as lab results, imaging, structured vitals, patient reported outcomes, or caseworker observations. The evidence pointers are not an invitation to log everything. They are a map from claim to the smallest set of supporting artifacts that makes challenge possible. The chain must also be compatible with security requirements for electronic protected health information, including audit controls that record and examine activity in information systems that contain or use electronic protected health information. (45 C.F.R. § 164.312(b)). The conceptual move is to treat auditability as procedure evidence, not as interior capture.
Third, the system must issue a patient contestability packet at the time of encounter completion or at least at the time the note becomes operationally relied upon, aligned with legal access rights. The packet is not the entire internal deliberation. It is the claims map, the evidence pointers, and the explanation of how to request correction, together with the disclosure logic that explains what is available under right of access and what is excluded, such as psychotherapy notes, which are explicitly carved out from the access right. (45 C.F.R. § 164.524(a)(1)(i)). The point of acknowledging psychotherapy notes is not to restrict patient rights beyond law, but to avoid designing a contestability regime that inadvertently compels disclosure of material that law treats differently, and to respect the distinct evidentiary sensitivities recognized in doctrine such as the psychotherapist patient privilege. (Jaffee 8–18).
Where substance use disorder records are involved, the redesign must incorporate Part 2 constraints explicitly, because contestability and portability cannot be achieved by flattening confidentiality regimes. The system therefore tags Part 2 protected segments and routes disclosures through Part 2 compliant pathways, preserving the patient’s ability to access and contest while preventing unauthorized downstream disclosure. (42 C.F.R. pt. 2; HHS Part 2 fact sheet).
Evaluation using the contestability cost index
Under baseline documentation, the patient’s time cost is driven by the work of interpretation. Patients must decode clinical shorthand, infer what is asserted as fact versus opinion, and locate the operative propositions that influenced treatment, eligibility, or referral. Under the redesigned note, time cost falls because claims are explicit, layered, and linked to the underlying sources that matter, which converts contest from narrative disagreement into discrete proposition testing.
Under baseline documentation, expertise cost is high because contestation often requires clinical literacy, legal literacy, and procedural knowledge of records correction pathways. Under the redesigned workflow, expertise cost falls because the patient contestability packet identifies the decisive claims and the correction route, and because the chain of custody makes it possible to ask an accountable clinician to explain why a judgment was made without requiring the patient to reverse engineer the procedure.
Under baseline documentation, access cost is often the binding constraint. Even where right of access exists, delay, format limitations, and fee practices can create practical barriers. (45 C.F.R. § 164.524; HHS access guidance). Under the redesigned workflow, access cost falls when the packet is delivered in a usable electronic form by default, consistent with access rights and interoperability policy aims, while still using Part 171 exception logic to avoid unreasonable interference and Part 164 minimum necessary logic to avoid overdisclosure. (45 C.F.R. pt. 171; 45 C.F.R. § 164.502(b)).
Under baseline documentation, evidentiary cost rises because disputes become disputes about the record itself, and because clinical notes are frequently treated as business records with presumptive reliability unless circumstances of preparation indicate lack of trustworthiness. (Fed. R. Evid. 803(6)). Under the redesigned workflow, evidentiary cost falls because the chain of custody for reasons and evidence pointers make trustworthiness contestable without requiring broad discovery, and because the record becomes less dependent on rhetorically complete narrative as a substitute for evidence.
Privacy constraints and what is intentionally not logged
A legitimate documentation commons in healthcare must refuse the premise that better verification requires deeper capture of interior life. The system therefore does not log raw prompts, intermediate drafts, free form clinician reflections, or broad ambient data streams as default proof, because those are precisely the materials most likely to expand inference scope beyond what care requires and beyond what privacy law intends. Instead, the system logs bounded procedure events, constraint identifiers, role attestations, and integrity anchored evidence pointers, and it relies on audit controls and access governance to make those logs usable for accountability while remaining security sane. (45 C.F.R. § 164.312(b); 45 C.F.R. § 164.514(d)). The minimum necessary principle operates here as a design constraint, not as an after the fact compliance justification. (45 C.F.R. § 164.502(b)).
The interoperability pressure created by information blocking enforcement risk must be met with exception governed disclosure rather than maximal disclosure. Part 171 exists precisely to structure when a practice that interferes with access, exchange, or use will not be treated as information blocking because it falls within an exception. (45 C.F.R. pt. 171). A system that makes every provenance artifact universally available will not only be clinically disruptive, it will be privacy destructive, especially for domains governed by Part 2 and for therapeutic contexts recognized as privilege sensitive. (42 C.F.R. pt. 2; Jaffee 8–18).
Counterarguments and limits
A serious objection is that clinicians already experience documentation burden as a primary driver of burnout, and that any added structure will further reduce time available for care. A second objection is that separating observation, inference, and judgment creates legal exposure by making inferential steps explicit, which plaintiffs could weaponize. A third objection is that stronger patient contestability will increase dispute volume and degrade trust, especially in high acuity settings where immediate action is required.
The response begins by conceding that a badly designed utterance commons will fail because it will add fields and friction without reducing downstream contestability costs. The design answer is that structure must replace narrative length rather than augment it, and that the system must generate the contestability packet and evidence pointers as a byproduct of documentation, not as an additional task. The exposure objection misunderstands what liability already tracks: when the record is treated as a business record, reliability and trustworthiness are already in play, and hiding inferential steps does not eliminate dispute, it simply shifts dispute into more expensive forms. (Fed. R. Evid. 803(6)). The trust objection is addressed by procedural realism: the aim is not to invite endless contestation, but to make correction feasible when stakes are high, while leaving low stakes narrative details outside the governance regime. In addition, the right of access and the policy direction of interoperability already push toward patient visibility, and the institution’s choice is not whether patients will see records, but whether what they see will be contestable at reasonable cost. (45 C.F.R. § 164.524; 42 U.S.C. § 300jj 52; 45 C.F.R. pt. 171).
The remaining limit is that clinical truth is often probabilistic and time bound, and not every dispute can be resolved through documentation alone. A contestable utterance commons does not eliminate the need for human repair. It ensures that when the institution speaks through documents, it speaks in a way that can be examined without requiring patients to fund the cost of reconstruction through their own suffering.
Closing: what changes, what remains risky
If this redesign is adopted, clinical and social service documentation becomes a verifiable, care compatible, privacy constrained utterance layer in which the note is no longer primarily a liability shield or a billing narrative, but a contestable artifact with a minimal chain of custody for reasons. Patients gain a practical ability to identify what is being claimed, what evidence supports it, and how to seek correction or explanation without incurring prohibitive time and expertise costs, consistent with right of access and interoperability norms. (45 C.F.R. § 164.524; 42 U.S.C. § 300jj 52; 45 C.F.R. pt. 171). What remains risky is the institutional temptation to respond to uncertainty with expanded capture, and the parallel temptation to respond to compliance pressure with synthetic narrative that appears complete while remaining ungrounded. The success condition is therefore measurable: contestability costs for patients and advocates fall in time, expertise, access, and evidentiary labor, while logging remains bounded by minimum necessary principles and confidentiality regimes, especially Part 2, so that authenticity infrastructure does not become surveillance infrastructure. (45 C.F.R. §§ 164.502(b), 164.514(d), 164.312(b); 42 C.F.R. pt. 2).
Chapter Nineteen
The Utterance Commons as Public Infrastructure
Institutional speech is a public infrastructure problem because contestability is nonrival in its benefits and easily underprovided by private incentives, meaning that when one person can challenge an institutional utterance at reasonable cost, the resulting discipline of attributable procedure and evidentiary linkage benefits everyone who depends on that institution’s record, including people who never bring a claim, never file a grievance, and never appear in court. Under conditions of generative drafting, the asymmetry that structures the entire book becomes acute at the level of the polity: language becomes cheap enough to be produced at industrial scale, while contestability remains expensive enough that institutions can, without necessarily intending to deceive, offload the costs of verification, interpretation, and reconstruction onto those least able to bear them. The commons settlement proposed here is therefore not a moral appeal for better writing, but an infrastructure design: build a minimal, testable layer for verifiable institutional utterances that can be adopted across sectors, audited without surveillance creep, and enforced without demanding that every domain reinvent its own provenance regime.
The reason to frame this as infrastructure rather than as internal policy is that the authoritative record is rarely confined to one organization. Administrative agencies exchange records with vendors, states exchange records with federal programs, hospitals exchange records with payers and other providers, and employers exchange records implicitly through reference channels and explicitly through litigation and compliance processes. Once records move, legitimacy cannot depend on local narrative norms; it must depend on portable assurances that an utterance was produced by an attributable procedure, within versioned constraints, with evidence pointers adequate to the stakes, and with contestability guarantees that do not require maximal capture of persons. That portability is the core promise of an utterance commons.
Why standards must carry more weight than executive fashion
One of the defining constraints on any public infrastructure settlement is that policy regimes shift faster than institutional dependence on records. The federal government’s posture toward AI governance, for example, has been driven by a mix of executive directives, agency guidance, and voluntary standards, and the instability of purely political instruments is not a speculative concern. Executive Order 14110 was issued on October 30, 2023 and then later revoked in January 2025, illustrating how quickly a high level policy frame can be changed even when agencies and vendors are still building to its expectations (Executive Order 14110; Reuters). This volatility is precisely why a durable utterance commons must anchor itself in implementable standards and procurement levers that can persist across administrations and jurisdictions, rather than depending on a single executive instrument for legitimacy.
A workable settlement begins with the existing pattern in U.S. governance, where voluntary technical frameworks supply shared vocabulary and methods that can then be incorporated into acquisition, audit, and sector regulation. The NIST AI Risk Management Framework is an explicit example of this style of governance, offering a structured approach to mapping, measuring, managing, and governing AI risks that organizations can operationalize and regulators can reference without writing a full technical specification into law (NIST AI RMF 1.0). The same pattern exists in secure software practice, where NIST’s Secure Software Development Framework establishes a baseline of practices that procurement and assurance regimes can then incorporate as requirements or evaluation criteria (NIST SP 800 218). For institutional utterances, the analog is a minimal chain of custody for reasons specification and a contestability evaluation method that can be adopted in the same way: common enough to be portable, minimal enough to avoid surveillance, strict enough to be audit meaningful.
Convergence mechanisms for a commons settlement
The utterance commons cannot be willed into existence by a single actor because its value is relational: it arises when multiple institutions accept the same minimal verification primitives and treat their outputs as contestable artifacts rather than as self authenticating narratives. Convergence therefore has to occur through three channels that already shape documentary authority at scale: standards bodies, procurement ecosystems, and adjudicatory institutions.
Standards bodies provide the shared grammar. The relevant lesson is that transparency and verification systems succeed when they establish a minimal, widely usable set of primitives that do not require trust in each participant’s internal narrative about what it did. Certificate Transparency is the canonical case in the web security domain: it describes a protocol for publicly logging certificates so that anyone can audit issuance activity and detect suspect certificates, shifting trust from private assertions to verifiable publication and auditability (RFC 6962). The utterance commons does not replicate the full public logging model, because institutional utterances often contain sensitive content, but it does adopt the same structural idea: publish, or selectively disclose, verifiable commitments about procedure and evidence pointers, so that trust is grounded in auditable structure rather than rhetorical confidence.
A second standards lineage supplies the selective disclosure and portability logic necessary to avoid surveillance: the W3C Verifiable Credentials Data Model defines a framework for verifiable claims, issuers, and verification processes, explicitly emphasizing that verifiers validate claims before relying on them and that validation approaches vary by context (W3C VC Data Model v2.0). The relevance here is not that every utterance chain becomes a credential, but that the commons requires a widely understood pattern for how a party can present a verifiable attestation about procedure without exposing underlying sensitive data by default. A privacy constrained utterance commons is, at base, a selective disclosure regime for reasons.
Procurement ecosystems provide the enforcement vector that is both noncriminal and nonutopian. When an institution makes procurement a condition of market participation, it can demand evidence packets, attestations, and warranties that reshape vendor incentives without waiting for courts to develop new doctrine. The public sector already uses procurement this way in other domains, and OMB memoranda have explicitly directed agencies toward governance and transparency mechanisms around AI use, including inventories and risk management expectations that impose documentary discipline (OMB M 24 10). The general point is that procurement can set the minimum viable requirements for chain of custody for reasons in high stakes domains, and can do so in a way that is measurable through audit rather than enforced through subjective claims of responsibility.
Adjudicatory institutions provide the backstop because documentary disputes inevitably become disputes about reliability and trustworthiness. Courts have long used procedural and circumstantial signals to assess the reliability of records, and any commons settlement that ignores litigation reality will either be performative or will be defeated by adversarial testing. The commons therefore must be designed so that, when contested, an institution can show attributable procedure, constraint versioning, and evidence pointer integrity without requiring a court to infer trustworthiness from fluent prose.
The contestability cost index as the anti theater mechanism
The most predictable failure of standards driven governance is that it produces checklists that are easy to satisfy and hard to trust. The utterance commons avoids this failure by refusing to treat compliance artifacts as success metrics, and instead treating contestability cost reduction as the measure of legitimacy improvement. That is the role of the contestability cost index: it forces every institution and every regulator to answer the same question in operational terms, namely whether an affected party can challenge an utterance at reasonable cost in time, expertise, access, and evidentiary work, given the stakes.
This index matters for another reason that standards efforts often evade. A provenance regime can easily become a narrative of assurance about itself. Organizations can produce attestations about their attestations, and auditors can certify the existence of certification processes, and the entire system can become a bureaucratic generator of words. A contestability cost index collapses this recursion by imposing an empirical question that can be tested with red team methods and sampling: can an affected party, or a designated advocate, reconstruct the decisive claim set and the supporting evidence pointers without heroic effort, and can they identify the accountable decision procedure without being forced to obtain internal deliberations or personal prompt histories.
The index therefore becomes the commons’ enforcement language. Standards bodies can publish technical schemas, regulators can reference them, procurement can require them, and auditors can certify them, but the index determines whether any of those moves actually reduces the asymmetric burden that generative drafting introduces.
Privacy constrained verification as a constitutional constraint
A commons settlement must state, and then enforce, what it will not do. If the utterance commons becomes a mandate to log prompts, preserve drafts, and capture deliberative interiors as proof of sincerity, it will collapse into surveillance infrastructure and will be rejected on both ethical and practical grounds. Public infrastructure is legitimate only when it constrains power, including the power to collect. The commons therefore adopts two structural refusals.
First, it refuses maximal capture as a default. Verification is satisfied by proof of attributable procedure and evidence linkage, not by capture of private interior life. Second, it refuses public logging of sensitive content while still permitting audit. This is why the commons borrows from selective disclosure patterns rather than directly copying public transparency logs. The system discloses what is needed to make challenge feasible and to prevent silent substitution of reasons, while keeping sensitive data within bounded channels and only escalating disclosure when stakes, law, and adjudicatory need justify it.
This privacy constraint is not a soft preference. It is a legitimacy requirement, because a regime that makes contestability possible only by expanding institutional surveillance will redistribute the costs of legitimacy onto those who are already subject to institutional observation, which would be a structural inversion of the book’s normative target.
Counterarguments and limits
A serious objection is that building a shared infrastructure for institutional utterances will impose uniformity on domains that require contextual judgment, and will therefore either become too vague to matter or too rigid to fit. A second objection is that any standards regime will be captured by incumbents, who will write requirements that small organizations cannot meet, thereby consolidating market power under the banner of trust. A third objection is that contestability metrics will incentivize institutions to optimize for the appearance of contestability rather than for substantive fairness, producing a new kind of theater with quantitative varnish.
These objections must be conceded in part because they are structurally predictable. The response begins with a design principle: the commons specifies minimal primitives, not full domain logic, and it treats those primitives as a substrate on which domain specific requirements can be layered. That is why the analogs are NIST style frameworks and narrow technical protocols rather than comprehensive regulatory codes (NIST AI RMF 1.0; NIST SP 800 218). The capture risk is addressed by insisting that procurement and regulator adoption be staged and proportional, and by defining conformance pathways that allow smaller entities to meet requirements through narrowly scoped evidence packets, third party attestations, or shared services without surrendering autonomy. The metric gaming risk is addressed by pairing the contestability cost index with adversarial testing, including red team methods that simulate challenges in real conditions, and by treating contestability as a property that must hold under stress, not as a property that can be asserted in calm administrative settings.
The remaining limit is political. A commons settlement necessarily operates across public and private actors, and its legitimacy depends on ongoing buy in. That is why the settlement cannot be framed as ideological enforcement or as moral purification. It must be framed as documentary due process in the narrow sense developed throughout the book: institutions that speak through documents must be contestable at reasonable cost, or they will lose governability and will externalize conflict into courts, media, and social fracture.
Closing: what changes, what remains risky
If the utterance commons is treated as public infrastructure, institutional speech becomes more like a verifiable public utility and less like a rhetorical performance, because every high stakes utterance must carry a minimal, auditable chain of custody for reasons that can be selectively disclosed and adversarially tested. Standards bodies provide the shared primitives, procurement provides enforceable incentives, regulators provide targeted mandates where stakes justify them, and courts provide the reality check that prevents narrative substitutes from becoming default truth. The contestability cost index prevents the settlement from degenerating into compliance theater by making the system answerable to a measurable question: did the cost of challenge fall without increasing surveillance. What remains risky is the gravitational pull of bureaucracy toward more documents rather than more evidence, the temptation to treat transparency as maximal disclosure rather than bounded verification, and the persistent political volatility that makes any single policy instrument an unreliable foundation. The infrastructure answer is therefore explicit: build the commons on minimal, portable verification primitives and test it by whether it makes contestability materially cheaper while keeping provenance bounded, because legitimacy after fluent text will be decided not by how well institutions can speak, but by whether those who are governed can answer back. (RFC 6962; W3C VC Data Model v2.0; NIST AI RMF 1.0; OMB M 24 10; NIST SP 800 218).
Conclusion
Legitimacy After Fluent Text
If institutional authority is exercised through documents, then due process is not an abstraction appended to power, but the operational condition under which power becomes examinable, revisable, and therefore governable; the documentary record is the medium through which reasons travel, liability attaches, and affected people can either contest an action or be forced to absorb it as fate. The core asymmetry that has structured this manuscript is now settled enough to state without ornament: generative drafting collapses the marginal cost of producing reasons, while the cost of contesting those reasons remains tied to human time, expertise, access, and evidentiary work, and this gap predictably produces reason laundering, responsibility diffusion, and record saturation even in organizations whose members are acting in good faith under throughput and risk pressure. The institutional problem, therefore, is not that texts might be inaccurate, though they might be; it is that fluent text can function as a substitute for attributable procedure, and the substitute is hard to detect precisely because it reads like competence.
The book’s proposal has been a reconstruction rather than a prohibition. Administrative law has long insisted that authority must be defended by the reasons the agency actually gave, rather than by an advocate’s later invention, which is the basic logic of Chenery in its most durable form (SEC v. Chenery Corp.). It has also insisted that reasons must be connected to rational consideration rather than to unexplained swings or post hoc convenience, which is the living core of reasoned decisionmaking in State Farm’s arbitrary and capricious review (Motor Vehicle Mfrs. Assn. v. State Farm). And due process doctrine has framed procedure as a calibrated technology for reducing error under constraints, rather than as a liturgical performance, which is Mathews’ explicit balancing among private interest, governmental burden, and risk of erroneous deprivation (Mathews v. Eldridge). The argument of this book has been that machine mediated drafting changes the risk profile of institutional speech in a way that those doctrines already anticipate: when reasons can be produced in abundance and authorship can be diffused across tools, the ordinary inferential links by which a court or an affected party attributes a reason to a decision procedure become unstable, and this instability shows up as contestability failure.
For that reason, the settlement proposed here treats an institutional utterance as a procedure bound artifact. Authenticity is not treated as a metaphysical aura of human authorship; it is treated as attributable procedure under constraint, paired with evidence pointers adequate to the stakes, and disclosed in a way that makes challenge feasible without requiring maximal capture of persons. This is why the book has insisted on a chain of custody for reasons, because the institution’s duty is not to disclose its entire interior deliberation, but to disclose the minimal map that permits meaningful contestation at reasonable cost.
The final move, which matters because it marks the point where proposals either become real or become theater, is to insist that the utterance commons must be evaluated as infrastructure. Infrastructure governance succeeds when trust is moved from rhetoric to verifiable structure, and when verification is designed so that it can be performed by adversaries rather than only by insiders. In secure communications, Certificate Transparency offers an instructive example of the genre: it builds auditability through append only logs and verifiable proofs, so that reliance is conditioned on the ability to verify rather than on the ability to believe (RFC 6962). In identity and credential exchange, the Verifiable Credentials data model similarly insists on a three party ecosystem in which a verifier checks claims before relying on them, and it is precisely that insistence on verifiability, rather than narrative assurance, that an utterance commons must borrow while keeping content disclosure bounded (Verifiable Credentials Data Model v2.0). In public sector governance, the pattern is increasingly explicit: risk management and governance requirements are being codified through centralized guidance, as in OMB Memorandum M 24 10, while technical frameworks such as the NIST AI Risk Management Framework offer a shared method spine that organizations can operationalize without reducing governance to slogans (OMB Memorandum M 24 10; NIST AI RMF 1.0). The infrastructure claim of this book is that institutional speech now requires an equivalent minimal verification layer, because the record itself has become a contested terrain of power.
That minimal layer is not a demand for omniscience. It is a demand for contestability at reasonable cost, measured rather than asserted. The contestability cost index is the anti theater mechanism because it forces institutions to demonstrate that their utterances can be challenged without heroic effort, and it forces auditors and regulators to test whether contestation is feasible in practice rather than merely promised in policy. This is also where the privacy constraint becomes constitutional rather than rhetorical. If the verification layer expands inference scope by default, it will become surveillance infrastructure, and the legitimacy bargain collapses because it shifts the cost of institutional accountability onto the person whose interior life becomes the evidence. The settlement therefore requires privacy preserving verification, which means that what is recorded is procedure and responsibility at the level necessary for contestation, while personal prompt histories, drafts, and sensitive deliberative interiors are not logged by default and are disclosed only when law, stakes, and adjudicatory need justify escalation.
A realistic adoption agenda follows directly from where documentary authority already concentrates. Start where stakes are high and contestability is already a legal or operational requirement. In benefits and health contexts, access rights and interoperability constraints already reveal that the record is not an internal convenience but a site of rights, and HIPAA’s right of access and the information blocking regime make clear that withholding or obfuscating records can itself become a compliance and legitimacy failure (45 C.F.R. § 164.524; 45 C.F.R. § 171.103; 42 U.S.C. § 300jj 52). In procurement, representations and certifications are already treated as enforceable documentary commitments, which is why the FAR contains specific safeguarding obligations and representation regimes that can be audited and that carry consequences when false or unreliable (48 C.F.R. § 52.204 21; 48 C.F.R. § 52.204 25; 48 C.F.R. § 52.212 3). Where documentary commitments are enforceable, the logic of epistemic warranties becomes natural rather than aspirational, and the False Claims Act illustrates why documentary artifacts that are materially false can trigger severe institutional exposure (31 U.S.C. § 3729). The adoption strategy is therefore to require chain of custody for reasons where the institution is already relying on documents to allocate goods, impose burdens, or obtain payment, and then to measure success as reduced contestability cost without increased surveillance.
What remains risky is not mysterious. Institutions will be tempted to comply by producing more words rather than more evidence, because word production is what generative tools optimize, and bureaucracy is what organizations already know how to do. Regulators will be tempted to mandate disclosure rather than verification, because disclosure is legible to policy makers even when it is not usable to affected parties. Vendors will be tempted to sell provenance as a feature rather than as an enforceable constraint, turning governance into a marketing category. The book’s answer to these predictable risks is disciplined: require minimal, verifiable primitives, test them with adversarial audit routines, bind them to procurement and remedies, and hold the privacy line by designing selective disclosure as the default rather than as the exception. Legitimacy after fluent text will not be secured by asking institutions to speak better. It will be secured by making institutional speech procedurally attributable, evidentially anchored, and contestable at a cost that does not require the governed to become professional litigants in order to be treated as persons.
Appendix A
Glossary of Defined Terms
Institutional utterance. A document, notice, letter, form, record entry, or other communicative artifact that functions as an institutional speech act with allocative consequences, meaning that it is relied upon for enforcement, liability allocation, eligibility determination, contractual reliance, or public justification.
Chain of custody for reasons. A structured linkage among claim, decision procedure, accountable roles, evidence pointers, and versioned constraints that makes an institutional utterance contestable without requiring disclosure of full internal deliberation.
Reason laundering. The production of rhetorically adequate reasons whose provenance is intentionally or structurally diffused across tools, templates, prompts, approvals, and post hoc edits such that no accountable agent can be examined about why the institution said what it said.
Contestability. The practical ability of an affected party to challenge an institutional utterance at reasonable cost, where cost is measured in time, expertise, access, and evidentiary work relative to the stakes.
Contestability cost index. A measurement framework that quantifies the contestability cost of an institutional utterance by scoring time burden, expertise burden, access burden, and evidentiary burden, and by tracking how those burdens change after adoption of verifiable utterance primitives.
Integrity. The property that an utterance artifact has not been altered without detection after its issuance, including protection against silent substitution of content or attachments.
Provenance. The property that an utterance can be associated with the tools, templates, model versions, and policy constraints under which it was generated, at a level sufficient to evaluate reliability without expanding inference scope.
Attribution. The property that an utterance can be tied to accountable institutional roles and to a defined decision procedure, rather than being treated as an orphaned product of a toolchain.
Warranty. A legally enforceable commitment that specified classes of institutional representations were generated through defined procedures with defined evidence packets, and that remedies attach when those commitments fail.
Evidence pointer. A stable reference to an underlying evidentiary artifact, such as a record, dataset, transcript, image, or transaction, that can be retrieved under authorized conditions and that is anchored so its identity can be verified.
Selective disclosure. A disclosure pattern in which an institution can prove defined properties of an utterance and its chain of custody, such as procedure conformance or role attestation, without disclosing unnecessary sensitive content.
Privacy constraint. The nonnegotiable requirement that verification must be achievable without default logging of personal prompt histories, drafts, or sensitive deliberative interiors, and without expanding institutional surveillance beyond what stakes and law require.
Appendix B
Utterance Chain of Custody Specification, Version One
Utterance artifact header. The utterance artifact SHALL include an immutable header containing the following fields, expressed in a machine readable form and bound cryptographically to the utterance content and attachments.
Utterance identifier. A unique identifier for the utterance instance.
Utterance type. A controlled vocabulary value indicating the utterance class, such as benefits determination, disciplinary notice, procurement attestation, clinical note disclosure, or contractual representation.
Issuing institution. A stable identifier for the institution and business unit responsible for issuance.
Decision procedure identifier. A stable identifier referencing the documented decision procedure that authorizes this utterance type, including the applicable policy version.
Decision date and effective date. Timestamps for decision finalization and for operative effect.
Accountable roles. A set of role attestations, each containing role name, role identifier, attestor identity method, and attestation timestamp, where at least one role corresponds to the ultimate accountable decision authority for the utterance.
Constraint bundle reference. A reference to the versioned constraint bundle governing generation, including template version, policy ruleset version, model class, and any restricted drafting modes. The constraint bundle SHALL not require disclosure of prompts by default.
Evidence pointer set. A set of evidence pointers, each containing pointer identifier, pointer type, retrieval authority, content hash or equivalent integrity anchor, and a short evidence description written in plain language.
Disclosure profile. A definition of what is disclosed by default to an affected party, what is available upon request, and what requires escalation, with each tier tied to a legal or policy basis.
Integrity binding. A cryptographic binding that covers the utterance text, attachments, and header fields, enabling detection of alteration.
Procedure event log. The utterance artifact SHALL be supported by a procedure event log that is append only within the institution’s trust boundary and can be selectively disclosed. The log SHALL contain, at minimum, the following event types with timestamps and role attestations.
Initiation event. Creation of a case or matter invoking a decision procedure.
Evidence intake events. Each event records the receipt or creation of an evidentiary artifact and binds it to an evidence pointer.
Drafting modality declaration. A declaration of whether machine mediated drafting assistance was used, expressed as a controlled value, without logging prompt text by default.
Review events. Each substantive review step records reviewer role, scope of review, and outcome, with emphasis on evidence linkage and claim boundaries rather than on prose quality.
Decision event. The event that finalizes the decision, records the accountable decision role, and binds the final claim set and evidence pointer set.
Issuance event. The event that releases the utterance to the affected party or external recipient and binds the integrity signature to the artifact.
Correction and amendment events. Any subsequent corrections must produce a new utterance version linked to the prior version, with a plain language explanation of change scope and effect.
Evidence pointer requirements. Evidence pointers SHALL be stable, auditable, and redaction friendly.
Stability. Pointers must remain valid for a defined retention period appropriate to the domain.
Integrity anchoring. Each pointer must include an integrity anchor, such as a content hash or signed record identifier, sufficient to detect substitution.
Authorization. Each pointer must specify the authority required to retrieve the underlying artifact, including whether the affected party has direct access rights.
Minimality. Pointers must be sufficient for contestability while avoiding unnecessary exposure of sensitive content.
Appendix C
Evidence Packet Templates
Benefits determination evidence packet template. This template applies where an institutional utterance determines eligibility, continuation, reduction, or termination of benefits.
Case identifier.
Decision procedure identifier and version.
Claim set. A plain language list of decisive findings and conclusions, each tagged as observation, inference, or judgment.
Evidence pointer set. For each claim, the pointers that support it, including integrity anchors and retrieval authority.
Rule mapping. The governing rule text or policy section applied, with version identifier.
Opportunity to respond. The mechanism, deadline, and access route for the affected party to present contrary evidence or arguments.
Error correction path. The process for amendment, reconsideration, and appeal.
Disclosure profile. What is disclosed now, what can be requested, and what requires escalation.
Workplace discipline evidence packet template. This template applies to performance and conduct actions with potential employment consequences.
Matter identifier.
Decision procedure identifier and version.
Separation of record layers. Observations, inferences, and judgments are recorded distinctly, with each layer attributed to accountable roles.
Source integrity. For each quoted or summarized source, provide an evidence pointer and integrity anchor.
Comparators and consistency. If policy requires consistency, record the relevant policy standard and the basis for differential treatment.
Employee response channel. How the employee can contest observations, challenge inferences, and submit evidence.
Disclosure profile and privacy constraint. Specify what is intentionally not logged, such as personal prompt histories.
Procurement attestation evidence packet template. This template applies to vendor representations, certifications, and compliance claims that an agency or institution relies upon.
Attestation identifier.
Applicable clause or requirement reference. For federal procurement, include the FAR clause or representation mechanism invoked (48 C.F.R. § 52.204 21; 48 C.F.R. § 52.204 25; 48 C.F.R. § 52.212 3).
Claim set. Identify each material representation.
Reason chain summary. Identify the accountable roles and procedure steps used to validate the claim.
Evidence pointer set. Provide pointers to controls evidence, system inventories, or test results, with integrity anchoring.
Reasonable inquiry statement. Describe the inquiry performed at a procedural level, not as a narrative.
Remedies and audit rights. Identify contractual remedies for provenance failure and a narrowly scoped audit mechanism.
Clinical and social service documentation evidence packet template. This template applies to documentation that can affect care, payment, eligibility, or legal outcomes.
Record identifier.
Clinical observation layer. What was directly observed or reported, with source attribution.
Inference layer. Clinical interpretations, risk assessments, and derived conclusions, with accountable role attribution.
Decision layer. Care plan or service determination statements, linked to policy or clinical guideline references where applicable.
Patient contestability channel. How the patient can request access, corrections, and explanations, aligned to applicable access rights (45 C.F.R. § 164.524).
Selective disclosure and privacy constraint. Specify what is not captured by default and how sensitive content is protected.
Appendix D
Audit Test Suite
Reason laundering red team test. Objective: determine whether the organization can produce rhetorically adequate reasons that cannot be traced to attributable procedure and evidence.
Setup. Select a sample of high stakes utterances across domains and request the chain of custody for reasons, including accountable roles and evidence pointers.
Adversarial move. Attempt to identify whether the utterance can be defended only by narrative explanations rather than by verifiable procedure and stable evidence pointers.
Failure signal. The institution provides polished rationales that differ from the recorded claim set, or it cannot identify who is accountable for decisive inferences.
Pass criteria. The institution produces a minimal reason chain and evidence pointers sufficient for contestation without relying on post hoc narrative invention, consistent with Chenery’s insistence that action stands or falls on invoked grounds (SEC v. Chenery Corp.).
Responsibility diffusion test. Objective: determine whether accountable roles are genuine or ceremonial.
Setup. Select utterances with multiple approvals and request role attestations tied to specific procedure steps.
Adversarial move. Interview, or simulate interview prompts, asking each role to identify what they verified and what evidence supports the decisive claim set.
Failure signal. Roles disclaim responsibility by pointing to tools, templates, or downstream reviewers, and the procedure log does not bind verification duties to accountable roles.
Pass criteria. Each decisive layer has a role that can be examined about what was checked and what evidence supports it.
Record flood test. Objective: measure whether the organization can overwhelm contestation by saturating the record with fluent text.
Setup. Select a case class and attempt to reconstruct the decisive claim set from the record as an external party would.
Adversarial move. Measure time and expertise required to isolate decisive reasons and evidence pointers, then compare to a baseline.
Failure signal. The record contains large volumes of narrative that obscure decisive claims and lacks a stable map from claim to evidence.
Pass criteria. The utterance artifact provides a claim map and evidence pointers that allow reconstruction without heroic effort, and the contestability cost index improves measurably.
Silent substitution test. Objective: detect whether institutions can change reasons or evidence after issuance without detection.
Setup. Obtain issued utterances and later versions from internal systems.
Adversarial move. Attempt to identify whether substantive changes occurred without version linkage, integrity binding, or disclosure.
Failure signal. Content changes without verifiable versioning or without a correction event linked to the earlier issuance.
Pass criteria. Integrity binding and version linkage detect substitution and enable an affected party to see what changed and why.
Privacy creep test. Objective: ensure the provenance layer does not expand surveillance by default.
Setup. Review logs and data retention practices associated with chain of custody generation.
Adversarial move. Attempt to retrieve personal prompts, draft histories, or sensitive deliberative interiors unrelated to the minimal reason chain.
Failure signal. The system captures and retains sensitive interiors as a default condition of verification.
Pass criteria. Verification is satisfied through procedure and role attestations plus evidence pointers, with selective disclosure, consistent with a bounded verification model rather than maximal capture (Verifiable Credentials Data Model v2.0).
Appendix E
Contestability Cost Index Rubric
Definition. The contestability cost index is a composite score intended to measure how costly it is for an affected party to mount a credible challenge to an institutional utterance, holding stakes constant and focusing on the practical burdens that convert formal rights into usable contestation.
Dimensions. The index measures time burden, expertise burden, access burden, and evidentiary burden, each scored on a bounded scale defined by domain baselines and calibrated using representative challenge scenarios.
Measurement method. Select a representative utterance class, define a challenge scenario that reflects realistic stakes, and then measure how long a trained advocate and a typical affected party would take to identify the decisive claim set, retrieve or request supporting evidence, understand applicable rules, and file or present a challenge. The expertise dimension is scored by whether the challenge can be mounted by an ordinary advocate, requires specialized legal or technical expertise, or requires teams and retained experts. The access dimension is scored by whether evidence is directly accessible, accessible only by formal request, or accessible only through litigation or administrative escalation. The evidentiary dimension is scored by whether evidence pointers are stable and integrity anchored, or whether the challenger must reconstruct evidence provenance through inference.
Interpretation. The index is not a moral score. It is an operational measure of whether the institution has reduced the cost of challenge while preserving privacy. It is therefore aligned with the due process logic that procedure is calibrated to reduce erroneous deprivation under constraints (Mathews v. Eldridge).
Example application. In a benefits termination letter, a low index outcome would mean that the claimant can identify the decisive reasons, see the rules applied, and access the evidence pointers to the designated record set quickly, consistent with access rights frameworks, rather than needing to litigate merely to see what the institution relied upon (45 C.F.R. § 164.524).
Appendix F
Model Clauses for Contracts and Procurement
Epistemic warranty clause. The provider warrants that each material representation identified as warranted representation was generated and issued through the provider’s defined decision procedure and constraint bundle, and that the provider maintains a chain of custody for reasons linking each warranted representation to accountable roles and to evidence pointers adequate to the agreed stakes. The provider further warrants that the evidence pointers are integrity anchored and that the provider will preserve their retrievability for the retention period defined in the agreement.
Provenance failure remedy clause. If a warranted representation is materially relied upon and the provider cannot produce the chain of custody for reasons for that representation within a defined response period, or if integrity anchoring reveals silent substitution of decisive reasons or evidence pointers, then the provider shall be deemed in breach, and the customer shall be entitled to defined remedies proportionate to the stakes, including cure obligations, service credits, termination for cause, and if applicable indemnification for third party claims that arise from the provenance failure. Where the agreement involves claims submitted for payment, the parties acknowledge that false records or statements material to claims can trigger statutory exposure, and the clause is intended to allocate responsibility for verification economics rather than to dilute legal duties (31 U.S.C. § 3729).
Narrow audit rights clause. The customer may audit the provider’s conformance to the chain of custody for reasons requirements solely as to the warranted representations and solely through inspection of procedure event logs, role attestations, and evidence pointer integrity anchors, with selective disclosure protections. The audit shall not require disclosure of personal prompts, draft histories, or deliberative interiors unless a higher disclosure tier is triggered by a defined dispute mechanism or legal compulsion. The parties agree that audit scope is constrained to prevent provenance from becoming surveillance.
Procurement representations alignment clause. Where the agreement is a public sector procurement, the provider represents that it will maintain evidence packets sufficient to support applicable representations and safeguarding obligations, and that it will cooperate with reasonable inquiries consistent with the applicable procurement regime (48 C.F.R. § 52.204 21; 48 C.F.R. § 52.204 25; 48 C.F.R. § 52.212 3).
Appendix G
Adoption Playbook
Phase logic. Adoption must proceed as an evidence building program, not as a documentation program, because the failure mode of any governance initiative under generative drafting is that it increases the supply of text without increasing the supply of contestable structure. Begin with one or two high stakes utterance classes where contestability is already demanded, implement the minimal utterance artifact header and procedure event log, and then use the contestability cost index to measure whether challengers can reconstruct decisive reasons and evidence pointers without heroic effort.
Governance roles. Ownership of the utterance layer should be assigned jointly across legal, security, audit, and operational leadership, but decision rights must be explicit so that responsibility does not dissolve into committee. The accountable decision role for each utterance class must be defined, and review rituals must be redesigned so that they generate evidence linkage and claim boundary discipline rather than wordsmithing.
Procurement integration. Require vendors and internal tool builders to support the chain of custody specification as a deliverable, not as a feature, and bind conformance to warranties and remedies. Align internal policy to the same standard so that vendor requirements do not exceed internal discipline.
Audit integration. Replace checklist audits with adversarial tests and sampling, using the audit test suite as a repeatable harness. Treat improvements as real only when the contestability cost index decreases without expansion of surveillance.
Public sector alignment. Where federal agencies are subject to centralized governance expectations for AI, align utterance commons adoption to those governance requirements and risk management methods, using NIST AI RMF and OMB M 24 10 as compatibility anchors while keeping the program focused on documentary due process rather than general AI ethics (NIST AI RMF 1.0; OMB Memorandum M 24 10).
Privacy enforcement. Treat the privacy constraint as a hard requirement with explicit disallowed defaults, including default logging of prompts and drafts. Use selective disclosure as the default verification method and escalate only when necessary and justified, borrowing the verification posture of credential based ecosystems without importing their identity maximalism (Verifiable Credentials Data Model v2.0).
Works Cited
Administrative Conference of the United States. “Administrative Record in Informal Rulemaking.” Recommendation 2013-4, 10 July 2013.
Adams, C., et al. “Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP).” RFC 3161, RFC Editor, Aug. 2001, http://www.rfc-editor.org/rfc/rfc3161.html. https://doi.org/10.17487/RFC3161. Accessed 21 Dec. 2025.
Akerlof, George A. “The Market for ‘Lemons’: Quality Uncertainty and the Market Mechanism.” The Quarterly Journal of Economics, vol. 84, no. 3, 1970, pp. 488–500. https://doi.org/10.2307/1879431.
American Law Institute. Restatement (Second) of Contracts. American Law Institute, 1981. H2O Open Casebooks reproductions: § 159, opencasebook.org/casebooks/11720-bruckner-howard-law-contracts-2024/resources/10.2.3-restatement-second-contracts-159/; § 164, opencasebook.org/casebooks/11720-bruckner-howard-law-contracts-2024/resources/10.2.2-restatement-second-of-contracts-164/; § 208, opencasebook.org/casebooks/11720-bruckner-howard-law-contracts-2024/resources/10.3.1-restatement-second-of-contracts-208/. Accessed 21 Dec. 2025.
AT&T Mobility LLC v. Concepcion. 563 U.S. 333. Supreme Court of the United States. 27 Apr. 2011. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep563/usrep563333/usrep563333.pdf. Accessed 21 Dec. 2025.
Austin, J. L. How to Do Things with Words. Clarendon Press, 1962.
Camp v. Pitts. 411 U.S. 138. Supreme Court of the United States. 2 Apr. 1973. United States Reports.
Carnival Cruise Lines, Inc. v. Shute. 499 U.S. 585. Supreme Court of the United States. 17 Apr. 1991. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep499/usrep499585/usrep499585.pdf. Accessed 21 Dec. 2025.
Carpenter v. United States. 585 U.S. 296. Supreme Court of the United States. 22 June 2018. SupremeCourt.gov, http://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf. Accessed 21 Dec. 2025.
CBS Inc. v. Ziff-Davis Publishing Co. 75 N.Y.2d 496. Court of Appeals of New York. 8 Feb. 1990. Justia Law, law.justia.com/cases/new-york/court-of-appeals/1990/75-n-y-2d-496-0.html. Accessed 21 Dec. 2025.
Citizens to Preserve Overton Park, Inc. v. Volpe. 401 U.S. 402. Supreme Court of the United States. 6 Apr. 1971. United States Reports.
Cleveland Board of Education v. Loudermill. 470 U.S. 532. Supreme Court of the United States. 19 Mar. 1985. United States Reports.
Daubert v. Merrell Dow Pharmaceuticals, Inc. 509 U.S. 579. Supreme Court of the United States. 28 June 1993. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep509/usrep509579/usrep509579.pdf. Accessed 21 Dec. 2025.
Department of Commerce v. New York. 588 U.S. 752. Supreme Court of the United States. 27 June 2019. United States Reports.
Equal Employment Opportunity Commission. Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964. 18 May 2023.
Equal Employment Opportunity Commission. “Summary of Selected Recordkeeping Obligations in 29 C.F.R. Part 1602.”
Equal Employment Opportunity Commission. “What Is the EEOC’s Role in AI?” 29 Apr. 2024.
Federal Acquisition Regulation. 48 C.F.R. § 52.204-21. “Basic Safeguarding of Covered Contractor Information Systems.” Acquisition.gov, http://www.acquisition.gov/far/52.204-21. Accessed 21 Dec. 2025.
Federal Acquisition Regulation. 48 C.F.R. § 52.204-25. “Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.” Acquisition.gov, http://www.acquisition.gov/far/52.204-25. Accessed 21 Dec. 2025.
Federal Acquisition Regulation. 48 C.F.R. § 52.204-26. “Covered Telecommunications Equipment or Services Representation.” Acquisition.gov, http://www.acquisition.gov/far/52.204-26. Accessed 21 Dec. 2025.
Federal Acquisition Regulation. 48 C.F.R. § 52.212-3. “Offeror Representations and Certifications Commercial Products and Commercial Services.” Acquisition.gov, http://www.acquisition.gov/far/52.212-3. Accessed 21 Dec. 2025.
Federal Arbitration Act. 9 U.S.C. § 2. Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/uscode/text/9/2. Accessed 21 Dec. 2025.
Federal Judicial Center. “Amendments to Federal Rules of Practice and Procedure (Evidence 2017): Self-Authenticating Electronic Evidence.” 2017, http://www.fjc.gov/content/325216/amendments-federal-rules-practice-and-procedure-evidence-2017-self-authenticating. Accessed 21 Dec. 2025.
Federal Judicial Center. “Amendments to Federal Rules of Practice and Procedure (Civil Rules 2015): Failure to Preserve Electronically Stored Information.” 2015, http://www.fjc.gov/publications/amendments-federal-rules-practice-and-procedure-civil-rules-2015-failure-preserve. Accessed 21 Dec. 2025.
Federal Records Act. 44 U.S.C. § 3101. Office of the Law Revision Counsel, U.S. House of Representatives, uscode.house.gov/view.xhtml?req=(title:44%20section:3101%20edition:prelim). Accessed 21 Dec. 2025.
Federal Rules of Civil Procedure. Rule 26(b)(1). Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/rules/frcp/rule_26. Accessed 21 Dec. 2025.
Federal Rules of Civil Procedure. Rule 37. “Failure to Make Disclosures or to Cooperate in Discovery; Sanctions.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/rules/frcp/rule_37. Accessed 21 Dec. 2025.
Federal Rules of Evidence. Rules 702, 803, 807, 901, 902. Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/rules/fre. Accessed 21 Dec. 2025.
Federal Power Commission v. Transcontinental Gas Pipe Line Corp. 423 U.S. 326. Supreme Court of the United States. 7 Jan. 1976. United States Reports.
Goldberg v. Kelly. 397 U.S. 254. Supreme Court of the United States. 23 Mar. 1970. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep397/usrep397254/usrep397254.pdf. Accessed 21 Dec. 2025.
Illinois General Assembly. 815 ILCS 333/9. “Attribution and Effect of Electronic Record and Electronic Signature.” Illinois Compiled Statutes, http://www.ilga.gov/documents/legislation/ilcs/documents/081503330K9.htm. Accessed 21 Dec. 2025.
Institute of Internal Auditors. The IIA’s Three Lines Model: An Update of the Three Lines of Defense. The IIA, http://www.theiia.org/ThreeLines. Accessed 21 Dec. 2025.
Internet Engineering Task Force. Laurie, Ben, Adam Langley, and Emilia Kasper. “Certificate Transparency.” RFC 6962, RFC Editor, June 2013, http://www.rfc-editor.org/rfc/rfc6962.html. https://doi.org/10.17487/RFC6962. Accessed 21 Dec. 2025.
Internet Engineering Task Force. Laurie, Ben, et al. “Certificate Transparency Version 2.0.” RFC 9162, RFC Editor, Dec. 2021, http://www.rfc-editor.org/rfc/rfc9162.html. https://doi.org/10.17487/RFC9162. Accessed 21 Dec. 2025.
Internet Engineering Task Force. Jones, Michael B., et al. “JSON Web Signature (JWS).” RFC 7515, RFC Editor, May 2015, http://www.rfc-editor.org/rfc/rfc7515.html. https://doi.org/10.17487/RFC7515. Accessed 21 Dec. 2025.
Internet Engineering Task Force. Rundgren, Anders, et al. “JSON Canonicalization Scheme (JCS).” RFC 8785, RFC Editor, June 2020, http://www.rfc-editor.org/rfc/rfc8785.html. https://doi.org/10.17487/RFC8785. Accessed 21 Dec. 2025.
Internet Engineering Task Force. Schaad, Jim. “CBOR Object Signing and Encryption (COSE): Structures and Process.” RFC 9052, RFC Editor, Aug. 2022, http://www.rfc-editor.org/rfc/rfc9052.html. https://doi.org/10.17487/RFC9052. Accessed 21 Dec. 2025.
Internet Engineering Task Force. Adams, C., et al. “Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP).” RFC 3161, RFC Editor, Aug. 2001, http://www.rfc-editor.org/rfc/rfc3161.html. https://doi.org/10.17487/RFC3161. Accessed 21 Dec. 2025.
Jaffee v. Redmond. 518 U.S. 1. Supreme Court of the United States. 13 June 1996. United States Reports.
Judicial Conference of the United States. Advisory Committee on Evidence Rules Agenda Book. 2 May 2025. United States Courts, http://www.uscourts.gov/sites/default/files/document/2025-05_evidence_rules_committee_agenda_book_final.pdf. Accessed 21 Dec. 2025.
Judicial Conference of the United States. Advisory Committee on Evidence Rules Agenda Book. 5 Nov. 2025. United States Courts, http://www.uscourts.gov/sites/default/files/document/2025-11_evidence_rules_commitee_agenda_book_final.pdf. Accessed 21 Dec. 2025.
Kent, Karen, and Murugiah Souppaya. Guide to Computer Security Log Management. NIST Special Publication 800-92, National Institute of Standards and Technology, Sept. 2006, csrc.nist.gov/pubs/sp/800/92/final. Accessed 21 Dec. 2025.
Kumho Tire Co. v. Carmichael. 526 U.S. 137. Supreme Court of the United States. 23 Mar. 1999. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep526/usrep526137/usrep526137.pdf. Accessed 21 Dec. 2025.
Lipsky, Michael. Street-Level Bureaucracy: Dilemmas of the Individual in Public Services. Russell Sage Foundation, 1980.
March, James G., and Herbert A. Simon. Organizations. Wiley, 1958.
McDonnell Douglas Corp. v. Green. 411 U.S. 792. Supreme Court of the United States. 14 May 1973. United States Reports.
Merton, Robert K. “Bureaucratic Structure and Personality.” Social Forces, vol. 18, no. 4, 1940, pp. 560–68.
MITRE. “MITRE ATT&CK.” MITRE, attack.mitre.org/. Accessed 21 Dec. 2025.
Moynihan, Donald, Pamela Herd, and Hope Harvey. “Administrative Burden: Learning, Psychological, and Compliance Costs in Citizen-State Interactions.” Journal of Public Administration Research and Theory, vol. 25, no. 1, 2015, pp. 43–69. https://doi.org/10.1093/jopart/muu009.
Motor Vehicle Manufacturers Association of the United States, Inc. v. State Farm Mutual Automobile Insurance Co. 463 U.S. 29. Supreme Court of the United States. 24 June 1983. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep463/usrep463029/usrep463029.pdf. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, U.S. Department of Commerce, Jan. 2023, nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1, U.S. Department of Commerce, July 2024, nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. Guide for Conducting Risk Assessments. NIST Special Publication 800-30, Rev. 1, U.S. Department of Commerce, Sept. 2012, csrc.nist.gov/pubs/sp/800/30/r1/final. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. An Introduction to Privacy Engineering and Risk Management in Federal Systems. NISTIR 8062, U.S. Department of Commerce, Jan. 2017. https://doi.org/10.6028/NIST.IR.8062.
National Institute of Standards and Technology. NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management. Version 1.0, 16 Jan. 2020, http://www.nist.gov/document/nist-privacy-frameworkv10pdf. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. NIST Special Publication 800-37, Rev. 2, U.S. Department of Commerce, Dec. 2018, nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. NIST Special Publication 800-218, U.S. Department of Commerce, Feb. 2022, csrc.nist.gov/pubs/sp/800/218/final. Accessed 21 Dec. 2025.
National Institute of Standards and Technology. Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53, Rev. 5, U.S. Department of Commerce, Sept. 2020, csrc.nist.gov/pubs/sp/800/53/r5/upd1/final. Accessed 21 Dec. 2025.
National Labor Relations Board. “Weingarten Rights.” National Labor Relations Board. Accessed 21 Dec. 2025.
NLRB v. J. Weingarten, Inc. 420 U.S. 251. Supreme Court of the United States. 16 June 1975. United States Reports.
Office of Management and Budget. Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence. Memorandum M-24-10, 28 Mar. 2024.
Office of Management and Budget. Accelerating Federal Use of Artificial Intelligence through Innovation, Governance, and Public Trust. Memorandum M-25-21, 3 Apr. 2025.
Office of Management and Budget. “Definitions.” 5 C.F.R. § 1320.3. U.S. Government Publishing Office, http://www.govinfo.gov/link/cfr/5/1320?link-type=pdf§ionnum=3&year=mostrecent. Accessed 21 Dec. 2025.
OpenSSF. “SLSA Provenance.” Supply-chain Levels for Software Artifacts (SLSA) Specification, v1.0, slsa.dev/spec/v1.0/provenance. Accessed 21 Dec. 2025.
OpenSSF. “Verifying Artifacts.” Supply-chain Levels for Software Artifacts (SLSA) Specification, v1.0, slsa.dev/spec/v1.0/verifying-artifacts. Accessed 21 Dec. 2025.
OWASP. “LLM01: Prompt Injection.” OWASP GenAI Security Project, genai.owasp.org/llmrisk2023-24/llm01-24-prompt-injection/. Accessed 21 Dec. 2025.
OWASP. OWASP Top 10 for Large Language Model Applications. OWASP, owasp.org/www-project-top-10-for-large-language-model-applications/. Accessed 21 Dec. 2025.
ProCD, Inc. v. Zeidenberg. 86 F.3d 1447. United States Court of Appeals for the Seventh Circuit. 20 June 1996.
Reuters. “EEOC Says Wearable Devices Could Lead to Workplace Discrimination.” 19 Dec. 2024.
Reuters. “Trump Revokes Biden Executive Order on Addressing AI Risks.” 21 Jan. 2025.
Reuters. “US Judicial Panel Advances Proposal to Regulate AI-Generated Evidence.” 2 May 2025.
Secure Systems Lab. “DSSE: Dead Simple Signing Envelope.” GitHub, github.com/secure-systems-lab/dsse. Accessed 21 Dec. 2025.
SEC v. Chenery Corp. 318 U.S. 80. Supreme Court of the United States. 1 Mar. 1943. United States Reports.
SEC v. Chenery Corp. 332 U.S. 194. Supreme Court of the United States. 23 June 1947. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep332/usrep332194/usrep332194.pdf. Accessed 21 Dec. 2025.
Sigstore. “Frequently Asked Questions.” Sigstore Documentation, docs.sigstore.dev/about/faq/. Accessed 21 Dec. 2025.
Simon, Herbert A. Administrative Behavior: A Study of Decision-Making Processes in Administrative Organization. Macmillan, 1947.
United States. 5 U.S.C. § 706. “Scope of Review.” Office of the Law Revision Counsel, U.S. House of Representatives, uscode.house.gov/view.xhtml?req=(title:5%20section:706%20edition:prelim). Accessed 21 Dec. 2025.
United States. 15 U.S.C. § 7001. “General Rule of Validity.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/uscode/text/15/7001. Accessed 21 Dec. 2025.
United States. 15 U.S.C. § 7001(h). “Electronic Agents.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/uscode/text/15/7001. Accessed 21 Dec. 2025.
United States. 18 U.S.C. § 1001. “Statements or Entries Generally.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/uscode/text/18/1001. Accessed 21 Dec. 2025.
United States. 20 C.F.R. § 404.900. “Administrative Review Process.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. 31 U.S.C. § 3729. “False Claims.” Office of the Law Revision Counsel, U.S. House of Representatives. Accessed 21 Dec. 2025.
United States. 42 U.S.C. § 300jj-52. “Information Blocking.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/uscode/text/42/300jj-52. Accessed 21 Dec. 2025.
United States. 29 C.F.R. pt. 1602. “Recordkeeping and Reporting Requirements Under Title VII, the ADA, GINA, and the PWFA.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. 29 C.F.R. pt. 1607. “Uniform Guidelines on Employee Selection Procedures.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. 29 C.F.R. § 2560.503-1. “Claims Procedure.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. 45 C.F.R. § 164.312. “Technical Safeguards.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. 45 C.F.R. § 164.502(b). “Minimum Necessary.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. 45 C.F.R. § 164.514(d). “Minimum Necessary Requirements.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. 45 C.F.R. § 164.524. “Access of Individuals to Protected Health Information.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. 45 C.F.R. pt. 171. “Information Blocking.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. 45 C.F.R. § 171.103. “Information Blocking Definitions.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States. Department of Health and Human Services. “Individuals’ Right under HIPAA to Access Their Health Information.” 30 May 2025. Accessed 21 Dec. 2025.
United States. 42 C.F.R. pt. 2. “Confidentiality of Substance Use Disorder Patient Records.” Electronic Code of Federal Regulations, U.S. Government Publishing Office. Accessed 21 Dec. 2025.
United States Courts. Federal Rules of Evidence. Effective 1 Dec. 2024. United States Courts, http://www.uscourts.gov/sites/default/files/2025-02/federal-rules-of-evidence-dec-1-2024_0.pdf. Accessed 21 Dec. 2025.
Uniform Commercial Code. § 2-302. “Unconscionable Contract or Clause.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/ucc/2/2-302. Accessed 21 Dec. 2025.
Uniform Commercial Code. § 2-313. “Express Warranties by Affirmation, Promise, Description, Sample.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/ucc/2/2-313. Accessed 21 Dec. 2025.
Uniform Commercial Code. § 2-316. “Exclusion or Modification of Warranties.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/ucc/2/2-316. Accessed 21 Dec. 2025.
Uniform Commercial Code. § 2-719. “Contractual Modification or Limitation of Remedy.” Legal Information Institute, Cornell Law School, http://www.law.cornell.edu/ucc/2/2-719. Accessed 21 Dec. 2025.
Vermont Yankee Nuclear Power Corp. v. Natural Resources Defense Council, Inc. 435 U.S. 519. Supreme Court of the United States. 21 Feb. 1978. United States Reports.
Whalen v. Roe. 429 U.S. 589. Supreme Court of the United States. 1 Mar. 1977. United States Reports. Library of Congress, tile.loc.gov/storage-services/service/ll/usrep/usrep429/usrep429589/usrep429589.pdf. Accessed 21 Dec. 2025.
World Wide Web Consortium. Verifiable Credential Data Integrity 1.0. W3C Recommendation, http://www.w3.org/TR/vc-data-integrity/. Accessed 21 Dec. 2025.
World Wide Web Consortium. Verifiable Credentials Data Model v2.0. W3C Recommendation, 15 May 2025, http://www.w3.org/TR/vc-data-model-2.0/. Accessed 21 Dec. 2025.
Jonathan Johnson-Swagel 
Leave a comment