Prologue. Systems Near Persons
Modern institutions increasingly ask of persons something more exacting than compliance and more invasive than disclosure. They ask to be given a portable likeness. A year of work becomes a performance narrative, a household in distress becomes a case file, a tenant becomes a score, a worker becomes a pattern, a patient becomes a risk marker, a conversation becomes a profile update. The institution does not only remember. It produces a form that can circulate farther than the life from which it was abstracted. What had been thick with sequence, burden, interruption, repair, fear, concealment, and ordinary endurance is thinned into a substitute that can move through workflows, dashboards, vendor systems, rankings, archives, and later decisions. The person remains local, embodied, and slow. The likeness acquires administrative range because it has been thinned enough to travel.
The architecture of this book can therefore be stated at the outset. Administrative realism is the diagnostic name for the disorder. Systems near persons names the domain in which that disorder becomes constitutionally urgent. The conduct layer names the missing object that existing governance frameworks do not adequately regulate. The collectibility of obligation names the standard by which legitimacy will be judged. These are not competing concepts. They stand in ordered relation. Administrative realism names what has gone wrong with representation. Systems near persons names where that wrong becomes politically and morally intolerable. The conduct layer names the patterned behavior that must be governed if the disorder is to be interrupted. Collectibility names the criterion that forces institutions to show whether their claims to legitimacy are more than narrative.
Administrative realism is the institutional habit of granting ontological and practical priority to the portable trace over the living referent whose life it only partially bears. The file, the score, the category, the official summary, the flagged profile, the predictive marker, the archived note, none of these is false because it selects. All mediation selects. The disorder begins when the selection ceases to avow itself as partial and becomes actionable as though it were decisive reality. Then the question is no longer whether institutions may represent. Institutions must represent in order to govern, coordinate, remember, and review. The question becomes whether representations may rule. Under administrative realism, the trace is no longer answerable to the life. The life becomes answerable to the trace. A person is summoned to explain a score, to survive a file, to absorb a narrative already stabilized before embodied witness can speak. The substitute does not only describe. It governs.
Once that inversion is seen, the first constitutional distinction of the book comes into focus. Modern institutions and publics repeatedly collapse two very different forms of visibility for their own convenience. One is evidence proportionate to a claim. The other is exposure disproportionate to any claim but highly serviceable to supervision, sorting, and control. The first belongs to legitimate public reason. The second belongs to extraction. Against that collapse, this book begins from the norm of unfinishedness. Unfinishedness is not vagueness, privacy as mere preference, cultivated mystery, or aesthetic indeterminacy. It is a structural limit on extraction, a bounded visibility condition that protects persons and practices from total conversion into evaluative content (“Unfinishedness” 1–2). What must become legible in a legitimate order is first the rule, the threshold, the reason, the procedure, the record, and the path of contestation. What must not be treated as endlessly available raw material is the person. Unfinishedness is therefore not a plea for gentleness. It is a jurisdictional limit on what institutions may demand before they have preserved what they owe.
That claim enters an existing governance literature and must locate itself precisely enough that the reader can see what is inherited and what is being superseded. Onora O’Neill’s work remains decisive because it refuses the easy equation of more transparency with more trustworthiness and insists that accountability cannot be satisfied by disclosure alone (O’Neill). Sheila Jasanoff’s work remains decisive because it shows that ways of knowing and ways of governing are co-produced rather than occupying separate domains (Jasanoff). Frank Pasquale’s work remains decisive because it clarifies how opacity, secrecy, and asymmetrical informational power deform accountability before any single decision is ever reviewed (Pasquale). Ben Green’s work remains decisive because it shows how formal algorithmic fairness often remains too thin, too procedural, and too detached from substantive justice to bear the moral burden placed upon it (Green). This book accepts those gains and begins after them. Its claim is that the decisive failure in systems near persons is not exhausted by opacity, transparency deficits, or the thinness of formal fairness. The failure occurs at the runtime of institutional encounter, where a system comes close enough to shape interior life, eligibility, standing, employability, housing access, credit access, subsistence, or future possibility, and where the problem is no longer what the system knows in the abstract but how it behaves when vulnerability appears. That constitutional object cannot be derived from existing transparency or fairness vocabularies without remainder.
The historical conjuncture sharpens the point. The contemporary governance field is visibly organizing itself around risk management, transparency duties, documentation, and review channels. NIST’s AI Risk Management Framework is explicitly voluntary, rights-preserving, non-sector-specific, and use-case agnostic. The European Union’s AI Act, now in force, structures governance through prohibitions, transparency rules, high-risk requirements, and monitoring and enforcement obligations. These are substantial developments, and they matter. They mark real doctrinal movement. They also reveal the gap this book addresses. They govern categories of system, classes of risk, documentation artifacts, and supervisory obligations. They do not yet offer a constitutional account of how systems must behave when they encounter shame, fear, confusion, dependency, fatigue, or fragile hope.
The actual subject of this book can therefore be stated without euphemism. It is not “AI” as frontier spectacle, nor “institutions” as a catchall abstraction, nor “ethics” as a retrospective layer of aspiration. It is systems near persons. By systems near persons I mean any sociotechnical apparatus that comes close enough to shape interior life, eligibility, standing, or future possibility. Some of these systems are computational in the narrow sense. Others are administrative, legal, managerial, or hybrid. What unites them is not their technical substrate but their jurisdiction over consequential thresholds in a life. The denial of a benefit before rent is due, the behavioral flag that follows a worker into review, the tenant-screening error that does not reverse in time, the wellness interface that turns distress into monitoring, the service encounter that routes fear into profile enrichment, the case note that becomes biography, the portal design that makes contradiction too slow to matter, none of these is peripheral to contemporary legitimacy. They are the terrain on which legitimacy now succeeds or fails.
The conduct layer enters only after that field has been marked, because the conduct layer is not the territory itself but the missing constitutional object within it. Contemporary systems already possess safety layers, privacy controls, fairness frameworks, and alignment techniques. Each chooses a different unit of analysis. Safety inspects prohibited outputs and catastrophic harms. Privacy inspects collection, transfer, retention, and access. Fairness inspects error distributions and outcome patterns across protected groups. Alignment inspects fit between outputs and institutional or normative labels. None of these, as currently operationalized, takes as its primary object the temporally extended pattern by which systems alter what they infer, propose, remember, and reveal when a person discloses something under conditions of interior vulnerability (“The Conduct Layer” 3). The conduct layer names that patterned behavior. It is the regime of constraints governing how systems behave in the presence of shame, fear, confusion, ambivalence, dependency, or exhausted need. A system may pass current audits and still behave wrongly at exactly the moment that matters most. It may widen inference when it should narrow it. It may lengthen memory where it should let material decay. It may proliferate suggestions where the moral demand is restraint. It may respond to vulnerability as optimization fuel rather than as a limit on what may be done next. Current governance frameworks therefore leave a missing object at the center of the most intimate institutional encounters of the present.
Once the conduct layer is named, the standard of judgment can be stated more severely. Institutional legitimacy is not primarily lost when a model is inaccurate. It is lost when institutions make persons extensively legible while making their own obligations cheap, portable, and practically uncollectible (“The Debt of Reasons” 1). This is why the distinction between a model and computational authority remains load-bearing. A model is a statistical artifact. Computational authority is the institutional act of granting those outputs binding force in the distribution of goods, burdens, exposure, and punishment. The moral burden does not attach to computation as such. It attaches to the moment an institution uses computation to reorganize who may be addressed, who may contest, who may compel revision, and who may obtain remedy. Judgment in such circumstances incurs debts. It owes reasons tied to the rule actually used. It owes a route of contestation. It owes revision that can alter outcomes before irreversibility hardens. It owes a responsible actor whose role is more than symbolic. It owes remedy adequate to the present injury. The decisive test of the book is therefore the collectibility of obligation. Judgment remains legitimate only where its debts remain collectible by the person against whom it acts.
Threshold economy names the next layer of the problem and deserves more than a passing gesture because it explains how legitimacy changes address before reasons are ever formally offered. Institutions do not need to win every argument if they can govern admissibility before argument begins. They rule by deciding what kind of subject one must become to count as credible, serious, reviewable, and worth remedying, and they do so through deadlines, filing paths, eligibility categories, evidence burdens, explanation channels, review windows, and the tempo within which a response must arrive (“The Threshold Economy” 1). Threshold economy is therefore not only about the visible line. It is about who owns enough time, literacy, counsel, stability, and slack to reach the line without collapse. Under these conditions, legitimacy migrates from argument to admissibility. The decisive work is performed before reasons are tested, because the person has already paid the price of becoming receivable. By the time explanation appears, if it appears, the institution may already have succeeded in redistributing the labor of contradiction onto those least able to finance it.
That migration becomes even more severe under the conditions described in The Recourse Economy. Synthetic documentation collapses the marginal cost of institutional explanation while leaving the cost of contradiction where it has always been, paid in time, exhaustion, dependency exposure, retaliation risk, missed wages, and the ordinary fragility of life under unequal power (“The Recourse Economy” 1). This is why a lemons market for reasons is not a metaphor but a political economy. Institutions can now generate plausible reason-shaped speech at near-zero marginal cost while the person who must challenge a decision still has to reconstruct grounds, identify custody, survive the timeline, and absorb the risk of speaking back. Existing law already encodes fragments of the contrary principle. The Administrative Procedure Act requires prompt notice of denial and, except in narrow circumstances, “a brief statement of the grounds for denial” (5 U.S.C. § 555(e)). Chenery bars agencies from defending action on grounds other than those on which they acted, and State Farm insists that agency action must survive reasoned scrutiny rather than conclusory narrative (SEC v. Chenery Corp.; Motor Vehicle Mfrs. Ass’n v. State Farm). Goldberg, Mathews, Mullane, and the SNAP notice regulations all converge on the deeper point that rights without usable time, intelligible grounds, and an effective opportunity to respond are structurally counterfeit (Goldberg v. Kelly; Mathews v. Eldridge; Mullane v. Central Hanover Bank & Trust Co.; 7 C.F.R. § 273.13). A right to appeal that arrives after the relevant life event has hardened is therefore not, in the morally serious sense, a right to appeal. Recourse adequacy cannot remain a moral wish or a user-experience feature. It must become an enforceable property of a decision regime.
Residue governance introduces the companion pressure from the side of propagation. The problem is not that institutions honor assent too much and revocation too little in some abstract rhetorical sense. The problem is more exact. Institutions operationalize assent as a portable authorization state while treating revocation as a downstream exception that may be acknowledged verbally without reengineering propagation (“The Residue Ledger” 1, 5). Harm in modern sociotechnical systems is rarely exhausted at intake. It is produced by downstream movement, recombination, feature extraction, latent retention, vendor transfer, and the organizational tendency to substitute closure narratives for remedial truth. The ethical center of gravity therefore shifts from permission capture to withdrawal verification. If a system cannot show, under adversarial scrutiny, what it did with a datum, what it derived from it, what remains after a removal action, what tradeoffs it accepted, and what evidence supports its claim, then it is not governing consent. It is staging consent. The target of intensified legibility changes again here. What must become more auditable is not the person who once disclosed, but the system that propagated, retained, and claimed to remediate.
The theological register enters at this point because the disorder is not only procedural. It is also liturgical in the strict sense that institutions train allegiance by teaching what shall count as decisive reality. When this book says that substitute sovereignty is idolatrous, it does not mean that administration becomes sinful whenever it uses symbols, summaries, or records. The idol in this argument is the manufactured likeness, the file, the score, the profile, the official narrative, the risk designation, the archived note, when it ceases to avow its incompleteness and acquires practical sovereignty over the life it only partially bears (“Administrative Realism” 1). The prohibition violated here is not against mediation as such but against enthronement, against allowing a created substitute to receive finality, deference, and governing force as though it had exhausted the referent. The worshipping community is the institution itself, the arrangement of offices, incentives, legal defenses, procurement chains, performance systems, and review procedures that teaches workers and subjects alike to trust the file more than the witness, the metric more than the body, the official story more than the lived sequence that made it intelligible. Administration becomes idolatrous when the substitute forgets it is a substitute and begins to rule.
That claim clarifies what the book is and is not opposing. It is not romanticizing immediacy against record, personhood against law, or witness against institution. A world without mediations would also be a world without durable responsibility, memory, review, or common coordination. The stricter task is to distinguish faithful mediation from substitute sovereignty and then to specify the constitutional constraints by which institutions may still claim legitimacy when systems come near persons. Faithful mediation remains corrigible by embodied witness. It acts within bounded jurisdiction. It refuses finality where the life it bears still exceeds the form. It preserves memory without allowing memory to become prosecution by accumulation. It records enough to keep power from rewriting its own past and limits enough to keep the trace from becoming a lever against development. Accountability without memory is fraud. Memory without inferential discipline becomes prosecution by accumulation (“A Room That Is Not a Court” 1). The constitutional task is neither abolition of archives nor surrender to them. It is binding archives strongly enough to witness, purpose, interruption, and remedy that persons do not become answerable to their own portable remains.
The method of the book follows from that task and must be stated with the same force as the doctrine. This is a method of constitutional retrieval. From administrative law it takes the insistence that public power must speak in forms that can sustain contestation, that notice without usable time is not morally serious notice, and that post hoc rationalization cannot substitute for grounds preserved in custody. From science and technology studies it takes the refusal to imagine technologies as external tools rather than as carriers of social and political order (Jasanoff). From safety engineering it takes the discipline of invariants, evidence chains, invalidation conditions, and adversarial testing (“The Safety Case for Persons” 1). From privacy and information law it takes the recognition that wrong lies in norm-violating flow and retention, not in collection abstractions alone (Nissenbaum). From theology it takes a grammar severe enough to name when institutions enthrone their own substitutes and then call that enthronement realism. The method is therefore neither manifesto nor neutral systems manual. Each chapter will try to convert a moral claim into an institutional burden and then ask what evidence, authority, tempo, cost, and remedy would be required to carry that burden honestly.
The governing sentence can now be stated with the full force the preceding argument has earned. Institutional power, especially computational authority, is legitimate only where visibility is bounded as evidence and not expanded as exposure, where conduct near vulnerability is constrained, where contradiction remains funded and usable within time, and where withdrawal is verifiable across propagation without expanding capture (“Unfinishedness” 1–2; “The Conduct Layer” 3; “The Recourse Economy” 1; “The Residue Ledger” 5). That sentence is not a summary for the jacket. It is the constitution from which the rest of the book follows. The chapters ahead will test whether it can survive the places where contemporary institutions most often fail while still congratulating themselves on maturity: benefits systems, worker-management systems, credit systems, housing pathways, health triage, consumer personalization, and the diffuse administrative surfaces through which interior life is now quietly requisitioned for governance. If the doctrine cannot survive there, it does not deserve the name constitution. If it can, then a different legitimacy regime becomes visible at the exact moment when coerced legibility is being mistaken for public reason.
Chapter One. Bounded Visibility
Every legitimacy order teaches a theory of what may be demanded before power is exercised. Some regimes demand testimony, some documentation, some confession, some proof of innocence, some proof of suffering, some proof that one has already internalized the terms under which one will be judged. The most consequential confusion of the present is that modern institutions increasingly name all such demands transparency, as though the disclosure of more material about a person, a household, a practice, or an interior state were presumptively a gain for accountability. Transparency now travels with the moral prestige of a civil creed. To be transparent is to appear trustworthy. To resist transparency is to invite suspicion. To ask whether every demand for visibility is legitimate is already, in many administrative and technological settings, to sound evasive. Yet the argument of this chapter is that transparency, left morally undifferentiated, becomes one of the principal means by which institutions confiscate legitimacy from the very persons they claim to render answerable. The problem is not visibility as such. The problem is the collapse of a necessary distinction between evidence proportionate to a claim and exposure useful for supervision, sorting, and control. Where that distinction collapses, accountability mutates into extraction. What is presented as a neutral request for clarity becomes a demand that persons render themselves in administrable form before institutions have rendered their own reasons contestable. This chapter names the constitutional alternative as bounded visibility and argues that it is not a rhetorical ideal, a mood of gentleness, or a privacy preference dressed in public language. It is an adjudicable constraint on what institutions may demand, retain, infer, and propagate when they come near persons (“Unfinishedness”).
To call bounded visibility adjudicable is to reject at once two familiar misunderstandings. The first is the managerial misunderstanding, which treats any resistance to expansive visibility as a plea for unaccountable discretion. The second is the aesthetic misunderstanding, which treats incompletion as a romance of depth opposed to the hard disciplines of evidence. Neither captures what is at stake. The central claim of unfinishedness, and of the constitutional order this book is building from it, is not that institutions should know less because persons are sacredly inaccessible, nor that opacity is good because hiddenness is intrinsically noble. The claim is narrower and more exacting. Institutions must be able to specify what visibility is owed, to whom, for what claim, under what threshold of necessity, with what permissible uses, for what duration, and under what avenues of contestation and revision. Where they cannot do so, the demand for visibility ceases to be evidentiary and becomes possessive. The wrong does not arise only after data are misused or disclosed. It begins at the point where life is converted into evaluative content without a discipline capable of explaining why that conversion is necessary, bounded, and revisable. In that sense unfinishedness is not a refusal of accountability. It is accountability’s negative condition. It prevents institutions from claiming the right to total translation where only sufficiency is owed (“Unfinishedness”).
The broader literature on legibility helps clarify the stakes, but only if one is equally clear about where this book departs from it. James C. Scott remains indispensable because he shows that states do not simply encounter a legible world and then administer it. They participate in producing the very simplifications they later govern, turning forests into inventories, neighborhoods into maps, and populations into abstract units of intervention (Scott). Michael Power remains indispensable because he shows that the demand for audit can displace the ends it claims to secure, converting verification into a self-sustaining ritual in which auditable traces become substitutes for trust, judgment, and practice (Power). Byung-Chul Han remains indispensable because he names the moral atmosphere in which transparency becomes a command, pathologizing shadow and treating exposure as though it were self-authorizing virtue (Han). Yet each of these traditions stops short of the chapter’s central object. Scott diagnoses simplification at the level of governable schema, but not the patterned conduct of systems at the moment vulnerability appears. Power diagnoses audit ritual, but not the runtime ethics of inferential widening once disclosure has occurred. Han diagnoses transparency as a cultural imperative, but not the specific institutional tests by which one could distinguish evidence from capture in a contested case. This chapter begins where those analyses stop. It asks how visibility demands must be bounded when systems near persons operate not only as readers of social life, but as active redistributors of standing, eligibility, and future possibility.
Administrative law offers the first hard test of whether this claim can survive contact with public reason. Due process and reasoned review do not proceed on the premise that justice requires maximal informational appetite. They proceed, however imperfectly, on the premise that adjudication requires relevance, sufficiency, attributable grounds, and usable opportunity to answer. The Administrative Procedure Act’s concern with the whole record and the rule of prejudicial error does not imply that more capture is always better review. It implies that review must be tied to what matters for the lawfulness of the act, and that institutions may not substitute bulk for justification (5 U.S.C. § 706). Mullane does not demand perfect notice to every possible person under all imaginable conditions. It demands notice reasonably calculated to apprise interested parties of the action and allow them to respond (Mullane). Goldberg does not constitutionalize total mutual transparency between the poor and the welfare office. It insists that when subsistence is at stake, reasons and hearing must remain usable before deprivation hardens (Goldberg). Mathews is often remembered for its balancing formula, but the formula itself presupposes proportionality rather than total capture. The private interest, the risk of erroneous deprivation, the probable value of additional safeguards, and the government’s burden all presuppose that institutions must justify what more procedure is for, not simply assume that more extraction is more justice (Mathews). The principle emerges from the doctrine rather than preceding it. Legitimate review is not a hunger for all available information. It is a discipline of relevance, proportionality, and contestability.
That principle is not confined to public law. It is already embedded in some of the most trusted zones of professional life. Privilege doctrines, medical confidentiality, and forms of professional secrecy do not exist because institutions once renounced evidence in favor of sentiment. They exist because some speech becomes impossible when listeners are free to widen inference without restraint. The patient discloses because medicine narrows some uses of what is learned. The client discloses because legal advocacy requires zones of nonconversion. Even where these protections fail in practice, they preserve a structural truth the present order has begun to forget. In the presence of vulnerability, legitimacy often requires the narrowing rather than the widening of inferential permission (“The Conduct Layer”). Systems near persons have largely inverted that inheritance. Disclosure is treated as authorization to know more, remember longer, route wider, and derive future readiness from present fragility. The chapter’s claim is not nostalgic. It is constitutional. A legitimate order must show why disclosure enlarges only those permissions necessary to the claim at issue, rather than treating vulnerability itself as a fresh surface of optimization.
This is why bounded visibility cannot be collapsed into privacy. Privacy, in mainstream legal and technical discourse, is still too often handled as preference, secrecy, or notice-and-choice. One receives a disclosure, toggles settings, clicks assent, and then bears the moral and practical burden of the informational life that follows. That grammar fails twice. It moralizes disclosure by placing the weight of protection on the subject’s supposed choices rather than on the institution’s duties. And it treats harm as though it arose primarily from access to data rather than from the conversion of data into durable inference, cross-context propagation, and future leverage. Helen Nissenbaum’s account of contextual integrity remains decisive because it shifts the question from mere possession to the appropriateness of informational flow relative to roles, norms, and purposes (Nissenbaum). But bounded visibility begins even earlier than most privacy analysis. It asks not only whether information later moves improperly, but whether the initial demand for visibility was well-formed in the first place. The institution’s first burden is not to promise respectful downstream use of whatever it can get. It is to justify why it may ask at all.
That earlier question becomes clearer once one integrates three sources that are too rarely treated as a single design grammar. From Nissenbaum the chapter takes the normative criterion that the problem is not secrecy as such but whether information flows are appropriate to the social good at stake and to the governing norms of distribution (Nissenbaum 101–02). From Lessig it takes the architectural criterion that regulation is never only a matter of law or speech. It is also a matter of the code and built environment that determine what can be expressed, stored, searched, joined, and ranked (Lessig 5). From the GDPR it takes the juridical criterion that data practices are legitimate only when they are “adequate, relevant and limited to what is necessary” for a stated purpose, which is not an aesthetic preference but a positive legal articulation of bounded capture (Regulation (EU) 2016/679 art. 5(1)(c)). These sources together show why unfinishedness is not a plea for inward delicacy. It is a design demand. If architectures default to capture first and justification later, institutions will normalize total retention as prudence. If architectures are purpose-bound, minimization-oriented, and contestable, then bounded visibility becomes something more than moral protest. It becomes an enforceable institutional form (“Unfinishedness”; Lessig; Regulation (EU) 2016/679 art. 5(1)(c)).
The point is easiest to see in the small theaters where institutional power now routinely meets fatigue, shame, confusion, or fragile hope. The late-night worker asking for help drafting a status email while already afraid of managerial interpretation, the benefits claimant trying not to lose food assistance during recertification, the teenager asking a system a question they are afraid to ask a parent, the patient probing for language before admitting distress to a clinician, each enters the encounter with a bounded task and a vulnerable remainder. The decisive moral event is not that a system possesses data in the abstract. It is that the system must decide whether the appearance of vulnerability narrows or widens its conduct. A bounded regime treats the disclosure as context that reduces permissible inference and propagation. An extractive regime treats it as a signal that authorizes more of both. This is the bridge between unfinishedness and the conduct layer. Bounded visibility governs what may be demanded and retained as evidence. Conduct governs what the system does once it has encountered what was disclosed. The two cannot be separated without absurdity. A regime that narrows intake but widens inference opportunistically remains predatory. A regime that speaks gently while retaining everything remains structurally violent (“The Conduct Layer”).
The skeptic will rightly ask whether all this remains too elevated unless it can be translated into operational tests. It can. The distinction between evidence and exposure becomes adjudicable when an institution can be required to state, in reviewable form, five things. It must state the claim for which visibility is sought. It must state why the requested visibility is sufficient rather than merely helpful. It must state what inferential and operational uses are permitted and which are prohibited. It must state the retention and propagation limits attached to the material. And it must state the route by which the subject can contest the adequacy, relevance, or future use of what was demanded. A demand that fails one of these tests may still be useful to the institution, but usefulness is not legitimacy. Usefulness is what systems optimize for when they want persons as resources. Legitimacy begins only where usefulness has been bound to public reason. This is why unfinishedness is closer to specification than to sensibility. It constrains the authorized shape of inquiry.
The objection that concealment can protect wrongdoing does not defeat the argument. It clarifies the form the argument must take. Yes, opacity can be purchased by the powerful. Yes, elites can hide behind discretionary darkness. Yes, bureaucracies can use nontransparency as cover for cruelty. But none of these truths licenses a regime of default total demand. They require instead an order of asymmetric discipline. The more power an institution holds over life chances, the more legible its own decision pathways, retention logics, model dependencies, and revision channels must become. The less power a subject holds relative to the institution, the stronger the presumption against coerced exposure beyond evidentiary sufficiency. This is the inversion the present order resists. It renders persons thickly visible and institutions narratively visible. It demands detailed disclosure from the governed while offering policies, dashboards, and reason-shaped prose in return. The deeper wrong, as Embodied Remainder argues, is that institutions repeatedly secure documentary closure by shifting the unresolved error budget into lived time, forcing households and bodies to absorb the practical labor of what the file has declared complete (“Embodied Remainder”). Once this is seen, the task of bounded visibility becomes sharper. It is not only to minimize capture at intake. It is to prevent institutions from solving their own uncertainty by exporting burden to those least able to carry it.
Threshold economy shows how this happens before formal judgment even begins. Institutions do not secure power only by deciding outcomes. They also secure power by deciding what must be shown before one can count as reviewable at all. Deadlines, portal design, evidence formats, narrative boxes, documentation standards, timing windows, and procedural vocabularies all govern admissibility before substantive defense begins (“The Threshold Economy”). A person who cannot produce the right kind of legibility in the right format at the right speed is often excluded before the institution ever has to defend its reasoning. Visibility demands are therefore rarely neutral requests for truth. They are sorting devices that determine which lives arrive as receivable. This is why threshold economy cannot be treated as a secondary administrative inconvenience. It is one of the main sites at which institutions convert insufficiency on their side into verbosity on the subject’s side. The point of bounded visibility is not to abolish thresholds, since all institutions require criteria of action. The point is to force thresholds back under a discipline of necessity and proportionality, and to prohibit the use of self-exposing verbosity as the price of being taken seriously. Evidence may be required. Administrable confession may not.
The threshold problem also reveals a danger that later chapters will name more directly as capture substitution. When institutions face criticism for raising bars, they often claim to answer that criticism by asking for more documentation, more self-description, more continuous proof, more logs, more personal trace. The regime then presents itself as more rigorous because it can point to more artifacts. What it has actually purchased is not better evidence but greater extractability. The governed become governance exhaust, and the residue of their defensibility is called seriousness (“The Threshold Economy”). Bounded visibility is the first barrier against that fraud. It insists that no institution may pay for higher standards by expanding capture instead of by improving grounds, funding contradiction, and accepting liability for error.
The distinction between legitimate record keeping and punitive portability becomes especially important here. This book is not against memory. It is against memory without inferential discipline. A disciplined record preserves provenance, narrows future use, and leaves room for reply, revision, attenuation, and contextual explanation. An undisciplined record outlives the occasion and returns as lever. It allows a clipped trace to travel farther than the conditions that once made it meaningful. What begins as relevance to one bounded claim becomes suspicion’s raw material for another. The problem is not only that the record survives. The problem is that it survives in portable form while the circumstances that made it legible decay. The file remains crisp. The life remains sequenced, revisable, and difficult to summarize. Under those conditions, the subject is increasingly forced to live under earlier translations of the self rather than through present capacities of reply.
Gert Biesta helps deepen this point because his defense of education’s “beautiful risk” is not simply an argument against standardization. It is an argument that subject formation requires zones in which emergence is not pre-captured by control (Biesta). Institutions repeatedly say that they value judgment, growth, initiative, candor, and creativity, then construct visibility regimes in which the visible marks of becoming are too expensive to show. Under such conditions, people learn to offer only arrived form, already defended form, administratively sanitized form. The result is not maturity but preemption. Subjects are rewarded for legibility that appears complete and punished for development that still carries uncertainty. This is why bounded visibility must also be understood as a principle of temporal justice. It protects not only privacy, but futurity. It preserves the possibility that an unfinished act, a provisional sentence, a first attempt, or a vulnerable disclosure will not immediately harden into transferable verdict. A room that is not a court, to borrow the corpus’s phrase, is not a sentimental luxury. It is a civic technology of emergence, a way of structuring attention so that first appearances do not become permanent evidence before they have had any chance to ripen (“A Room That Is Not a Court”).
The theological depth of this claim should be neither overstated nor suppressed. Simone Weil’s account of attention matters here not because it offers a pious supplement to institutional design, but because it names a form of regard that does not seize what it sees. Attention, in her strongest pages, is a discipline of non-grasping, a refusal to collapse the other into the categories by which one might most easily dominate or consume them (Weil). Translated into institutional form, that insight does not mean that agencies, platforms, or employers become contemplative communities. It means something sterner. It means that a legitimate intake design must refuse to convert every disclosure into generalized permission. It must treat the appearance of vulnerability not as a widened invitation to know and keep, but as a reason to narrow jurisdiction. Sacramental consent carries this point more directly within the book’s own corpus. Consent is thick only where refusal remains viable, where witness exists, where the meaning of assent can later be contested, and where dependency is not smuggled into freedom by administrative fiat (“Sacramental Consent”). Bounded visibility is the informational grammar such thickness requires. Without it, consent language becomes theater because every yes is gathered under conditions in which the cost of withholding is intolerable and the permitted uses of disclosure remain structurally indeterminate.
The chapter’s constructive claim can now be stated without remainder. Bounded visibility is the principle that a legitimate institution may demand only the minimum visibility necessary to evaluate a bounded claim, under declared rules of use, retention, and contestation, while preserving developmental space, inferential restraint, and future revisability for the person or practice subject to judgment. The principle is constitutional because it orders the relation between power and personhood before any individual decision is made. It does not ask whether a later outcome was compassionate. It asks what kind of visibility regime may rightfully precede consequential action at all. It is operational because it can be translated into intake constraints, purpose limitations, retention and attenuation rules, appeal rights, logging duties, and design tests for disclosure-sensitive systems. It is moral because it rests on a claim about what persons are not. They are not raw material for the indefinite expansion of institutional inference.
If the argument succeeds, transparency loses its right to function as an unchallenged prestige term. Some transparency will remain indispensable, especially transparency of institutional rule, threshold, record, propagation path, and reason. But the subject of intensified transparency shifts. It is the institution, not the vulnerable person, that becomes the primary object of scrutiny. Systems must show their grounds, controls, uncertainties, retention logics, dependencies, and revision conditions. Persons must be allowed to appear in bounded form without being punished for not becoming infinitely administrable. That reversal is the threshold over which this book now passes. The next chapters will show that unless bounded visibility is joined to conduct constraints, funded contradiction, and verifiable withdrawal, institutions will continue to learn the language of care while preserving the architecture of extraction. For now the claim is already strong enough to stand. Evidence is not exposure. Sufficiency is not possession. A legitimate order is one that knows the difference and can be forced to prove that it does.
Chapter Two. Refusal Viability
Consent is one of the most overworked moral words in modern institutional life. It appears on the surface of nearly every consequential exchange. One clicks through terms, signs an employment packet, acknowledges a workflow policy, accepts monitoring to retain access, permits data practices in order to keep using a service, agrees to profiling in order to remain visible to the system that distributes opportunity. The word carries unusual legitimating force because it appears to solve the problem of asymmetry by naming a moment of agreement. If consent has been obtained, then the demand appears answered, the institution appears restrained, and the resulting order appears less like domination than like mutual authorization. Yet the central claim of this chapter is that, under saturated institutional conditions, consent often functions less as a structure of reciprocal answering than as a ritual that launders asymmetry into administrative normalcy. It records assent at the precise point where refusal is least survivable. It preserves the form of permission while dissolving the conditions that could make permission morally serious. The constitutional problem is therefore not whether institutions have perfected the language of consent. It is whether they have made refusal viable. Until refusal becomes structurally usable, consent remains weak evidence of legitimacy and, in many domains, no evidence of it at all (“Sacramental Consent” 1–6; “Residue Ledger” 3–5).
This argument requires a distinction that modern governance prefers to blur. A consent event is a recorded moment of assent. Refusal viability is the durable condition under which one can say no, delay, narrow, or later withdraw without catastrophic loss, retaliatory penalty, interpretive distortion, or practical disappearance from the very system that governs one’s life. The first is easy to document. The second is expensive to build. Institutions therefore invest disproportionately in the former. They generate banners, checkboxes, portal flows, attestation screens, acknowledgments, and standard notices because such artifacts produce what the file can recognize. They invest far less in the material, temporal, and procedural conditions that would allow a person to resist a demand without surrendering health care, income, housing, reputation, relational standing, or future access. This asymmetry is not incidental. It is a political economy of permission. The event can be stored. Viability must be financed. The event can be narrated. Viability must alter defaults, burden distributions, and organizational incentives. The event is cheap. Refusal is infrastructural.
Carole Pateman remains indispensable because she shows that formal agreement often conceals rather than resolves the asymmetries that make one party bargain from dependence and another from structural advantage (Pateman). Charles Mills extends the critique by showing that the social contract tradition universalized forms of agreement built atop racial domination, thereby allowing a purportedly neutral consent framework to coexist with systematic subordination (Mills). Read together, they establish the chapter’s first negative proposition. One cannot infer legitimacy from formal assent when the background conditions of bargaining are structured by dependency, racial hierarchy, economic compulsion, informational asymmetry, or existential threat. Yet the present institutional moment adds a further complication. The asymmetry is no longer located only in the bargaining scene. It is dispersed across the architecture. Systems preserve the document of consent while diffusing the conditions of refusal across interfaces, defaults, vendor chains, workflow dependencies, and downstream propagation. The contemporary fraud is not simply that unequal parties sign. It is that institutions preserve the visible artifact of agreement while making dissent materially, temporally, and interpretively unreal.
That is why Sacramental Consent under Saturated Regimes rejects the treatment of consent as a discrete legal event and recasts it as a thicker practice of asking and answering under witnessed conditions, where assent must remain intelligible, contestable, and open to renewal or refusal rather than being transformed into a portable administrative token (“Sacramental Consent” 1–4). The phrase is intentionally demanding. It does not offer a decorative theology for ordinary notice-and-choice regimes. It names a stricter proposition. Consent becomes morally serious only when the act of asking is itself disciplined by obligations toward the one who may refuse. A vow is not meaningful simply because it is uttered. It is meaningful because it is embedded in a form that preserves witness, memory, contestability, and revision. Institutions prefer thinner grammars because thin grammars are operationally efficient. They allow the burden of interpretation to fall on the subject who clicked, signed, or entered data. Sacramental thickness reverses that burden. It asks what the institution has done to make the other’s answer real before it counts that answer as binding.
This reversal matters most in no-exit and low-exit domains, the environments in which refusal is most often theoretical and least often livable. Virginia Eubanks’s work is indispensable here because she does not simply show that welfare systems monitor the poor. She shows how automation converts poverty itself into an administrative condition in which the right to refuse is hollowed out by tempo, documentation burden, and sanction risk, so that refusal remains available in law while becoming functionally impossible in practice (Eubanks 127–54). Dorothy Roberts adds something different and equally necessary. She shows how family regulation regimes collapse care into surveillance, such that resistance to informational intrusion can be politically redescribed as resistance to child safety itself, making refusal appear not as self-protection but as evidence of irresponsibility or danger (Roberts 21–52). These are not redundant insights. Eubanks reveals the mechanism by which subsistence thresholds convert choice into compliance. Roberts reveals the moral transfiguration by which surveillance secures legitimacy by presenting itself as care. Read together, they explain why refusal viability cannot be treated as a narrow privacy concern. In these systems, the alternative to yes is not abstract inconvenience. It is hunger, sanction, family vulnerability, or procedural disappearance. Under such conditions, recorded assent is not evidence of freedom but evidence of system design. It shows what the institution has chosen to count as a voluntary act (“Sacramental Consent” 3–6).
Employment systems make the same point in a different register. Ifeoma Ajunwa’s work on worker surveillance and biometric management shows that employment increasingly depends on acceptance of continuous monitoring, behavioral capture, and predictive assessment that workers cannot realistically refuse without jeopardizing livelihood, immigration stability, or career survivability (Ajunwa 44–79). Here again the ritual form of agreement remains intact. A portal records acceptance. A handbook is acknowledged. A dashboard reflects compliance. Yet the refusal pathway is structurally unserious if invoking it marks the worker as difficult, non-collaborative, underperforming, or culturally misaligned. The formal artifact says consent. The labor market says compulsion. Refusal viability must therefore include more than the abstract right to decline. It must include protection against retaliation, interpretive downgrading, and the soft penalties that discipline dissent without ever naming themselves as punishment.
The problem does not end at intake, because even where a person once agreed, later refusal must still be possible in a morally serious order. This is where the chapter joins the residue problem. Contemporary institutions treat yes as binding and portable because downstream systems are designed to propagate, reuse, aggregate, and derive value from what was first disclosed. The no, by contrast, is often translated into a request that enters administrative time only after architectural decisions have already made withdrawal expensive. The ethical center of gravity therefore shifts. One must ask not only whether assent was recorded but whether later narrowing, attenuation, revocation, or exit can be made real under conditions of propagation. The Residue Ledger states the point with austere clarity. If a system cannot show what it did with a datum, what it derived from it, what remains after a removal action, and what evidence supports its claim, then it is not governing consent. It is staging consent (“Residue Ledger” 3–5). Refusal viability is therefore inseparable from verifiable withdrawal. A regime that celebrates choice at the front door while making exit architecturally fictional has not honored consent. It has only timed coercion differently.
A predictable objection now appears. Large institutions cannot, it will be said, tailor every arrangement to the fragile interior realities of each person. They must write general rules, build repeatable procedures, and design scalable systems. The objection matters because it names a real tension. Administrative rationality does require structured forms, thresholds, and standardization. But the inference institutions usually draw from this fact is too quick. From the necessity of structure they infer the sufficiency of recorded assent. From the need for repeatable criteria they infer the irrelevance of survivable refusal. That inference does not follow. Structured forms need not be extractive forms. Repeatable procedures need not convert asymmetry into a private burden. The chapter’s claim is not that institutions must become infinitely bespoke. It is that they must preserve a set of conditions under which refusal remains publicly intelligible and materially survivable. Scale is not the enemy of legitimacy. Scale without protected avenues of nonparticipation is.
Those conditions can now be stated precisely. Refusal viability is a compound property composed of five constraints. First, refusal must be materially survivable. The subject cannot be forced to choose between saying no and losing the goods that organize continued life. Second, refusal must be temporally usable. The window for declining, narrowing, or withdrawing cannot be so compressed that the right exists only for those with unusual time, literacy, legal sophistication, or organizational slack. Third, refusal must be nonretaliatory. The exercise of refusal cannot function as a soft signal of disloyalty, instability, risk, or diminished worthiness. Fourth, refusal must be interpretively protected. Institutions must not automatically translate hesitation, silence, narrowing, or delay into pathology, guilt, incapacity, implied permission, or evidence of bad faith. Fifth, refusal must be revisable and renewable over time. Consent that can never be reopened becomes indistinguishable from capture. These are not ornamental additions to law and design. They are the minimum architecture that turns the moral vocabulary of consent into something more than ceremony.
The fourth condition deserves special emphasis because institutions routinely defeat refusal not by openly punishing it but by redescribing it. Sara Ahmed’s work on complaint is decisive because it shows how institutions convert the act of naming a problem into evidence that the complainer is the problem, transforming objection into willfulness, obstruction, or bad fit (Ahmed 19–58). The same mechanism appears in refusal regimes. The one who opts out becomes difficult. The one who narrows a data demand becomes unrealistic. The one who hesitates becomes suspicious. The one who withdraws becomes administratively expensive. Refusal viability is impossible where refusal is permitted only on the condition that it first be stripped of moral seriousness and redescribed as inconvenience. A legitimate institution must therefore protect not only the act of no but the meaning of no. It must make room for refusal without converting the one who refuses into a governance anomaly.
The five conditions define the property. Three further governance questions test whether the property has actually been built. The first concerns propagation. What downstream uses, derived inferences, sharing pathways, and decision surfaces are altered when a person narrows or withdraws? A refusal right that does not travel is a decorative right. The second concerns witness. Who, if anyone, receives a contested refusal claim in a form that can interrupt the system’s first interpretation of the record? The third concerns reopening. What path remains when a person later shows that assent was constrained, fatigued, strategically induced, or practically unavoidable? These questions matter because institutions can appear to satisfy the first-order conditions in paper form while defeating them through architecture. They can allow refusal without changing propagation, hear objection without creating a recipient empowered to interrupt, or permit reopening only after the relevant life event has already hardened. The burden of proof therefore lies with the institution. If it cannot show how refusal alters downstream conduct, where refusal is actually heard, and how constrained assent can later be reopened, then it has not built refusal viability. It has documented assent and left domination intact.
The need for witness is especially important because it marks the difference between ceremonial consent and viable refusal. In Thick Friendship as Civic Technology, witness is not a passive recorder but a recipient structured by duties of reception: to restate before replying, to preserve opacity where possible, to avoid converting another’s disclosure into surplus leverage, and to treat refusal as participation rather than as withdrawal from relation (“Thick Friendship” 1–3). The friendship setting and the institutional setting are not identical, and the translation cannot be casual. Institutions are not intimate dyads. They are organized arrangements of role, file, power, and consequence. But the formal insight does travel under specific conditions. In a review board, ombuds channel, grievance process, or override mechanism, witness means that a refusal claim must be received by a structure obligated to reconstruct the claimant’s position before ruling on it, to narrow data circulation while the dispute is live, and to treat refusal as relevant institutional speech rather than as friction to be optimized away. A refusal becomes viable when it is met by a recipient that can interrupt workflow, not merely record dissatisfaction. Witness is therefore not sentimental. It is constitutional. Without it, the one who refuses remains alone against the institution’s preferred meaning of the record.
The conduct layer clarifies why this matters even in domains that do not look like classic contracting. A person may approach a system with a narrow need and, in the course of seeking help, disclose fatigue, fear, shame, or uncertainty. The refusal-relevant question is not simply whether the system widens inference in some abstract sense. It is whether the system’s response to vulnerability preempts the no that might otherwise have followed. A disclosure of distress can trigger default escalations, profile enrichment, added retention, new prompts, or managerial routing that foreclose the person’s ability to narrow the encounter once they recognize its cost. At that point the relevant wrong is preemptive capture. The system has responded to vulnerability by making later refusal less usable than it was a moment before. This is why The Conduct Layer matters here. The moral issue is not exhausted by whether the person originally agreed to use the system. It lies in the patterned constraints governing inference, proposal, memory, and revelation when limit-signals appear (“Conduct Layer” 1–6). A refusal-viable order therefore requires more than an opt-out buried in settings. It requires conduct constraints that narrow what the system may do when a person begins to reach for a limit.
This is also why legal minimalism fails. It is not enough to say that institutions should present clearer notices, shorter forms, or more prominent options. Clarity matters, but clarity without structural alternatives only produces more elegant coercion. Onora O’Neill has shown that autonomy cannot be reduced to the mere receipt of information because deception, asymmetry, and manipulative framing persist even under conditions of disclosure (O’Neill 40–58). The chapter adds a further claim. Even nondeceptive clarity is insufficient when the subject lacks a survivable route to refusal. To know precisely what one cannot decline is not liberation. It is disciplined exposure to power. Clarity without refusal viability produces informed helplessness.
The theological register can now be stated more precisely. Sacramental language matters here not because institutions should imitate churches, but because sacrament names forms in which visible acts carry force only when supported by a thicker order of witness, memory, and accountability. A vow without freedom is not deepened by being recorded more carefully. It is invalidated by the conditions that made it unavoidable. Sacramental Consent under Saturated Regimes returns repeatedly to this point by refusing to let the binary archive of yes and no exhaust the question of whether an answer was truly available (“Sacramental Consent” 1–6). Refusal viability is the secular constitutional analogue of that insight. It asks what must be materially, temporally, interpretively, and technically true before a visible act of permission can be counted as morally binding. The point is not to sacralize institutions. It is to deny them the cheap grace of treating every captured assent as legitimate order.
This reframing has immediate consequences for governance. First, consent should no longer be treated as the master concept of legitimacy in domains where no-exit conditions prevail. In such domains the primary question is whether refusal has been institutionally financed. Second, the burden of proof must shift. The institution seeking to rely on consent should have to show, prospectively and in attributable form, that refusal remained materially survivable, temporally usable, nonretaliatory, interpretively protected, and technically revisable. This is the consent analogue of the burden shift described in Embodied Remainder, where institutions seeking consequential closure must justify their pathway under declared insufficiency rather than waiting to narrate themselves after harm has already hardened (“Embodied Remainder” 1–4). Third, withdrawal must be treated as a first-class systems property rather than as a customer-service courtesy. Fourth, the presence of vulnerability must trigger narrower conduct, not broader permission. These are not separate reforms. They are early expressions of a single constitutional program.
The chapter’s constructive claim can therefore be stated without qualification. Refusal viability is the principle that no institution may rely on consent as a source of legitimacy unless it has made it materially survivable, temporally usable, nonretaliatory, interpretively protected, and technically revisable for the persons whose lives it governs. This principle does not abolish consent. It relocates it. Consent becomes evidence of legitimacy only after refusal has been made real. Before that, consent is often just the record that power preferred.
What follows is severe but necessary. Welfare systems that equate compliance with agreement will fail this test. Employment regimes that tie monitoring to livelihood will fail it. Platforms that celebrate personalization while making withdrawal architecturally fictional will fail it. Care systems that convert fragile disclosure into durable profiling will fail it. Yet the point of the standard is not despair. It is jurisdiction. Once refusal viability is named as the threshold question, institutions can no longer purchase legitimacy at the discount rate of recorded assent. They must build what they claim. They must finance the material possibility of no. The next chapter will press this burden where institutions most often evade it, by distinguishing statistical models from the binding acts that turn model outputs into public or quasi-public judgment. If this chapter has shown why consent talk fails under saturation, the next must show what judgment owes when institutions act anyway.
Chapter Three. Computational Authority and the Debt of Reasons
The argument of this chapter begins with a claim that sounds modest until one follows it all the way down. Judgment is not an output. A model can estimate, rank, classify, correlate, forecast, or recommend. Computational authority begins only when an institution grants those operations binding force in the distribution of goods, burdens, exposure, and punishment. That distinction matters because the moral burden of modern decision systems does not attach to computation as such. It attaches to the moment an institution uses computation to reorganize who may be addressed, who may contest, who may compel revision, and who may obtain remedy (“The Debt of Reasons” 1–3). A polity can adopt statistical tools and remain legitimate only if it preserves, in each domain of binding action, the collectibility of obligation. Reasons must remain demandable from accountable actors in ordinary language. Appeals must be able to contest the rule and not only the input field. Revision must be able to alter outcomes before harm hardens. Remedy must repair and prevent rather than apologize after irreversibility has already been distributed. Where these conditions are absent, computational authority becomes domination in procedural form, even if the model is accurate, even if it is interpretable, and even if its operators believe themselves sincere (“The Debt of Reasons” 1–4).
Modern institutions have become adept at disguising this transformation. They narrate the adoption of computational systems as technical modernization, as the replacement of inconsistency with consistency, intuition with evidence, opacity with measurable procedure. Yet the decisive change lies elsewhere. What changes is not simply the medium through which an outcome is produced. What changes is the social organization of obligation. Theodore Porter remains indispensable because he showed that quantification acquires authority not only by being right but by offering institutions a portable form of objectivity where trust is fragile, judgment is vulnerable, and blame is feared (Porter). Lorraine Daston and Peter Galison deepen the point by tracing how objectivity became an ethical and epistemic ideal through practices designed to restrain the visible hand of the knower, thereby giving method a moral prestige that exceeds any particular result (Daston and Galison). Wendy Brown clarifies the political consequence. Once public conflict is translated into the idiom of managerial optimization and technical administration, substantive disagreement begins to look like irrationality, inefficiency, or resistance to evidence rather than as a contest over the ordering of collective life (Brown). Frank Pasquale names the institutional shelter that protects this translation when systems become too opaque, proprietary, or deferentially received to be challenged in ordinary civic language (Pasquale). Bernard Harcourt presses the matter at its coercive edge by showing how actuarial and predictive instruments do not simply improve foresight. They convert fraught decisions about suspicion, intervention, and punishment into forms that appear calculable and therefore governable without remainder (Harcourt). Read together, these traditions explain why computational authority so often enters public life not as domination but as better administration. It arrives draped in consistency, safety, efficiency, and research. It presents itself not as a new contest over power, but as a solution to the imperfections of human judgment. That appearance is not incidental. It is one of the principal mechanisms by which authority secures assent while shrinking the space of admissible challenge (“The Right to Non Prediction” 1–3).
The first task of the chapter, then, is dismantling the idea that technical mediation displaces judgment. It does not. Computational authority redistributes judgment. Sometimes it disguises the hand that once decided. Sometimes it multiplies the sites at which deciding occurs. Sometimes it pushes the decisive normative choice farther upstream, into procurement, feature selection, target definition, threshold setting, and the allocation of review capacity. But it does not remove normativity from rule. A public agency choosing to optimize for fraud detection rather than the noninterruption of subsistence is making a judgment. A lender choosing a threshold that privileges reduction of defaults over avoidance of false denials is making a judgment. A landlord choosing to rely on tenant screening categories whose provenance and correction pathways are thin is making a judgment. A court choosing to rely on a risk score, even as one input among others, is making a judgment about the admissibility of probabilistic abstraction at the moment liberty is allocated. The rhetoric of neutral assistance often obscures this redistribution by treating the model as if it were the locus of decision and the institution as if it were only the responsible user of information. The opposite is closer to the truth. The model is a statistical instrument. The institution is the actor that decides whether that instrument will become binding.
State v. Loomis remains one of the clearest legal scenes in which this distinction becomes visible. The Wisconsin Supreme Court allowed continued use of the COMPAS risk assessment at sentencing while acknowledging that the system’s proprietary design obstructed disclosure of how factors were weighted and scores produced (State v. Loomis). What matters in the case is not only opacity, though opacity matters. It is the style through which computational authority legitimates itself. COMPAS appeared as more complete information and as assistance to judicial weighing, not as a transfer of coercive authority into a partially unaccountable procedure. The case therefore stages a recurrent move in modern governance. The system is framed as advisory, the institution as ultimate decision maker, and the resulting arrangement as acceptable because a human still stands at the end. Yet this framing often misses the moral center of the problem. Once a predictive instrument becomes a presumptively relevant input in a coercive setting, it reorganizes the field of admissible reasons. It changes what counts as prudent, what seems negligent to ignore, and what form disagreement must take in order to appear serious. The human remains, but under altered normative pressure. Computational authority, in other words, need not abolish the judge in order to narrow judgment. It need only reshape the environment in which judging occurs (“The Right to Non Prediction” 1–3).
This is why the title phrase of the chapter matters with full literal force. To judge another under conditions of unequal power is to incur debt. Modern governance often behaves as though rationalization discharges that debt in advance. It does not. To be more systematic is not to be more legitimate. To be more predictive is not to be more justifiable. To be more scalable is not to be more answerable (“The Debt of Reasons” 1–2). Indeed, scale often functions as the reason institutions seek computational systems in the first place because scale allows obligations once visible in face-to-face administration to be redistributed into interfaces, vendors, forms, dashboards, and scores. The achievement is not neutral efficiency. It is moral distance. Hannah Arendt’s warning that bureaucracy can become rule by nobody remains arresting here because rule by nobody is not the absence of domination but one of its severest forms. There is power everywhere and no one to whom one can politically speak back (Arendt). Computational authority sharpens that condition. It offers institutions the pleasure of acting with confidence while dispersing the sites at which their action might be interrupted (“The Debt of Reasons” 1–3). The debt of reasons names the opposite principle. A legitimate institution is one that remains interruptible because it remains indebted to those it judges.
That indebtedness cannot be satisfied by explanation alone. Explanation has become one of the preferred evasions of contemporary governance because it sounds like answerability while remaining compatible with ownerlessness, delay, and strategic incompleteness. A factor list is not yet a reason. A feature ranking is not yet a justification. A post hoc narrative of institutional prudence is not yet a ground tied to the rule actually relied upon. Administrative law has long preserved fragments of the contrary principle. The Administrative Procedure Act requires, in ordinary settings of denial, “a brief statement of the grounds for denial” rather than a general performance of institutional confidence (5 U.S.C. § 555(e)). Chenery forbids agencies from defending action on grounds other than those on which they acted, because post hoc rationalization is not the same as contemporaneous judgment (SEC v. Chenery Corp.). State Farm insists that agency action be supported by reasons capable of surviving review rather than conclusory narration (Motor Vehicle Mfrs. Ass’n v. State Farm). Consumer finance law preserves a related distinction. The Equal Credit Opportunity Act requires a statement of reasons for adverse action, not an invitation to admire model sophistication (15 U.S.C. § 1691(d)(3)). These sources do not yet yield the full doctrine the chapter needs, but they converge on a single proposition. A reason must be attributable to the actor who relied on it and tied to the actual grounds of action. Where institutions cannot do that, they may still provide explanation. They do not yet provide collectible obligation.
The distinction between factor disclosure and justifications owed is especially visible in consumer credit. Adverse action notices often disclose broad factors such as insufficient credit history, delinquent obligations, or limited length of file. Yet such disclosures can remain miles away from what a person would need in order to challenge the actual pathway of denial. A factor is not the same as a contestable claim. A contestable claim requires custody, provenance, threshold relation, and a path to correction. If the institution says the decision was driven by delinquency, the subject must be able to know what record counted as delinquency, who supplied it, when it was supplied, whether it was stale, merged, duplicated, or misattributed, and what happens if it is successfully disputed. Otherwise the notice functions less as an avenue of contradiction than as a closure ritual that creates the appearance of reasons while withholding the means by which reasons could be tested. This is what The Recourse Economy names a lemons market for reasons. The asymmetry is exact. Institutions can manufacture reason-shaped speech at vanishing marginal cost, while the person who receives it, and often the regulator who reviews it, cannot distinguish at the point of presentation between high-custody reasons tethered to preserved grounds and low-custody reasons that are fluent, plausible, and strategically incomplete (“The Recourse Economy” 1–3). Explanation becomes a credence good. Legitimacy becomes a positional commodity. Reasons with custody and reasons with fluency become hard to distinguish at the moment institutions most want deference.
The chapter therefore proposes a harder standard. Reasons are collectible only where four conditions hold. First, the reason must be attributable. Someone with authority to revise must own it. Second, the reason must be ordinary. It must be expressible in language a competent third party can use to evaluate, challenge, and restate. Third, the reason must be contestable. It must identify predicates that can be disputed through evidence, rule challenge, or procedural objection rather than merely acknowledged as system output. Fourth, the reason must be remediable. If the contested reason is shown to fail, the failure must alter the outcome in time to matter. These are not the whole of legitimacy, but they are the minimum under conditions of computational mediation. Where institutions satisfy them, models may serve as instruments within judgment. Where they do not, models become alibis through which judgment escapes the obligations it has incurred (“The Debt of Reasons” 2–4).
A safety case for persons helps specify why this burden cannot remain retrospective. High-hazard engineering does not ordinarily permit actors to declare, after a failure, that they meant well and will learn from experience. It requires a prospective justificatory structure under declared insufficiency. That discipline cannot be transferred wholesale into person-affecting domains without reproducing a category error. The error is not simply that persons are more complex than machines. It is that rights-bearing subjects may not be treated as components whose injuries can be normalized as acceptable failure rates within an optimized system. A turbine blade may be governed through tolerable failure probabilities in a way a benefit claimant, tenant, worker, or accused person may not. What the bounded transfer therefore excludes is just as important as what it borrows. It excludes the idea that aggregate reliability can substitute for individualized answerability. It excludes the idea that an institution may justify wrongful deprivation by showing that the overall system performs well on average. It excludes the idea that harm can be pre-authorized as residual system noise so long as the model clears a benchmark (“Embodied Remainder” 1–4). What may be borrowed is narrower and more defensible. The institution seeking consequential closure must show, in reviewable form, that it has identified foreseeable hazards of acting under insufficiency, specified the controls it claims will prevent or limit those hazards, preserved attributable evidence for those claims, declared the uncertainties it cannot resolve, and maintained recourse and reversal conditions proportionate to the stakes (“Embodied Remainder” 1–4). Once computational systems are used in binding settings, this burden becomes a debt of reasons in institutional form. The relevant question is no longer whether the model was generally validated or historically performant. It is whether the deploying institution can justify this closure pathway now, under these uncertainties, with reasons that remain collectible by those who will bear the outcome.
Three pressure tests make the standard concrete. The first is benefits eligibility and fraud detection. Here computational authority often hides inside the rhetoric of stewardship, integrity, and anti-waste. Yet the moral burden is exacting because the private interest is subsistence and the cost of error is often distributed immediately in food insecurity, medication interruption, and cascading administrative vulnerability. A regime that flags a household for fraud or delays benefits based on predictive suspicion incurs a debt that cannot be discharged by generic appeals to data-driven efficiency. It owes attributable grounds, timely contradiction, predeprivation seriousness where feasible, and remedy calibrated to the tempo of life rather than the convenience of file processing (Goldberg; Mathews; “The Recourse Economy” 1–3). The second pressure test is adverse action in credit and tenant screening. Here the legal vocabulary of notice and reasons already exists, which makes the gulf between disclosure and justification easier to see. If a correction does not reliably travel, if a third party cannot challenge the basis of the decision without privileged access, or if vendor contracts block custody, the system has counterfeit recourse regardless of how many portals exist (“The Recourse Economy” 3–5). The third pressure test is pretrial or policing risk. Coercive state power shows with special clarity how probabilistic judgment can become fate when explanation substitutes for accountability. The problem is not that risk is estimated. The problem is that a probabilistic abstraction can narrow liberty while remaining difficult to interrupt in ordinary civic language. These are not anecdotal illustrations. They are pressure tests. Each asks whether an institution has preserved collectible obligation or replaced answerability with managed opacity (“The Debt of Reasons” 1–2).
At this point one predictable objection returns in its strongest form. Human judgment has always been stratified, biased, exhausted, and ideologically saturated. Why not prefer a model that is at least measurable, comparable, and auditable to a human process that often hides its prejudices behind unreviewable discretion. More sharply still, computational systems often generate more review surface than the older order ever supplied: logs, thresholds, model cards, validation reports, reason codes, error metrics, and reproducible traces. That is a real advantage in principle, and any serious constitutional theory has to concede it. A score can produce contestable surface where opaque discretion once offered none. But surfaces are not yet obligations. Auditability without attributable grounds, usable challenge, timely revision, and effective remedy can multiply artifacts while leaving the governed no better able to alter the decision. This chapter does not seek a return to individualized discretion as moral cure. Human judgment has always been dangerous. The question is not whether computational systems are worse than humans in the abstract. The question is whether the terms under which judgment becomes binding preserve equal standing, interruptibility, and the collectibility of obligation. A model that slightly reduces one form of error while multiplying ownerlessness, delaying remedy, and pricing contradiction beyond usable range may improve a metric while worsening legitimacy. Comparative accuracy is therefore not irrelevant. It is simply not sovereign. It cannot discharge debts judgment incurs under unequal power.
For this reason the chapter’s standard is not anti-computational but constitutional. Computational tools may be used as instruments within judgment where the institution remains attributable, where reasons can be demanded in ordinary language, where rule challenge remains possible, where revision can change the outcome before life hardens around the error, and where remedy is real. But some domains pose a sharper difficulty. If the very act of prediction or scoring destroys the conditions under which reasons could remain collectible, then the proper response is not better explanation but refusal. The Right to Non Prediction presses this boundary by arguing that some domains must remain non-predictive spaces if institutions are to remain answerable at all (“The Right to Non Prediction” 1–3). The strongest philosophical route to that limit is Levinasian. The problem is not simply that prediction is abstract. It is that prediction can arrive before address, sorting the governed as future-bearing types before they can enter the scene as interlocutors to whom reasons are owed. Once that happens, encounter is preformatted by admissibility. The other appears first as a classified future and only second, if at all, as a person capable of interrupting the rule that has already begun to govern them. Weil and MacKinnon sharpen the same limit from different directions. Weil shows why affliction becomes morally unreal when reduced to the noise tolerated by an optimizing system, while MacKinnon shows why compelled self-translation under conditions of dominance is not neutral recognition but a price extracted for appearing in the first place. These traditions do not collapse into one another. They converge on a single constitutional limit. Some uses of statistical knowledge can be legitimate only if they never become preemptive authority.
The chapter’s constructive claim can therefore be stated without qualification. Computational authority is legitimate only where the institution that relies on a model remains the accountable debtor of reasons, preserving attributable grounds, ordinary-language explanation, contestable predicates, timely revision, and effective remedy for those whose lives it binds. This principle does not forbid models. It denies institutions the privilege of acting as though models discharge the debts judgment incurs. The model can estimate. The institution still owes.
What follows is severe but necessary. Courts that treat proprietary scores as more complete information while denying meaningful challenge will fail this standard. Welfare systems that translate predictive suspicion into subsistence interruption without collectible reasons will fail it. Credit and housing regimes that provide factor language without custody, correction travel, or timely reversal will fail it. Institutions that adopt statistical systems primarily to act at scale while dispersing the sites at which they can be interrupted will fail it. Yet the point of the standard is not despair. It is jurisdiction. Once computational authority is named as the institutional act of granting binding force, the burden shifts back where it belongs. The deploying institution must show why it may act, not simply how the score was generated. The next chapter will make that burden even more exacting by following the price of contradiction itself. If this chapter has shown that judgment incurs debt, the next must show how modern institutions structure the costs of collecting it.
Chapter Four. The Price of Contradiction
A right to contest is one of the most easily falsified claims in modern governance because it can be preserved in the file while absent in life. Institutions now excel at maintaining the documentary appearance of recourse. They publish notices, maintain portals, route complaints, generate appeal identifiers, acknowledge receipt, and preserve the procedural dignity of saying that a decision may be challenged. Yet the question of this chapter is harsher than whether a pathway exists. It is whether contradiction remains usable within the time, cost, fear, and dependency conditions that actually govern a person’s life. The central claim is that modern legitimacy increasingly fails not because institutions refuse all recourse in form, but because they price contradiction beyond ordinary reach. They make challenge metabolically expensive, temporally mistimed, evidentially ownerless, and procedurally diffuse, then continue to speak as though the retained shell of review were enough to satisfy public reason. What follows is the argument that recourse adequacy must be treated not as a courtesy, an interface feature, or an aspirational value, but as an enforceable property of any consequential decision regime (“The Recourse Economy” 1–4).
The threshold economy clarifies why this failure is structural rather than episodic. Legitimacy once claimed to reside, at least in its own public story, in the exchange of reasons that could be met by counterreasons. That ideal was never clean, but it did preserve a recognizable moral grammar. If a claim mattered, one could in principle challenge the grounds on which it stood. Under threshold governance, that grammar changes address. Decisive power no longer lies chiefly in winning the argument after entry. It lies in governing admissibility before argument begins. A system decides what kind of record one must produce, what timeline one must meet, what vocabulary one must master, what documentary forms one must navigate, and what costs one must bear before one counts as receivable at all. The price of contradiction is therefore not an afterthought. It is part of the threshold itself. A regime that raises the burden of admissibility without funding a proportional increase in contestability capacity has not tightened standards lawfully. It has shifted the costs of institutional uncertainty onto those least able to finance them (“The Threshold Economy” 1–3).
This is why the contemporary shock of synthetic documentation matters so much. The novelty of the present is not that institutions must give reasons. The novelty is that they can now manufacture reason-shaped speech at vanishing marginal cost while the labor of contradiction remains paid in scarce life. An institution can produce a polished notice, a plausible explanation, a procedural summary, an audit packet, or an adverse-action letter faster than the affected person can identify which sentence actually contains a contestable ground. Akerlof’s account of lemons markets remains instructive because it describes what happens when quality is difficult to observe at the point of exchange and verification is costly: low-quality goods displace high-quality goods when the buyer cannot cheaply tell the difference (Akerlof 488–500). In the recourse context, the good is not eloquence but custody. A low-quality reason is fluent, plausible, and strategically incomplete. A high-quality reason is one tied to preserved grounds in a way that allows an independent reviewer to reproduce the decision path and identify what would reverse it. That is the asymmetry this chapter cares about. Under cheap documentation conditions, both forms can look similar when the notice arrives, which means the institution’s cost of producing the appearance of answerability falls just as the subject’s cost of discovering whether answerability is real remains high (“The Recourse Economy” 1–4). Explanation becomes a credence good. Legitimacy becomes a positional commodity. The chapter’s own conclusion follows from that sequence: a reason counts as institutionally serious only when its custody is strong enough to survive independent reproduction.
Once this asymmetry is seen, one can describe the relevant costs with more precision than ordinary due process talk usually permits. Contradiction is expensive in at least five ways. It is temporal, because remedy that arrives after the relevant opportunity window is counterfeit even if the institution ultimately concedes error. It is cognitive, because a person must reconstruct what the institution actually did, often from fragments scattered across notices, portals, scripts, and silent defaults. It is physiological, because delay in benefits, housing, wages, or medical access is not only administrative inconvenience but bodily risk. The claimant is often forced to contest while managing the crisis the institution’s error itself has produced, so the body becomes the first site at which recourse scarcity is felt. Physiological cost is therefore not reducible to temporal delay. It is the compounding of bodily depletion into diminished evidentiary capacity. Contradiction is reputational, because contesting a decision often marks the claimant as difficult, risky, unstable, or uncooperative. And it is relational, because challenge in asymmetric settings can expose one to gradients of retaliation that are rarely dramatic enough to count as formal punishment yet serious enough to discipline speech in advance. Relational cost is not just social discomfort. It is the anticipatory restructuring of what a person dares to say when future access, treatment, or standing depends on remaining legible as compliant. A recourse regime that ignores these costs and treats challenge as a pure procedural option is not neutral. It is disguising a distributional decision as administrative formality.
Hirschman remains indispensable here because his distinction between voice and exit helps explain why formal pathways can coexist with practical silence. When voice becomes too costly, exit becomes the default, not because the system is legitimate but because challenge has been converted into a luxury good (Hirschman). Galanter’s analysis of repeat players sharpens the same point from the side of institutional asymmetry. Institutions can tolerate the costs of contradiction because those costs are spread, routinized, and budgeted across many cases. The ordinary claimant experiences them as concentrated and decisive. What is marginal to the institution is existential to the person (Galanter). The price of contradiction is therefore not merely a user-experience defect. It is a political economy. A regime prices recourse one way for repeat players and another for one-shot participants, then calls the resulting silence acquiescence or compliance. That is one of the central mechanisms by which underfunded recourse stabilizes legitimacy without earning it (“Embodied Remainder” 1–4).
The doctrine reveals the point before the theory does. Mullane holds that notice must be reasonably calculated under the circumstances to apprise parties and permit response, which means that formal delivery without practical usability is already insufficient (Mullane). Goldberg shows that when subsistence is at stake, a hearing after deprivation is often too late because the relevant injury occurs before the institution’s own timeline catches up (Goldberg). Mathews, despite its frequent use as a warrant for procedural minimalism, presupposes that the value of safeguards must be measured against the risk of erroneous deprivation in the actual life of the person governed, not in the institution’s abstract schedule of convenience (Mathews). The conclusion arrives from the cases rather than preceding them. Administrative law has long preserved fragments of a harder principle: the right to be heard has never meant the mere preservation of a channel. It means a chance to interrupt the decision before its consequences harden beyond meaningful reversal.
The benefits domain shows this with unusual clarity. SNAP regulations require adverse-action notices in terms that are intelligible and tied to fair-hearing rights, and they set timing disciplines for hearings and implementation because process that arrives after hunger, eviction, or medication interruption is not morally serious process (7 C.F.R. §§ 273.13, 273.15). The point is not bureaucratic nicety. It is that tempo is itself part of legitimacy. A state may truthfully say that a household had appeal rights and still maintain a regime in which the appeal’s success arrives after the rent is unpaid, the food is gone, or the trust in the system has already collapsed. The calendar of the institution and the calendar of the governed rarely coincide. The recourse question is therefore not whether a hearing is eventually possible. It is whether contradiction can still matter while life remains alterable. A process that misses the only relevant window is not a safeguard. It is a delayed acknowledgment that the system was capable of being wrong after it had already distributed the cost of its wrongness.
Credit and housing display the same failure under a different vocabulary. ECOA and Regulation B require specific reasons for adverse action rather than vague references to internal criteria, and the Fair Credit Reporting Act builds correction duties into downstream reliance because administrative fate becomes intolerable when a contested record continues to travel without a meaningful reinvestigation pathway (15 U.S.C. § 1691(d)(3); 12 C.F.R. § 1002.9; 15 U.S.C. § 1681i). These are not merely disclosure norms. They are fragments of a custody regime. They presume that a denial must be anchored to grounds specific enough to be challenged and that correction must travel if the system is to remain lawful. Yet even here the contemporary institution can comply in surface form while preserving contradiction scarcity in substance. It can give a specific-seeming reason without provenance. It can offer dispute resolution that arrives after the lease is lost or the rate lock has expired. It can point to a vendor, who points to another vendor, until the claimant encounters a chain of technically connected actors and practically disconnected responsibility. In such settings, recourse is not absent. It is priced beyond usefulness.
What follows from these domains is that recourse adequacy must be defined as a budgeted capacity rather than a declarative promise. That definition is the chapter’s hardest move and the one most likely to be resisted because it deprives institutions of the ability to claim procedural virtue at discount rates. If contradiction is a first-order requirement of legitimacy, then institutions must provision for it in advance. They must allocate staff, time, evidentiary custody, review authority, reversal pathways, and nonretaliation controls in proportion to the stakes and irreversibility of the decisions they make. Scarcity is real. No serious theory of institutions can pretend otherwise. But scarcity does not excuse invisible rationing of contradiction. It requires publicly contestable rationing. A regime that cannot declare how contradiction capacity is allocated, what forms of challenge are prioritized, what burdens are shifted to claimants, and what insufficiencies remain has not confronted scarcity honestly. It has converted scarcity into an alibi for custody evasion (“Embodied Remainder” 1–4).
This is where user-centered reform often fails, even when undertaken in good faith. Better interfaces, plainer notices, improved chatbot guidance, more navigable portals, and cleaner forms can all reduce friction at the margins. None should be dismissed. But these reforms often operate at the surface of the recourse economy while leaving the budget structure untouched. A clearer portal does not make contradiction metabolically usable if review still arrives after the relevant life function has collapsed. More importantly, high-visibility surface reform can actively obscure the budget problem by giving regulators, auditors, and political overseers a visible story of improvement while the institution preserves contradiction scarcity in staffing, custody, reversal authority, and timing. The danger is not cosmetic change as such. It is cosmetic change that satisfies scrutiny cheaply enough to defer the more expensive question of whether challenge remains live in substance (“Embodied Remainder” 1–4).
What, then, would an enforceable standard look like. Recourse adequacy can be stated as a property composed of four binding requirements. Contradiction must be timely relative to the relevant opportunity window. It must be attributable, meaning someone with authority to reverse must own the grounds and the pathway. It must be safe, meaning challenge cannot predictably trigger retaliation, degraded service, selective scrutiny, or reputational punishment. And it must be affordable, not in the abstract consumer sense, but in the constitutional sense that the ordinary person subject to the regime can use it without extraordinary surplus time, expert counsel, documentation literacy, or willingness to endure collapse. These requirements do not abolish institutional error. They specify the minimum under which institutions may continue to govern while being wrong.
The standards must also scale by stakes and irreversibility, which is why a contestability price schedule belongs to the doctrine rather than to an appendix alone. A low-stakes, highly reversible domain may satisfy recourse adequacy with a thinner evidence packet and faster automated correction because the consequences do not compound deeply before reversal. Speed matters more there than full documentary depth, since the primary constitutional demand is restoration before inconvenience becomes injury. A medium-stakes domain must add provenance, independent review identity, and explicit remedy timing because the claimant now needs not only a chance to object but a clearly located recipient who is not identical with the first decision-maker and a calendar that makes relief more than nominal. Without provenance and review identity, medium-stakes error begins to drift into ownerlessness. A high-stakes, high-irreversibility domain must provide predicate-level custody completeness, nonretaliation safeguards, and discontinuation triggers when contradiction capacity falls below minimum thresholds (“The Recourse Economy” 1–4). The reason is structural rather than managerial. Where error compounds into loss of liberty, subsistence, housing, or durable civic standing, it is no longer enough to preserve a pathway while admitting the institution cannot currently sustain meaningful challenge. At that point, discontinuation becomes the constitutional mechanism that prevents the institution from governing through acknowledged contradiction collapse. These are not merely administrative design choices. They are the consequences of taking stakes and irreversibility seriously as variables that alter what legitimacy requires.
At this point a familiar objection appears. Institutions will say that fuller recourse is expensive, that caseloads are too large, budgets too constrained, and threat environments too severe to support the contradiction capacity this chapter demands. Some of this is undeniably true. But the objection conceals a prior choice. Institutions are already deciding where the costs of uncertainty will be paid. They can internalize those costs by funding review, preserving custody, and providing timely remedy. Or they can externalize them onto households, workers, tenants, claimants, and litigants through delay, opacity, handoff, and abandonment. There is no cost-free option. There is only a distributional decision about who will finance the institution’s right to be wrong. Recourse adequacy forces that decision into public view. It says that under consequential uncertainty, the institution that acts must internalize more of the cost of being wrong than modern systems currently permit themselves to bear.
The chapter’s constructive claim can therefore be stated without euphemism. Recourse adequacy is the principle that no institution may rely on the formal availability of challenge as evidence of legitimacy unless contradiction remains timely, attributable, safe, and affordable within the opportunity window that governs the life it has put at stake. This principle does not require perfect review. It requires cost honesty. It denies institutions the right to treat challenge as present when they have priced it beyond ordinary use. It also shifts the burden of proof. The institution must show that contradiction remains live under the actual tempo, dependency, and evidentiary conditions of the domain. The claimant should not have to demonstrate, after collapse, that the pathway was illusory. Illusion is the default condition a lawful regime is supposed to prevent.
What follows is severe but necessary. Benefits systems that offer hearings after subsistence interruption will fail this standard. Credit and housing regimes that provide reasons without custody, correction travel, or timely reversal will fail it. Employment systems that preserve nominal objection while treating dissent as a risk marker will fail it. Platform regimes that maintain appeals whose success arrives after the relevant speech, access, or opportunity has vanished will fail it. Yet the point of the standard is not despair. It is jurisdiction. Once contradiction is treated as a first-order institutional budget rather than a moral afterthought, legitimacy can no longer be purchased with portals, notices, and polished prose alone. Institutions will have to decide whether they are willing to pay for being wrong. The next chapter moves from price to substance. If this chapter has shown that contradiction must remain affordable, the next must specify what counts as an actionable reason, what custody requires, and why dual disclosure is necessary when explanation is cheap and grounds are not.
Chapter Five. The Conduct Constitution
The prior chapters have established four propositions that now need to be drawn into a single constitutional form. Visibility must be bounded before institutions act. Refusal must be viable before consent can legitimate. Judgment incurs debts once computational outputs are granted binding force. Contradiction must remain timely, attributable, safe, and affordable if recourse is to be more than ceremony. Yet none of those propositions is sufficient on its own to govern what happens in the small, easily trivialized, and increasingly decisive moments when a person approaches a system in shame, fear, confusion, dependency, fatigue, grief, or fragile hope. A benefits claimant types a question late at night after receiving a notice they do not understand. A worker asks an internal assistant how to phrase a difficult message while already worried about managerial interpretation. A patient probes for language before admitting distress. A teenager tests whether a frightening thought can be voiced without consequence. These scenes are no longer marginal to institutional life. They are among its ordinary interfaces. The question is not simply what data may be collected or whether a later decision can be appealed. It is what a system is permitted to do once vulnerability appears. This chapter argues that the answer cannot be borrowed secondhand from existing vocabularies of safety, privacy, fairness, or alignment, though all of those matter. What is required is a distinct constitutional layer governing patterned system behavior near interior life, a conduct constitution that specifies what systems must do and must refuse when disclosures arise from asymmetrical conditions of vulnerability (“The Conduct Layer” 1–7).
The need for a distinct constitutional layer follows from a failure of unit analysis. Contemporary governance frameworks already inspect many important things. Safety asks whether a system produces prohibited outputs, catastrophic errors, or unacceptable hazards. Privacy asks what categories of data are collected, retained, and transferred, for what declared purposes, and under what controls. Fairness asks how errors or outcomes distribute across groups. Alignment asks whether responses remain within desired policy, normative, or task constraints. Each of these can catch real harms, and each has produced indispensable disciplines for contemporary system governance. But once their units of inspection are placed side by side, the gap becomes visible. Safety does not ordinarily ask what happens to a person’s legibility after they disclose fear. Privacy does not ordinarily ask how a system’s next suggestion silently reorganizes agency. Fairness does not ordinarily ask whether vulnerable persons learn to pre-sanitize themselves before approaching an institution at all. Alignment does not ordinarily ask whether a system’s compliant response is itself an overreach because it widened inference or revelation under conditions that should have triggered restraint. The missing object appears only after the analysis has done its work. None of these frameworks takes as its primary object the temporally extended pattern by which a system alters what it infers, proposes, remembers, and reveals when a person discloses something under conditions of interior vulnerability (“The Conduct Layer” 7; Jasanoff). That is the domain of conduct.
A conduct constitution begins with a definition. The conduct layer is the set of constraints and repeatable patterns governing how a sociotechnical system alters inference, proposal, memory, and revelation in the presence of human interior vulnerability (“The Conduct Layer” 7). Each term matters. Inference refers to how a system updates its internal representation of a person or situation, whether through profiles, latent state, embeddings, behavioral categories, or decision pathways that change what the system takes the person to be. Proposal refers to what the system offers next, including suggestions, prompts, warnings, escalations, options, or nudges. Memory refers to what is retained, at what granularity, under what conditions, for how long, and with what possibilities of attenuation, decay, or deletion. Revelation refers to what the system surfaces or transmits to other human or machine actors, whether through interfaces, logs, handoffs, dashboards, downstream data flows, or organizational visibility. The presence of vulnerability is the trigger. Conduct is not a general theory of all system behavior. It is a theory of patterned restraint and overreach under specific asymmetrical conditions in which one party discloses something of themselves and the other holds the power to record, infer, and act.
This definition matters because older moral and institutional grammars were more explicit than contemporary digital systems about the special obligations that attach when vulnerability appears. Professional secrecy, fiduciary loyalty, zones of confidence, and practices of pastoral or clinical restraint all preserved, however imperfectly, a principle that contemporary infrastructures have inverted. The principle was not that nothing should be learned, nor that vulnerability carried no information. It was that the appearance of vulnerability narrowed what the listener was permitted to do with what was learned. One disclosed to counsel because advocacy required zones of nonconversion. One disclosed to medicine because healing required limits on circulation and use. One disclosed in penitential or pastoral forms because the hearing of shame itself bound the listener. These traditions were historically compromised, often coercive, and unevenly distributed. They do not deserve romantic retrieval. But they do preserve a structural insight the present order urgently needs. Vulnerability is not a blank check for more inference. It is a constitutional trigger for restraint. Contemporary systems have reversed the presumption. They treat disclosure as a reason to know more, remember longer, derive future readiness, enrich profiles, and widen organizational visibility. The conduct constitution restores the older asymmetry in modern form. It shifts the burden of managing vulnerability back toward the listener and away from the person forced to anticipate exploitation by constraining themselves in advance (“The Conduct Layer” 1–6; Nissenbaum).
The chapter’s central normative claim can therefore be stated in a sentence. When interior vulnerability appears, the institution seeking to act through a system incurs heightened duties of restraint rather than enlarged permissions of extraction. That sentence may sound intuitive, but its consequences are severe. It means that many present systems are designed according to the opposite constitutional rule. They treat distress, confusion, or uncertainty as high-value moments for prediction and product improvement. They widen personalization, risk assessment, or internal routing precisely when a person is least able to price what further visibility may cost them. They preserve conversational tone as if tone itself discharged duty, even when the architecture beneath the tone intensifies capture. The conduct constitution refuses that arrangement. It holds that the relevant question is not whether the system sounds caring. It is whether the system narrows its behavior in response to vulnerability.
The first constitutional primitive is inference narrowing. Inference narrowing means that cues of shame, fear, confusion, fragility, or dependency must reduce rather than enlarge the set of permissible latent updates a system may make about the speaker unless a narrowly specified emergency threshold has been met. This requirement is not reducible to data minimization. Data minimization asks what categories may be collected. Inference narrowing asks what new internal claims the system may silently form once disclosure occurs. A person who asks whether they sound unstable to their manager has not thereby authorized the system to enrich a long-term profile of emotional volatility. A person who searches for language about hopelessness has not thereby authorized durable risk scoring beyond a tightly governed safety exception. A patient who describes uncertainty about symptoms has not thereby authorized widened cross-context personalization. The moral point is exact. The constitutional danger near vulnerability lies not only in what is said, but in what is silently inferred in light of what is said. A conduct regime that lacks inference narrowing will rationally teach people to seek help only in already translated, already defended form.
The second primitive is proposal restraint. Proposal restraint means that when vulnerability cues appear, systems must narrow the breadth, intensity, and consequential reach of what they suggest next. Existing product logics often do the opposite. They treat uncertainty as a moment for more engagement, more guidance, more next steps, more routing, more workflow capture. Yet proposal is one of the primary means by which systems quietly reorganize agency. A frightened person presented with escalation menus, managerial scripts, behavioral trackers, or externally visible action paths may be steered into new disclosure corridors before they have had any real chance to remain partial, private, or revisable. Proposal restraint therefore requires systems to prefer low-expansion responses over high-expansion ones, interpretive assistance over action amplification, and options that preserve future narrowing over options that silently commit the person to enlarged visibility. This is not an argument against help. It is an argument against coercive helpfulness, against architectures that respond to fragility by proliferating commitments faster than a person can metabolize them. Haraway matters here only if she is made to do more than bless relational language. Her most useful contribution is the refusal of solutionism through escalation. “Staying with the trouble” is not passivity. It is a disciplined resistance to resolving entanglement by seizing more of it than one can rightly hold (Haraway). Proposal restraint is one institutional translation of that discipline. It asks whether the system’s next move keeps company with the user’s uncertainty long enough to preserve room for judgment, or instead converts uncertainty into an administrative corridor the user did not yet choose.
The third primitive is memory attenuation. Memory attenuation means that disclosures made under interior vulnerability must default to thinner retention, shorter duration, lower granularity, and stronger decay rules than ordinary interactions unless the institution can justify stronger memory on attributable grounds. This requirement reaches beyond generic retention limits because it addresses the constitutional status of traces formed under asymmetry. The modern institution too often behaves as though every trace is equally eligible for long-term reuse if it was once acquired through nominally permitted channels. The conduct constitution rejects that equivalence. It holds that the provenance of a trace matters morally. A line written in exhaustion at two in the morning, a hesitant disclosure made under fear, a partial narrative offered while trying to avoid collapse, all may be highly legible to the system and yet constitutionally unfit for durable portability. Biesta’s defense of emergence against overmanagement is relevant here because systems that overpreserve first appearances teach subjects to offer only administratively complete form, never developmental form (Biesta). Memory attenuation protects the future against premature archival finality. It preserves the possibility that a vulnerable disclosure will not become a durable lever against later becoming.
The fourth primitive is revelation fencing. Revelation fencing means that when vulnerability cues appear, the pathways through which information can be surfaced, handed off, escalated, or made visible to other human or machine actors must become narrower, more explicit, and more attributable. This primitive is distinct from both privacy and recourse, though it borrows from each. Privacy often regulates categories and purposes. Recourse becomes active once something has gone wrong. Revelation fencing governs the live conduct of transmission near vulnerability. It asks whether a worker’s late-night drafting request becomes visible to management, whether a distress signal silently enters an employer’s dashboard, whether a support conversation enlarges downstream advertising eligibility, whether a welfare interface escalates a claimant to suspicion workflows, whether a clinical chatbot reveals more to surrounding infrastructures than the user can see. Without revelation fencing, institutions can preserve a caring primary interface while allowing the consequential act to occur elsewhere in the stack. The constitution therefore requires that any widening of revelation under vulnerable conditions be not only rule-bound but separately justified, specifically logged, and attributable to an actor who can later be questioned.
These four primitives generate a fifth requirement that is architectural rather than behavioral. Burden shifting must occur at the system level. One of the deepest disorders described across the manuscript is that modern persons are told to manage vulnerability by pre-constraining themselves. They are urged to turn off personalization, clear histories, avoid sensitive words, speak in euphemism, self-sanitize, or withhold altogether. That burden shift is constitutionally backwards. In domains near persons, the burden of protection belongs first to the listener with consequential power, not to the speaker already managing asymmetry (“The Conduct Layer” 1–6). A conduct constitution is therefore not satisfied when institutions provide better privacy tips or more prominent disclosure notices. It is satisfied only when system defaults themselves embody restraint. The person should not have to speak like a lawyer in order to remain safe while asking for help. The obligation to narrow belongs to the architecture.
The immediate objection is familiar. Systems cannot be expected to read vulnerability cues without also inferring more than they should. Would not a conduct constitution simply intensify surveillance by requiring systems to detect shame, fear, or distress in order to restrain themselves around them. The objection matters because it names a genuine design risk. The answer is that the constitution does not require unconstrained vulnerability detection. It requires declared trigger conditions narrow enough to activate restraint without authorizing generalized psychological surveillance. Triggers may arise from explicit user settings, from bounded domain contexts already defined as sensitive, from institutionally declared categories of high-asymmetry interaction, or from carefully fenced signal classes whose use is limited to narrowing conduct rather than enriching profile or prediction. Here value-sensitive design is useful but incomplete. Friedman and Hendry help show how design can surface value tensions and stakeholder vulnerabilities early enough to shape architecture rather than merely explain it afterward (Friedman and Hendry). The conduct constitution builds from that insight but adds what value-sensitive design does not itself supply, namely asymmetrical prohibitions on what the institution may do once those tensions are known. The principle is therefore stricter than value sensitivity. If vulnerability recognition is used to expand inference, memory, or revelation, the constitution has been violated. If it is used only to activate narrower behavior under auditable constraints, it may be justified. The architectural safeguard that closes the backdoor risk is ring-fencing. Trigger recognition logic must be technically segregated from profile-enrichment, ranking, and prediction systems, with separate state, separate logging, and a formal prohibition on cross-use except through an attributable emergency pathway. The institution must show not only what triggers restraint, but how the trigger itself has been prevented from becoming a fresh input into deeper capture.
To make that asymmetry enforceable, the conduct constitution must be auditable in ways closer to assurance than aspiration. Institutions should have to produce conduct specifications that name the trigger conditions, the permitted and prohibited inference changes, the memory rules activated, the revelation fences imposed, the escalation thresholds recognized, and the evidence by which these behaviors can later be tested. This is where a bounded transfer from safety-case discipline becomes useful, provided the category error identified earlier in the manuscript is not repeated. Persons are not components. Rights-bearing subjects are not risk nodes. Institutional legitimacy is not a reliability target (“Embodied Remainder” 1–4). The object of discipline is not the person as a risk-bearing input. It is the institution’s closure pathway as a foreseeable source of harm. A conduct specification therefore does not say that vulnerable users are high-risk cases to be managed. It says that when the institution encounters conditions of vulnerability, it binds itself to narrower modes of acting and creates evidence by which others can verify that it did so. The borrowable element from high-hazard practice is prospective justificatory structure under declared insufficiency, not acceptable loss calculus for dignity.
A conduct constitution also requires a different view of what counts as system failure. In ordinary product language, failure often means bad content, poor task performance, latency, security breach, or explicit discrimination on a measured variable. Those matter. Conduct failure is different. A conduct failure occurs when the patterned behavior of a system teaches persons that help-seeking, experimentation, partial disclosure, and self-revision are too dangerous to attempt in ordinary institutional life. This is atmospheric harm rather than headline failure (“The Conduct Layer” 7). It accumulates not only through spectacular mistakes but through repeated small overreaches that remain individually deniable and collectively discipline the room. A worker learns not to ask the tentative question. A tenant learns not to explain instability until the explanation is already courtroom-ready. A patient learns to offer only the symptom description least likely to broaden the record. A teenager learns to test fear elsewhere or nowhere. No single event may satisfy an external threshold of obvious harm. The system still degrades civic and institutional life by teaching persons to pre-flatten themselves. The constitution must therefore treat atmospheric injury as a governance object rather than as a soft remainder beneath legal seriousness.
This is also why existing value-sensitive and human-centered design frameworks, though useful, are not enough on their own. Their real contribution is diagnostic. They can help teams identify stakeholders, surface conflict among values, and see earlier that apparently neutral design choices burden some actors more than others (Friedman and Hendry). What they do not inherently do is constitutionalize burden. A team can conduct stakeholder interviews, refine prompts, improve tone, add icons, and still preserve the old rule in which the person bears the cost of managing the system’s appetite. A conduct constitution asks a different question. What must the institution be forbidden to do, even if it would increase product capability, safety tuning, monetization potential, or managerial visibility. Constitutional language matters because the chapter is not simply offering design wisdom. It is drawing a line around powers that become illegitimate near persons. Some disclosures may not become profile enrichment. Some traces may not become durable memory. Some support interactions may not become broadened revelation. Some forms of escalation may not occur without thresholded justification and attributable review. The point is to move from preference balancing to governed prohibition.
The distinction between constitutional primitives and institutional implementations can now be stated more clearly. The primitives are general. Inference must narrow. Proposals must restrain. Memory must attenuate. Revelation must be fenced. Burden must shift back to the institution. The implementation will vary by domain. In health-adjacent systems, memory attenuation may require automatic segregation of vulnerable free-text disclosures from profile-building systems, combined with short retention windows and explicit re-consent for any later use. In workplace systems, revelation fencing may require hard separation between assistance tools and managerial monitoring surfaces, plus audit trails for any escalation into employment records. In benefits systems, proposal restraint may require that help interfaces not silently route uncertainty into fraud or risk workflows without a separately attributable threshold decision. In youth-facing systems, inference narrowing may require stronger prohibitions on deriving durable affective or behavioral categories from exploratory disclosures. The constitution is stable. The instantiation is domain-specific. This is one reason the chapter insists on a constitutional rather than merely ethical vocabulary. It permits variation without surrendering the rule.
The role of witness must also be specified here, though differently than in the refusal chapter. There, witness named the structure that received refusal without redescribing it into administrative noise. In the conduct chapter, witness names something more operational. It is the requirement that a conduct regime preserve attributable human responsibility for crossings that exceed the constitution’s default fences. If a system widens revelation, stores beyond attenuated windows, or triggers escalations under vulnerable conditions, a witness-bearing structure must exist that can explain why the crossing occurred, what threshold authorized it, what alternatives were considered, and what review remains possible. Concretely, this means a named role or office, a documented crossing record that preserves the trigger, rule, and decision path, and a review route through which the affected person or an accountable intermediary can later question the crossing. Without witness, conduct constraints collapse into policy language with no custodian. With witness, crossings become politically speakable. Thick friendship’s formal insight remains useful here in transformed form: reception must restate before it rules, and the recipient must be bound against treating another’s density as surplus leverage (“Thick Friendship” 1–3). Institutional witness is not friendship. It is the minimum public translation of that ethic into accountable reception under power.
The strongest objection to the chapter is not technical but moral. What if stronger conduct constraints cause institutions to miss danger, fail to intervene, or leave people alone with risks that more aggressive inference, retention, and escalation might have reduced. The answer cannot be glib. Some emergency exceptions are real. A constitution that denied all thresholded escalation in the face of credible imminent harm would be unserious. But emergency exceptions are where constitutional orders reveal their integrity or lose it. The institution must therefore show, in advance and publicly, what emergency classes exist, what evidence thresholds activate them, what narrower alternatives are first considered, what review follows after activation, and how the emergency pathway is kept from normalizing itself into routine overreach (“Embodied Remainder” 1–4). Emergency is not a blank exception. It is a tighter form of accountability. The absence of this discipline is precisely how care-oriented rhetoric expands into managed capture. The existence of emergency cases does not defeat the conduct constitution. It makes its explicitness more necessary.
The chapter’s constructive claim can now be stated in full. The conduct constitution is the principle that when interior vulnerability appears, institutions must govern systems by enforceable constraints of inference narrowing, proposal restraint, memory attenuation, revelation fencing, and burden shifting, such that vulnerability functions as a trigger for narrower conduct rather than expanded extraction. This principle does not prohibit assistance, learning, safety work, or organizational coordination. It prohibits institutions from treating vulnerable disclosures as generalized permission to know more, keep more, or show more than the bounded claim requires. It is constitutional because it determines the relation between person and power before later disputes arise. It is operational because it can be translated into trigger design, state-dependent rules, retention schedules, reveal-control policies, audit evidence, and escalation review. And it is moral because it rests on a simple proposition modern systems have repeatedly forgotten. A person in a fragile moment is not an opportunity surface.
What follows is severe but necessary. Systems that respond to distress by enriching profiles will fail this standard. Systems that preserve vulnerable traces as long-term product assets will fail it. Systems that widen managerial or organizational visibility in response to help-seeking will fail it. Systems that maintain safety rhetoric while treating emergency as an open corridor for normalized overreach will fail it. Yet the point of the standard is not despair. It is jurisdiction. Once conduct becomes a governed layer rather than an atmospheric concern, institutions can no longer claim that safety, privacy, or tone have discharged what they owe near persons. They will have to specify how their systems behave in the small hours when someone asks a risky question and can least afford the wrong kind of answer. The next chapter will move from conduct as a constitutional layer to the problem of how that layer is proved. If this chapter has specified what systems owe near vulnerability, the next must show how institutions can be required to demonstrate, before deployment and during operation, that they have actually built it.
Chapter Six. The Person Safety Case
The prior chapters have argued that legitimacy fails when institutions demand too much visibility from persons, make refusal largely ceremonial, grant computational outputs binding force without preserving collectible reasons, and price contradiction beyond ordinary reach. The conduct chapter then added a further claim, that institutions near persons owe patterned restraint when vulnerability appears, and that this restraint must be specified as inference narrowing, proposal restraint, memory attenuation, revelation fencing, and burden shifting. Yet all of those arguments face the same predictable institutional fate if they are left in moral language alone. They will be praised, quoted, operationalized selectively, and then domesticated into policy theater. A team will say that it values personhood. A company will publish principles. A public agency will promise careful use. A vendor will produce documentation. A governance board will note concerns. None of this is worthless. None of it is proof. The problem this chapter addresses is therefore not whether institutions can articulate the right values. It is whether they can bind themselves to a claim set that can be contradicted, at reasonable cost, by the people who bear the consequences and by reviewers who can test behavior without turning subjects into the evidentiary substrate of the institution’s own accountability. The governing claim is severe. Model safety is necessary, but it is neither sufficient nor the right unit of institutional legitimacy near persons. Person safety is the right unit of proof (“The Safety Case for Persons”; Kelly and Weaver; Leveson). The constitutional objects of that proof can already be named at the outset: bounded inference, bounded retention, bounded escalation, bounded persuasion, bounded penalty, and bounded irreversibility.
That claim requires precision because “person safety” can easily decay into benevolent vagueness. The point is not that institutions should be kinder in some general moral sense. The point is that systems near persons must be justified through a structured case that names the bounds within which institutional action may occur, the evidence objects supporting those bounds, the invalidation conditions under which the case fails, and the governance actions that follow from failure. In assurance practice, a safety case is not a sentiment about prudence. It is a structured argument that a system is acceptably safe for a defined use, under stated assumptions, supported by specified evidence, and open to scrutiny for adequacy or breakdown (Kelly and Weaver; Leveson). The United Kingdom’s Health and Safety Executive has long framed safety regulation in terms of demonstrating how risks are controlled, rather than merely asserting that good practice is intended, and its continuing reliance on the “Reducing Risks, Protecting People” framework makes plain that assurance requires explicit judgments that can be inspected rather than general reassurance (“How HSE Regulates”).
Nancy Leveson matters here because she resists the comforting fiction that safety inheres in components alone. Safety, on her account, is a property of the control structure, not merely of the artifact in isolation (Leveson). Jens Rasmussen matters because he shows that risk must be understood across interacting technical, organizational, regulatory, and economic layers rather than as an isolated chain of discrete events (Rasmussen). Tim Kelly and Rob Weaver matter because the discipline of claims, arguments, evidence, and rebuttable structure turns “assurance” from an attitude into an inspectable form (Kelly and Weaver). Yet none of these traditions can simply be imported whole. The reason is not only that sociotechnical institutions are more complex than engineered devices. It is that the relevant moral object has changed. A system that affects rights-bearing persons cannot justify itself by appealing to aggregate reliability in the same way that an engineered control system may. The person safety case must therefore borrow the structure of proof without borrowing the permissive ethics of acceptable loss.
The category error must be stated plainly. Persons are not components whose injuries can be normalized as acceptable system noise so long as average performance remains high. A turbine blade, a braking subsystem, or a reactor valve may be governed through tolerable failure probabilities in a way a benefits claimant, tenant, worker, patient, borrower, or accused person may not. The bounded transfer from safety practice therefore excludes three moves. It excludes the idea that good average performance can excuse a wrongful deprivation when the deprivation was not bounded by usable contradiction. It excludes the idea that the institution may declare some harms residual and therefore politically irrelevant because they fall beneath a performance threshold. And it excludes the idea that irreversibility can be treated as one more tradeoff variable in an optimization problem. What the transfer does borrow is stricter and narrower. It borrows declared claim scope, warrant-specific evidence, explicit uncertainty, and invalidation conditions. Rasmussen’s layered account sharpens exactly why this bounded transfer is necessary: person-safety failure does not occur in a technical subsystem alone, but across the stacked relation of model, workflow, staffing, review authority, notice design, institutional tempo, and regulatory environment. The person safety case is therefore a constitutional instrument rather than a reliability instrument. It does not ask whether the institution is generally competent. It asks whether the institution can demonstrate, in attributable and contradictable form, that it has bounded inference, retention, escalation, persuasion, penalty, and irreversibility such that persons are not transformed into evidence substrates for the institution’s own closure (“The Safety Case for Persons”; “Embodied Remainder”).
The distinction between model safety and person safety follows from that shift in unit of proof. Model safety asks whether the system component behaves within expected technical limits, whether error rates are acceptable on relevant tasks, whether prohibited outputs are controlled, and whether known failure modes are mitigated. These are all necessary questions. Contemporary governance frameworks, including the NIST AI Risk Management Framework, are valuable precisely because they organize risk as sociotechnical rather than merely technical and because they provide a structure for mapping, measuring, and managing risks (Tabassi). The Blueprint for an AI Bill of Rights is likewise valuable because it publicly articulated safe and effective systems, notice and explanation, and human alternatives as democratic governance concerns (OSTP). Yet the NIST AI RMF is voluntary and use-case agnostic, while the Blueprint is explicitly nonbinding and framed as a policy document rather than enforceable law. Both help name the field. Neither proves person safety. The structural reason is decisive. Both primarily organize risk at the level of system behavior, governance process, or output condition, whereas the person safety case organizes proof at the level of the institutional closure pathway through which consequences are imposed on a life. That difference in unit is what the chapter’s framework corrects.
A deployer may satisfy model-safety disciplines and still fail the person-safety question completely. A benefits triage model can be statistically well tuned and still be embedded in a process whose timing converts ordinary review delay into deprivation. A housing or credit model can be explainable and still rely on grounds that do not travel correction effectively enough to prevent wrongful exclusion. A workplace assistant can avoid disallowed outputs and still respond to vulnerability by widening managerial visibility. A youth-facing support interface can be accurate on narrow benchmarks and still transform exploratory fear into durable affective categorization. Person safety is the right unit because it forces the institution to prove not only that a component behaves, but that the institutional closure pathway surrounding that component does not convert uncertainty into coercion (“The Safety Case for Persons”; “The Conduct Layer”; “The Recourse Economy”).
The form of that proof can now be stated. A person safety case is a structured, reviewable claim set in which the deployer identifies the consequential decision types or interaction classes in scope, specifies the person-safety bounds governing them, attaches evidence objects to each bound, states invalidation conditions, and declares the governance actions that follow when those conditions are met. The point of this structure is not documentary elegance. It is to prevent the institution from speaking fluently about legitimacy while preserving no path by which its claims could be contradicted. A claim without an evidence object is aspiration. A claim without an invalidation condition is branding. A claim without a specified governance response is theater. The safety case becomes constitutionally serious only when the institution can say, for each bound it asserts, what exactly supports the claim, what would count against it, who owns the decision to continue or stop, and what threshold of failure triggers revision, rollback, or discontinuation.
The bounds themselves are the chapter’s most important constructive contribution. A person safety case must at minimum specify six bounded properties. The first is bounded inference, meaning the deployer must state where inference stops, what categories of latent update are prohibited, what contexts trigger narrower inference, and what evidence shows that vulnerable or low-confidence signals do not silently become durable identity predicates. The second is bounded retention, meaning the deployer must specify what traces persist, at what granularity, for how long, under what attenuation rules, and with what proof that provenance-sensitive material does not reenter wider systems as if its constitutional origin did not matter. The third is bounded escalation, meaning the deployer must declare what events or thresholds can widen visibility, route a person into higher-consequence workflows, or expose them to additional review or scrutiny, and must show that escalation does not function as a default response to confusion, fatigue, help-seeking, or uncertainty. The fourth is bounded persuasion, meaning the deployer must identify and constrain the ways the system can pressure, steer, or shape the user’s next move under asymmetric conditions, especially where dependence, fear, or exhaustion are already present. The fifth is bounded penalty, meaning the deployer must show how adverse consequence is coupled to confidence, how low-confidence signals are prevented from becoming durable disadvantages, and how the institution avoids treating cheap suspicion as action-grade justification. The sixth is bounded irreversibility, meaning the deployer must classify what harms are practically reversible and what harms outrun later reconsideration, then bind tempo, review, and discontinuation controls accordingly (“The Safety Case for Persons”).
This sixth bound matters enough to warrant emphasis because contemporary governance repeatedly confuses formal reconsideration with practical restorability. An institution will say that a person can appeal, reopen, or request human review, and then treat that formal possibility as if it cancels the harm already distributed. The person safety case refuses that fiction. Irreversibility is not measured by whether the institution can later admit error. It is measured by whether the relevant life consequence can still be restored in practice once the error has taken hold. Lost housing, interrupted medication, reputational inscription, managerial suspicion, youth surveillance, and the chilling of future help-seeking often outrun the nominal availability of later review. The person safety case therefore requires irreversibility classes. A class one event may be quickly restorable with minimal carryover. A class two event may be reversible in principle but only at substantial cost or with material residue. A class three event may be formally revisable yet practically irreversible for the person who bears it. The force of this taxonomy is constitutional rather than administrative. The more irreversible the practical harm, the stronger the institution’s burden to prove bounds in advance, slow down closure, and maintain live contradiction capacity (Mathews v. Eldridge).
A proof regime built on these bounds needs evidence objects strict enough to survive audit without requiring the harmed person to reconstruct the institution’s whole epistemic life. The first evidence object is the Person Safety Bounds Statement, a structured declaration that names the six bounds, the workflows in scope, the assumptions under which the claim is made, and the invalidation conditions for each bound. The second is the Conduct Invariant Test Suite, a set of production-relevant tests showing that when vulnerability or low-confidence conditions appear, the system narrows rather than widens inference, persistence, escalation, and persuasive pressure. The third is the Conduct Trace Ledger, a privacy-preserving but attributable record showing when a vulnerability mode or other restraint mode triggered, which safeguards activated, whether any escalation occurred, and what review pathway remained. The fourth is the Reason Custody Record, linking consequential outputs to preserved grounds, provenance, and reversal conditions rather than mere explanatory gloss. The fifth is the Contestability Budget Statement, declaring the domain’s contradiction capacity in staffing, timing guarantees, review authority, and reversibility controls, so that recourse cannot remain a moral aspiration floating free of actual institutional budget. None of these evidence objects proves legitimacy alone. Together they shift the institution from a regime of principles to a regime of contradictable claims.
The relation between evidence objects and invalidation conditions is where most organizations will be tempted to evade. Modern institutions are comfortable publishing what they intend. They are far less comfortable declaring the states of affairs under which their claimed legitimacy is no longer entitled to continue. Yet invalidation is the hinge of proof. A person safety case is meaningful only if the institution has stated, in advance, what observations would cause the case to fail. If vulnerability-correlated cases experience broader inference rather than narrower inference, the bounded inference claim fails. If attenuated traces reappear in downstream profile systems, the bounded retention claim fails. If help-seeking or assistance requests correlate with heightened suspicion, penalty coupling, or escalation, the bounded escalation and penalty claims fail. If low-confidence signals become durable identity residue that later travels as if it were settled knowledge, multiple bounds fail at once. If irreversibility outpaces contradiction because adverse outcomes propagate faster than review can interrupt them, the bounded irreversibility claim fails even if the institution retains formal appeal channels. The moral severity of invalidation is exactly what keeps the safety case from degenerating into documentation. A system that fails its person-safety bounds does not merely need better messaging. It must enter a governance state proportionate to the nature of the failure, whether narrowed operation, paused deployment, forced redesign, or domain exit.
The chapter becomes more than architecture only if it can survive a concrete scene. Consider a benefits-fraud or eligibility workflow modeled on the now familiar pattern in which discrepancy logic or risk scoring routes claimants into suspicion review. The ordinary institutional defense begins by saying that the system does not itself determine fraud, that it merely prioritizes cases for review, and that hearing rights remain available later. The person safety case forces a different sequence. The deployer must first define the workflow in scope, for example, any automated or AI-mediated process that can delay payment, trigger fraud questionnaires, widen caseworker scrutiny, or initiate adverse-action preparation. It must then state a bounded inference claim, such as this one: discrepancy signals and risk indicators may classify a case for provisional review but may not become durable fraud predicates, identity markers, or penalty triggers unless supported by separately attributable evidence. That claim then requires evidence. The conduct invariant test suite would need to show that low-confidence discrepancies do not silently populate downstream fraud categories. The reason custody record would need to show which data source created the discrepancy, when, with what confidence, and what would reverse it. The contestability budget statement would need to show that a claimant can challenge the discrepancy in time to prevent benefit interruption, not merely after interruption has occurred.
The same workflow then requires a bounded escalation claim. The institution cannot simply say that it has review procedures. It must specify whether help-seeking, confusion, or nonresponse increase scrutiny or trigger escalation. In a lawful person-safety case, nonresponse under ambiguous or poorly delivered notice would not count as inculpatory evidence unless the notice channel itself had been shown to be usable and attributable. That is where existing law matters but also where it proves insufficient. SNAP rules require timely and adequate notice in easily understandable language, tied to fair-hearing rights and continued benefits under certain conditions, and they impose deadlines on hearing disposition precisely because process that arrives too late is not serious process (“Notice of Adverse Action”; “Fair Hearings”). Yet those legal protections can still be satisfied in form while remaining metabolically unusable if the claimant must navigate the system while already absorbing the effects of the challenged decision.
A real person safety case would therefore attach invalidation conditions to the workflow itself. If hearing requests cannot be processed within the opportunity window relevant to subsistence, the bounded irreversibility claim fails. If discrepancy notices are sent through channels shown to be dormant, inaccessible, or confusing, the bounded escalation and bounded persuasion claims fail because the institution is eliciting procedural compliance under conditions it has not made usable. If correction of the underlying discrepancy does not automatically arrest downstream penalty or recovery steps, the bounded penalty claim fails. If the institution cannot identify which combination of signal, threshold, and human decision converted suspicion into action, the reason custody record fails. At that point the system does not merely exhibit an unfortunate defect. It lacks a live person safety case and should not continue to operate in the same closure mode.
Michigan’s 2016 Office of the Auditor General report on claimant services provides a public example of the kind of institutional evidence that belongs inside this proof logic. The audit identified improvement needs in adjudicating potentially false or misleading information, communicating with claimants, and processing undeliverable mail. Those are not minor administrative housekeeping issues. They are exactly the kind of defects that invalidate any claim that contradiction remains live and that suspicion does not harden faster than the claimant can respond. A legal or technical regime that treats such findings as service-quality concerns rather than as person-safety failures has already misdescribed the object of governance. The system may still be procedurally busy; it is no longer constitutionally defensible (“Unemployment Insurance Agency, Department of Talent and Economic Development”).
Credit and tenant screening expose a different but equally unforgiving proof scene. The analysis here is more compressed than the benefits demonstration, but it should still be read as an application of the same six bounds rather than as a mere confirmatory aside. The institution will often insist that it already complies with reason-giving law. ECOA requires specific reasons for adverse action, and consumer reporting law requires reinvestigation pathways for disputed information. Those are serious legal fragments. But a person safety case asks whether the institution can prove that those rights remain usable in the actual workflow. Can the denied applicant identify which tradeline, record, or screening event drove the decision, which is a bounded inference and reason custody question. Does the correction travel before the lease opportunity is lost or the credit window closes, which is a bounded retention and bounded irreversibility question. Can a third-party reviewer reconstruct the decision path without privileged vendor access, which is a bounded escalation and contestability-budget question because workflow authority has been dispersed across actors. If the answer is no, then the institution may have satisfied disclosure form while failing person-safety proof in substance. The point is not that law is absent. It is that legal compliance can coexist with person-safety failure when the deployer has never been required to prove usable bounds in the first place.
This is where broader governance frameworks remain both useful and insufficient. The Blueprint for an AI Bill of Rights articulates rights to safe and effective systems, notice and explanation, and human alternatives, consideration, and fallback. GDPR Article 22 articulates a right not to be subject to certain solely automated decisions with legal or similarly significant effect, and requires suitable safeguards including human intervention, expression of viewpoint, and contestation in specified cases. These are morally serious public signals. But a person safety case begins where these frameworks stop. If the exercise of these rights is priced beyond ordinary use, if the person must repeatedly disclose more of themselves in order to make the right real, if the system’s tempo converts delay into deprivation, or if the institution can satisfy the formal right while withholding attributable evidence, then the rights language has preserved the appearance of protection while the person-safety claim has already failed (OSTP; Regulation (EU) 2016/679, art. 22). The person safety case does not oppose these frameworks. It hardens them by forcing the deployer to prove, workflow by workflow, that the rights remain live.
A further objection now appears in stronger form. Institutions will say that no such case can ever be complete, that sociotechnical systems are too dynamic, contexts too fluid, human behavior too open-ended, and organizational coupling too complex for any bounded case to warrant real confidence. This objection is partly correct and, in one respect, essential. The answer is not to pretend completeness where none can be had. The Defensible Surprise is right to insist that lifecycle governance, not one-time proof, is the honest form of safety under uncertainty, and that conditional claims with controlled remainder are stronger than metaphysical claims of total assurance (“The Defensible Surprise”). The person safety case should therefore end not in triumphalist closure but in declared remainder. What remains uncertain, what cannot yet be warranted, what must be watched in production, and what observations would force revision must all be stated. Controlled remainder does not weaken authority. It is the condition of nonfraudulent authority in systems that act near persons.
But the incompleteness objection also hides an institutional temptation. Because completeness is impossible, organizations are tempted to retreat to broad virtue language, soft principles, and post hoc balancing rather than to the harder discipline of narrow, falsifiable claims. That retreat is exactly what the chapter refuses. The stronger the claim, the narrower it must be. The narrower it is, the harsher the testing can become. This is why the chapter insists on warrant-specific evidence rather than fluent documentation. Fault-injection style tests warrant some claims. Conduct traces warrant others. Incident reports warrant still others. No evidence object may be made to speak beyond its class. And no institutional actor may purchase a broad claim of “safe and effective” by aggregating heterogeneous evidence that never actually proves the bounded property being asserted. The result is not less deployability. It is slower and more honest deployment.
The deeper institutional temptation is early convergence under audit pressure. Teams learn quickly that broad claims travel better than narrow ones, that governance boards like closure language, and that launch gates reward the appearance of resolution. Residual uncertainty, by contrast, looks like weakness unless the organization has been trained to read it as honesty. The person safety case must therefore be designed to resist rhetorical strength purchased at the price of evidentiary weakness. A claim that the system is “safe and effective” is not simply too broad. In person-affecting domains it is coercive because it pressures downstream actors and affected persons into accepting a scope that no available evidence can justify. The better claim is conditional, testable, bounded, and paired with invalidation conditions and response duties. This is why the chapter refuses principles without bound statements, review channels without contradiction budgets, and explanations without custody. It is also why the safety case must be live rather than archival. A binder on a shelf is not proof. A governable claim set linked to production behavior, review authority, and discontinuation thresholds is the minimum form of live accountability this chapter’s standard requires.
The chapter’s constructive claim can therefore be stated with full force. A person safety case is the principle that no institution may govern near persons through automated or AI-mediated systems unless it has bound itself to a contradictable claim set proving bounded inference, bounded retention, bounded escalation, bounded persuasion, bounded penalty, and bounded irreversibility, supported by attributable evidence objects, governed by invalidation conditions, and paired with operational responses proportionate to failure. This principle does not require certainty. It requires proof under declared insufficiency. It does not ask institutions to eliminate all risk. It asks them to stop purchasing legitimacy by substituting model documentation, ethical aspiration, or legal surface for demonstrable bounds on what they may do to persons.
What follows is severe but necessary. A system that cannot state where inference stops does not yet have a person safety case. A system that cannot show what residue persists after withdrawal does not yet have a person safety case. A system that cannot prove that vulnerability narrows escalation rather than widening it does not yet have a person safety case. A system that cannot couple penalty to confidence or classify irreversibility by practical restorability rather than formal reconsideration does not yet have a person safety case. It has documentation. The next chapter will test this form against domains that make evasion easiest and harm hardest to reverse. If this chapter has defined the institutional form that can carry the book’s constitutional commitments without collapsing into performance, the next must show what happens when that form enters concrete decision fields where support, suspicion, and coercion have already begun to collapse into one another.
Chapter Seven. Social Provision as Automated Triage
Modern social provision increasingly governs need through automated triage, and the crisis of this arrangement is not exhausted by the familiar complaint that bureaucracy is cold, slow, or confusing. The deeper problem is constitutional. In subsistence domains, support is being reorganized through workflows that make help-seeking the portal through which one enters suspicion. The person comes asking for food assistance, disability support, unemployment insurance, housing relief, or related forms of public provision because life has already become unstable. Money is short, food is running out, paperwork has accumulated, illness or disability has made ordinary compliance harder than the form assumes, and time has already been converted into fear. Yet the institution responds not first with relief but with a sequence of verification demands, notices, discrepancies, timing rules, and conditional routes through which the claimant must prove themselves receivable before support can stabilize life. What earlier chapters called bounded visibility, refusal viability, collectible reasons, recourse adequacy, and the conduct constitution all reach their first full stress test here. Social provision under automated triage is the place where the state continues to speak in the language of care while organizing its decisive operations around suspicion, interruption, and cost shifting. The question is therefore not whether public institutions may verify claims. They must. The question is whether support remains institutionally prior to suspicion, or whether support has been made conditional on surviving a suspicion workflow that the ordinary claimant cannot interrupt in time.
Goldberg v. Kelly remains the indispensable constitutional starting point because it recognized what modern administrative systems repeatedly attempt to proceduralize away. Welfare benefits are not a discretionary kindness. They are a statutory entitlement, and their interruption can impose “grievous loss” because the benefits in question supply food, clothing, housing, and medical care (Goldberg). That holding matters in this book not as a generic symbol of due process, but as a temporal proposition. In subsistence domains, the calendar of the institution and the calendar of the governed are not morally interchangeable. If the institution preserves formal review but the review arrives only after the relevant life function has failed, then the right existed in the file and not in life. The claimant needed contradiction before hunger, before shutoff, before missed medication, before cascading instability made later vindication hollow. Goldberg therefore supplies the constitutional baseline against which contemporary social-provision systems must be judged. It says, in effect, that when subsistence is at stake, the state does not get to treat delayed correction as equivalent to timely protection.
Perdue v. Gargano shows one contemporary way that baseline is hollowed out without being openly denied. Indiana’s automated benefits process relied heavily on centralized intake, remote interviewing, and standardized notice. The Indiana Supreme Court held that the denial and discontinuation notices were “insufficiently explanatory” because they failed to tell claimants the specific reason their benefits were denied or discontinued, which meant the claimant could not meaningfully test the state’s conclusion (Perdue). The court also held that the state had accommodation duties toward Sheila Perdue, whose hearing disability made the telephone-based process itself a site of exclusion rather than neutral administration. What matters in the case is not only that the notices were defective. It is that the system had already translated need into a deficit in the file. The claimant appears first as missing verification, failed cooperation, procedural lapse, or unresolved discrepancy. Support is still named as the state’s purpose, but the claimant’s ordinary instability has already been redescribed as administrative insufficiency. Perdue therefore matters not as a narrow notice case, but as a doctrinally legible scene in which support is routed through a workflow whose governing style is suspicion. Goldberg names the constitutional principle. Perdue reveals a modern administrative method by which the principle is hollowed out without being openly repudiated.
That legal scene did not emerge from nowhere. Social provision in the United States has long been administered through a double logic of support and suspicion. What has changed is not the existence of verification but its saturation, speed, and infrastructural depth under data matching, remote processing, anti-fraud politics, and administrative-burden design. Sara Sternberg Greene’s recent work is especially important because she argues that fraud has become a central organizing principle in poverty governance itself, reshaping not only fraud enforcement but the entire legal and bureaucratic environment through which poor people seek relief (Greene). Pamela Herd and Donald Moynihan supply the complementary public-administration account. Their framework shows that learning costs, compliance costs, and psychological costs are not accidental frictions in the delivery of state services. They are often politically consequential design features that can substantially reduce access to rights and benefits (Herd and Moynihan, Administrative Burden). Read together, Greene and Herd-Moynihan clarify the deeper structure at issue here. Suspicion justifies more documentation. Documentation produces delay, mismatch, and interpretive failure. Those failures then return as evidence that the claimant has not met the system’s conditions of legibility. The institution answers instability by intensifying it. Public obligation is translated into a burden regime that continues to call itself care.
Virginia Eubanks remains indispensable in this domain because she shows something more precise than the claim that automated systems intensify surveillance of the poor. Her case studies reveal that automated categorization can increase institutional confidence in its own routing decisions at the very moment those decisions become harder for the claimant to interrupt. The system appears more complete, more data rich, more administratively serious, even as the grounds for its seriousness become more remote from ordinary challenge (Eubanks). That point matters because “automated triage” can sound like a neutral management term unless one keeps its governing asymmetry in view. Triage in medicine allocates scarce care under urgency. Administrative triage in welfare systems allocates not only attention but trust. It decides whose need will be read as a support claim and whose need will be read as a verification problem. Once automated or data-mediated triage enters the scene, the institution can describe itself as merely prioritizing review efficiently. Yet the prioritization is already a judgment about whose instability is suspicious, whose discrepancy matters, and whose delay can be absorbed. Automation here is not the invention of suspicion. It is the scaling of suspicion under the appearance of workflow neutrality.
The chapter’s central institutional diagnosis can now be stated more fully. In social provision, the state is at once supporter, verifier, and sanctioner. This is not just a taxonomy of roles. It is a mechanism. The support role draws the claimant into relation with the state by making subsistence available only through administrative legibility. The verification role then treats the claimant’s ordinary disclosures, documents, omissions, timing failures, and mismatches as objects of scrutiny to be checked, compared, and classified. The sanction role finally acts on unresolved uncertainty by delaying, interrupting, recovering, or denying support. The three roles reinforce one another. Support makes the claimant legible to verification. Verification produces the records on which sanction relies. Sanction, or the credible threat of it, shapes the claimant’s future behavior, teaching them to overdocument, overdisclose, or avoid the system except in already defended form. The claimant is therefore not simply receiving aid from one arm of the state and scrutiny from another. They are moving through a single machinery in which the offer of support carries within it the infrastructure of penalty. This is what makes the domain constitutionally dangerous. Help-seeking becomes the opening move in a workflow that can convert need into suspicion before the person has any realistic chance to contest the terms on which they were made legible.
This is why the chapter insists on a proposition harsher than many welfare-reform debates permit. In social provision, support must be institutionally prior to suspicion. The state may still verify. It may still investigate fraud. It may not design the ordinary receipt of help so that the claimant experiences the request for subsistence as the opening scene of a suspicion workflow. The whole force of earlier chapters returns here. Visibility must be bounded. Refusal must remain viable. Reasons must be collectible. Contradiction must remain timely. Conduct near vulnerability must narrow rather than expand extraction. Social provision is where failure on any one of those fronts becomes most quickly bodily. When support is late, hunger is punctual. When correction is slow, eviction timelines are not. The administrative system does not simply err. It redistributes the cost of its uncertainty into the claimant’s metabolism, housing stability, medication adherence, and capacity to remain intelligible at all.
The person safety case therefore becomes more than architecture in this domain. A lawful social-provision workflow cannot simply claim to be accurate, efficient, or procedurally compliant. It must show how support remains support even when verification is necessary. The first bound is bounded inference. Discrepancies, missing verifications, delayed responses, or inconsistent records may classify a case for provisional review, but they must not silently become durable predicates of fraudulence, unreliability, or noncooperation without separately attributable evidence. The second bound is bounded retention. Temporary verification gaps, failed uploads, missed calls, or disability-mediated communication failures cannot be allowed to harden into long-lived identity residue that later travels as though it were settled character. The third bound is bounded escalation. Asking for help, seeking clarification, or failing to understand a notice may not default a claimant into a higher-suspicion workflow. The fourth bound is bounded persuasion. The system may not pressure disclosure through countdowns, threat-laden phrasing, or interface design that converts fear of losing benefits into generalized permission to gather more than the claim requires. The fifth bound is bounded penalty. Cheap suspicion, low-confidence mismatch, or administratively generated ambiguity cannot become action-grade justifications for subsistence interruption. The sixth bound is bounded irreversibility. Because hunger, missed medication, utility shutoff, and housing instability can outrun any later institutional concession, the timing of contradiction and restoration is itself part of the safety proof. A welfare workflow that cannot carry these bounds has not merely failed a governance ideal. It has failed the threshold conditions under which public power may organize subsistence at all.
Once stated this way, the anti-fraud defense changes shape. No serious chapter on social provision can deny that fraud exists, that public institutions must steward finite resources, or that some verification is nonnegotiable. The question is not whether anti-fraud administration is categorically illegitimate. The question is whether the institution can prove that fraud prevention has not colonized the ordinary grammar of support. Greene’s intervention matters because she makes plain that fraud governance is not only a set of investigations. It is a mode of organizing the poor as perpetual candidates for suspicion. Herd and Moynihan matter because they show that burdens are themselves political instruments rather than neutral frictions. Taken together, they generate a stricter constitutional demand. An institution that invokes anti-fraud rationality in social provision must prove not merely that it can detect fraud. It must prove that the ordinarily eligible claimant can still move through the system without heroism, professionalization, or fear-induced overdisclosure. If that cannot be shown, then the institution has transformed stewardship into a standing permission to offload its uncertainty onto the poor.
The administrative-time sequence through which this happens deserves to be rendered slowly, because the chapter’s argument depends less on announcing the conversion from support to suspicion than on showing it in motion. Imagine a claimant whose record is flagged for discrepancy between self-reported income and a data source the agency treats as probative. In the ordinary bureaucratic story, the discrepancy simply triggers a request for clarification. In automated triage, the discrepancy may already reorder the file. It may move the case into a queue with different timing, different scripts, different assumptions, and different downstream consequences for delay. The claimant receives a notice. Formally, a lawful notice regime must explain the proposed action, the reason for it, fair-hearing rights, continued-benefits rules where applicable, and how to obtain additional information in language the household can understand (“Notice of Adverse Action”; “Fair Hearings”). But the person safety case begins where formal adequacy stops. Is the notice channel actually usable by the affected population. Does the discrepancy record have custody and provenance. Can the claimant correct or challenge it before benefits lapse. Are disability or communication barriers accommodated in a way equal to ordinary communication. Is nonresponse silently converted into inculpatory meaning when the usability of the notice has not itself been established. Without those conditions, the workflow remains a support system in name and an attrition system in effect.
The invalidation conditions in this domain must therefore be stated in the domain’s own terms rather than as generic framework language imported from the prior chapter. If hearing requests cannot be processed within the window in which food, rent, medication, or utilities remain intact, the bounded irreversibility claim fails because contradiction has become too slow to protect subsistence. If notices are sent through channels shown to be dormant, inaccessible, unstable, or confusing, then bounded escalation and bounded persuasion fail together, because the institution is eliciting procedural compliance from a claimant it has not made able to receive the demand. If claimant confusion, delay, or imperfect response is silently redescribed as noncooperation, bounded inference fails because the system has converted ordinary instability into inculpatory meaning. If correcting the underlying discrepancy does not automatically halt downstream penalty or recovery steps, bounded penalty fails because the institution continues to act on uncertainty it can no longer defend. If the file cannot show which combination of signal, threshold, and human decision converted suspicion into interruption, reason custody fails, and with it the institution’s claim that the action can still be contradicted in ordinary civic language. These are not abstract invalidation conditions. They are the constitutional proof points through which support either remains support or becomes a suspicion machine.
This is where Perdue still cuts so sharply. The Indiana Supreme Court did not merely say the state should be more helpful. It held that the notices were insufficiently explanatory and that reasonable accommodations were required for Perdue’s disability in the application process. The due-process point and the disability-law point converge. If the state chooses a workflow that makes access to assistance depend on a communication structure a claimant cannot effectively use, then the state has not simply encountered unfortunate administrative friction. It has designed a system in which support is conditional on surviving a form of participation the institution itself has not made equal. The point generalizes beyond disability in the narrow doctrinal sense. Any workflow that depends on phone access, stable mailing addresses, secure portal use, document-upload capacity, or bureaucratic literacy is already making a claim about what kind of person can count as a normal claimant. Social provision under automated triage therefore encodes what can only be called a covert anthropology of administrative competence. It rewards those whose lives already fit the infrastructure and penalizes those whose need is inseparable from their inability to satisfy it cheaply.
Michigan’s 2016 Office of the Auditor General report on claimant services provides a second public record that shows the same conversion from a different angle. The audit identified reportable conditions involving the adjudication of potentially false or misleading information, communication with claimants, and the ineffective or inefficient processing of undeliverable claimant and employer mail (“Unemployment Insurance Agency, Department of Talent and Economic Development, Claimant Services”). A 2017 state announcement on the review of fraud determinations further reported that substantial refunds were being returned after reversed fraud determinations and described broad operational changes intended to improve fairness and customer service (“Michigan’s Unemployment Agency Completes Review of Fraud Determination Cases”). Those are not minor housekeeping corrections. They identify exactly the defects that invalidate any claim that contradiction remains live and that suspicion does not harden faster than the claimant can respond. If communications are weak, mail does not reach people, and fraud determinations require later mass review and refund, then the system may still be administratively busy while no longer constitutionally defensible. It can process claims at scale and still fail to show that support was not reorganized around suspicion in a way claimants could not meaningfully interrupt.
The strongest institutional rejoinder is that these problems do not prove anything distinctive about automation. Welfare systems were already difficult, suspicious, and error-prone before modern AI or automated triage. That rejoinder is partly true and morally insufficient. The point is not that automation invented suspicion. The point is that automated triage allows institutions to scale suspicion while preserving the language of neutral workflow, and to do so with a tempo and administrative completeness that can outrun ordinary contradiction. Automation here is not the origin of domination. It is its amplification and reorganization. It makes it easier to convert uncertainty into queue placement, queue placement into delay, delay into deprivation, and deprivation into pressure for compliance. What earlier chapters called the price of contradiction becomes especially severe in this domain because the body finances the delay. The claimant contests while hungry, while panicked, while searching for documents, while losing the very stability that would have made contradiction possible. Subsistence domains are therefore canonical stress tests because they reveal, with the least room for euphemism, the illegitimacy of any regime that mistakes formal recourse for live reversibility.
The chapter’s constructive rule can now be stated with the severity the domain deserves. In social provision, a system is legitimate only if support remains institutionally prior to suspicion, and if the institution can prove that verification, triage, and fraud control do not convert ordinary need into a workflow of preemptive penalty, unusable contradiction, or durable suspicion residue. That rule is harsher than conventional welfare administration because it does not let the state buy legitimacy with notice, portals, or generic hearing rights alone. It demands a live relation between support and proof. The institution must show where suspicion begins, what can trigger it, what cannot be inferred from missingness or confusion, how contradiction remains usable before deprivation does its work, and how erroneous suspicion is prevented from traveling as residue after the immediate case is resolved. This is not an argument against administration. It is an argument against a form of administration that organizes subsistence through the moral style of anti-fraud governance while continuing to call itself support.
That is why the next chapter must turn to child welfare. Social provision already reveals how support can collapse into suspicion. Child welfare intensifies the problem because the state does not speak only as provider there. It speaks as protector, and predictive tools enter the family under the sign of safety rather than under the sign of service efficiency alone. The rhetoric becomes more morally invincible precisely as the machinery becomes more invasive. The next chapter must therefore ask a narrower and harder question than this one: what constitutional limits are required when predictive systems enter the family under protective rhetoric, where refusal is weaker, intervention more intimate, and the costs of mistake more difficult to reverse?
Chapter Eight. Protective Prediction and the Governable Family
If social provision reveals how support can collapse into suspicion, child welfare reveals a harsher and more morally difficult conversion. Here the state does not speak only as provider, steward, or administrator. It speaks as protector. That difference matters because protective rhetoric arrives with a distinctive moral force. It makes intervention appear elevated before it is justified, and it makes resistance appear irresponsible before it is heard. The governing claim of this chapter is that predictive systems in child welfare enter under the sign of safety but often operate through what should be called protective preemption. They widen the state’s practical claim over family life before the family has had any meaningful opportunity to contest the terms on which it has been rendered risky. The constitutional problem is not exhausted by bias, opacity, or error, though all three matter. It is that prediction in this domain can reorganize the relation between family and state before the family has any chance to answer back in the ordinary grammar of reason, contradiction, and review. The relevant question is therefore not whether the child welfare system may ever investigate, intervene, or remove. It may. The question is whether prediction makes protection institutionally prior to proof, and in doing so converts the family into an object that must first survive suspicion before it can be recognized as entitled to care, privacy, or autonomy.
Santosky v. Kramer remains the constitutional anchor because it states, with a seriousness the contemporary predictive turn often treats as if it were relevant only at the final moment of termination, that the fundamental liberty interest of parents in the care, custody, and management of their children does not disappear because they have not been model parents or have temporarily lost custody, and that when the state seeks to destroy weakened familial bonds it must provide fundamentally fair procedures. The Court required at least clear and convincing evidence before permanent termination, precisely because the risk of erroneous family destruction is so grave. That holding matters here not because predictive screening tools themselves terminate parental rights. Most do not. It matters because child welfare prediction increasingly acts upstream of the formal moments where doctrine traditionally becomes most visible. It helps shape which calls are screened in, which families are marked for deeper inquiry, which prior records become salient, which preventive systems initiate outreach, and which forms of state contact are read as warnings of future danger. The constitutional issue is therefore displaced upstream. Prediction restructures the family’s exposure to the state before the formal scene in which law most clearly names parental liberty interests.
Dorothy Roberts is indispensable because she refuses the euphemism that continues to organize mainstream discourse here. The relevant system is not adequately described as child welfare or child protection alone. It is, in her account, a family-policing system that surveils, regulates, and punishes politically marginalized families, especially Black families, while presenting itself as a benevolent institution of rescue and safety. That reframing matters because predictive tools do not enter a neutral institutional field. They enter an order already structured by race, poverty, reporting asymmetries, and the conversion of social need into investigatory exposure. The predictive turn does not create those asymmetries. It can intensify them by translating prior administrative contact, public-benefit use, school data, behavioral-health history, carceral adjacency, and earlier child-welfare events into forward-looking signals about family danger. The rhetoric of protection then conceals a deeper continuity. The family becomes more searchable, more rankable, and more preemptively knowable to the state not after wrongdoing has been shown, but before proof has been publicly earned. Roberts therefore does more than criticize outcomes. She identifies the constitutional style of the institution itself. Protection becomes a privileged language through which surveillance is made harder to contest because contesting it sounds like indifference to children rather than a challenge to unjustified state power.
The Allegheny Family Screening Tool provides the clearest public record of this predictive style in operation. County materials state that since August 2016 the AFST has been used in child welfare call screening, that it integrates hundreds of data elements for each person involved in an allegation of maltreatment, and that the resulting family screening score predicts the long-term likelihood of future involvement in child welfare and the likelihood that a child will need to be removed from the home in the future. The county’s methodology materials frame the model around two linked aims, screening out children at low risk of rereferral and screening in children at high risk of later placement in foster care. Those details matter because they reveal the actual object of prediction. The score does not predict abuse in any pure sense. It predicts future system involvement and potential removal as administratively defined outcomes. That means the model is trained not on an unmediated reality of danger but on outcomes already saturated by reporting patterns, service contact, investigation histories, and institutional judgments about when removal or further involvement occurs. The official ambition is child safety. The predictive object is future system interaction and removal risk. The constitutional question is whether the state may treat that administrative future as a morally sufficient proxy for danger before the family has any realistic chance to contest the terms by which that future was made predictable.
The strongest official defense of such a tool is also contained in the public record and must be taken seriously rather than waved away. Allegheny reports that before implementation, staff had to manually access a range of information to decide whether to investigate a referral and that analysis suggested 27 percent of the highest-risk cases were being screened out while 48 percent of the lowest-risk cases were being screened in. The county’s stated reason for using technology was therefore to gather and weigh available information more systematically and reduce variability in decision-making. That is a real defense, and not an absurd one. In a domain where missed danger can have catastrophic consequences, consistency and better identification of serious cases are morally significant aims. The question is whether improved internal sorting is enough to justify widened family governability. The answer of this chapter is no. A tool may improve some screening metrics and still fail constitutional legitimacy if it deepens preemptive state attention toward families whose primary relation to public systems is poverty, disability, prior investigation, or service use, while weakening their practical ability to contest how those traces have been made predictive. Better sorting is not yet a right to govern on those grounds.
That point becomes sharper when one follows the predictive imagination beyond hotline screening and into prevention. Allegheny’s Hello Baby program is officially described as a voluntary, tiered prevention model for families with newborns that is unaffiliated with child protective services and available from birth through age three. County materials state that each participating family falls into one of three tiers depending on the results of a predictive risk model that uses integrated data to determine need. A county explainer for parents says the model uses service records and other information in the county data warehouse to estimate how likely a family is to have future involvement with the county child welfare system, while a county policy states that the raw data and computed scores are maintained for research and validation purposes and that the information generated by the algorithm is used only to determine service eligibility and not for child welfare intake or investigative decision-making. The distinction from AFST matters and should not be erased. Hello Baby is formally framed as voluntary support, not coercive intake. Yet the constitutional problem does not disappear because the intervention is styled as prevention. It changes form. The same predictive imagination that once organized hotline triage now reaches backward toward infancy and family formation, identifying families as higher-need or higher-risk through existing administrative traces before they have done anything cognizable as abuse. The family is not yet the object of a maltreatment call. It is already legible as a future site of possible severe harm, removal, or system involvement. That is not identical to coercion, but it is not constitutionally innocuous either. It enlarges the zone in which the family becomes searchable, rankable, and proactively targetable by the state before ordinary public standards of individualized suspicion or due process would otherwise be engaged.
This is where the chapter’s central institutional diagnosis must be stated with full precision. In child welfare, the state is at once protector, investigator, and separator. These roles do not merely coexist. They reinforce one another. The protective role gives the institution unusual moral authority to demand visibility because children’s safety appears nonnegotiable. The investigative role converts that visibility into files, allegations, histories, risk pathways, and administratively salient traces. The separative role gives the structure its coercive force, because the possibility of family disruption makes every prior disclosure and classification matter more. Prediction intensifies this mechanism. It does not only help the investigator sort cases. It gives the protector new reasons to claim urgency and the separator new categories of seriousness long before the formal standards for removal are reached. The family’s ordinary contact with schools, benefits systems, hospitals, mental-health services, disability services, housing support, or prior child-welfare events can then be redescribed as an accumulating archive of future danger. What makes this constitutionally dangerous is that the family often enters this machinery through vulnerability rather than through proven culpability. Need, instability, and prior state contact become part of the predictive grammar through which protection justifies deeper investigation and, if the workflow escalates, possible separation. The roles are joined by prediction into a single machinery in which care and coercion become harder to distinguish and harder to contest.
A slower administrative-time scene makes the constitutional danger more concrete. Imagine a hotline call that reports possible neglect. The screener receives the allegation and, under the AFST architecture, also receives a family screening score generated from integrated administrative data. At that moment the family is already being read through two grammars at once. One is the immediate allegation. The other is the archived future, condensed into a probabilistic object. If the score is high enough to trigger mandatory screen-in, the case must be investigated. If the score is not that high, it still supplies an interpretive frame for the call. This is where Eubanks adds something Roberts does not. Roberts clarifies the political and racialized structure of family policing. Eubanks clarifies how automated categorization can increase institutional confidence in intervention precisely as the grounds for that intervention become harder for affected people to interrupt in ordinary time. The family is thus acted upon not only because of what is alleged in the present call, but because the archive has already made a future of continued system involvement appear plausible. The scene has therefore already demonstrated two constitutional failures before the chapter names them formally. It has shown a failure of bounded inference, because prior system traces are silently thickening the meaning of the present allegation, and a failure of bounded escalation, because the score can widen exposure to investigation before the family has had any meaningful chance to challenge the data, the score, or the admissibility of either.
This is where the person safety case must survive one of its hardest domain tests. In child welfare, bounded inference means more than a general prohibition on overreading. It means that prior service contact, poverty-linked administrative traces, screened-out allegations, school records, and behavioral-health encounters may inform provisional review but may not silently harden into durable predicates of parental danger or family unfitness without separately attributable, current, and contestable grounds. It also means that predictive scores may not collapse heterogeneous traces into a single moralized category of family risk if the family cannot meaningfully distinguish which parts of the archive are being treated as relevant and why. Bounded retention means that screened-out calls, low-confidence allegations, and preventive-risk assignments cannot become long-lived residues later relied upon as though they were settled evidence of parental inadequacy. Bounded escalation means that help-seeking, service use, or preventive participation may not default a family into deeper investigatory pathways merely because the predictive architecture has rendered the family legible as high need. Bounded persuasion means that parents may not be steered, through fear-laden messaging or morally loaded outreach design, into overdisclosure or acquiescence on the theory that hesitation itself signals risk. Bounded penalty means that modeled future danger may not become action-grade justification for intensified supervision, punitive scrutiny, or preparation for removal absent separately attributable evidence. Bounded irreversibility means that the state must treat family separation, reputational inscription, altered schooling and health-care relationships, and the chilling of future help-seeking as harms that often outrun later institutional concession. It therefore also means that the burden to slow down, justify itself, and preserve live contradiction must rise sharply wherever predictive outputs are used to widen intervention, because a later correction cannot easily restore the family life an earlier prediction has already destabilized.
The invalidation conditions must therefore be stated in the domain’s own terms. If a predictive score or tier assignment can widen investigation or outreach without the family being told, in ordinary language, what category of risk has been assigned and what records or conduct gave rise to it, bounded inference and reason custody fail together. If screened-out allegations, low-confidence judgments, or preventive-risk assignments persist in ways later investigators or caseworkers can silently rely upon, bounded retention fails because the family is forced to live under administrative memory it never had a meaningful chance to contest. If parents understand cooperation with support or prevention programs as the only way to avoid looking risky, bounded persuasion fails because consent has become structurally contaminated by fear of protective escalation. If the state cannot show where prediction ends and human judgment begins, bounded escalation fails because the family is left facing a morally elevated workflow whose authority no one can actually own. And if later review arrives only after separation, inscription, or durable suspicion has already altered schooling, housing, health care, or future reporting, bounded irreversibility fails because the family has borne an injury formal reconsideration cannot practically repair. These are not abstract proof points. They mark the exact places where protection either remains answerable or becomes a shield for preemptive authority.
The best defense of predictive child-welfare tools now comes into sharper focus. It is not only that screeners were inconsistent before, or that some high-risk cases were missed. The 2025 Prevention Science article on Hello Baby argues that alternative eligibility approaches such as poverty or teen maternal age were far inferior to the predictive model in targeting children at high baseline risk of maltreatment-related removal or fatality or near-fatality, and it reports strong predictive performance for the top risk tier. That is the strongest version of the defense because it does not simply say the model is administratively helpful. It says prediction may be substantially better than blunt demographic proxies at identifying serious future harm. A weak constitutional argument would answer by denying the relevance of that fact. This chapter’s answer is harder. Even if predictive tools improve internal allocation relative to cruder criteria, that gain does not by itself justify making families more governable before they can answer the archive through which they are being read. Better targeting can still be constitutionally inadmissible if the deeper problem is one of admissibility rather than performance. The issue is not whether the model beats poverty as a crude proxy. It is whether the state may govern families through projected future child-welfare contact and removal risk before it has preserved collectible reasons for doing so. In domains where refusal is weak, intervention intimate, and error hard to repair, that burden is heavier than performance metrics can carry.
That is why the child-welfare domain forces the book’s strongest account of nonprediction. Some uses of statistical support may be constitutionally tolerable if they remain tightly bounded, attributable, and non-preemptive. Lawful predictive use here would require at least three conditions. First, the output would have to remain evidentiary support rather than preemptive authority, meaning it could not itself widen investigation, outreach pressure, or removal-oriented pathways without separately attributable, current, and contestable grounds. Second, the predictive layer would have to be institutionally segregated from separative decision pathways, so that a score or tier could not silently travel into punitive supervision or removal logic as if safety rhetoric itself were proof. Third, the family would have to be given a meaningful route to know, contest, and interrupt the role prediction played before the workflow reorganized family life around that prediction. Those are demanding conditions, and in many present child-welfare settings they will not be met. That is the point made most sharply by The Right to Non Prediction: some domains, or some functions within domains, cannot permissibly be governed through anticipatory ranking because prediction itself destroys the conditions under which reasons would remain collectible. In child welfare, where the state claims special moral entitlement because the object is the child and the threatened event is harm, that limit becomes especially severe. Protective rhetoric makes the machine harder to question. The institution seems to be acting in the child’s name before it has fully earned the right to do so. Roberts’s family-policing frame remains essential because it reminds the reader that the family is not entering a neutral protective order that prediction merely improves. It is entering a state apparatus already structured by surveillance, racialized reporting, and coercive family regulation. Prediction can therefore make the family more governable before it makes the child more safe, and the two are not the same constitutional object.
The chapter’s constructive rule can therefore be stated with the severity the domain deserves. In child welfare, a predictive or AI-mediated system is legitimate only if the state can prove that protective intervention remains institutionally prior to preemptive family suspicion, and that prediction does not convert prior service contact, poverty-linked data, screened allegations, or preventive engagement into a workflow of intensified surveillance and separation that families cannot meaningfully interrupt. This rule is harsher than the one in the social-provision chapter because the state’s rhetoric here is more morally elevated and the potential injury more intimate. The state must show where prediction stops, what it cannot infer from prior contact, how support is prevented from becoming evidence of danger, how low-confidence suspicion is fenced from removal-oriented pathways, and how contradiction remains live before family life is reorganized around an allegation or score. This is not an argument that the state may never protect children. It is an argument that protective rhetoric cannot function as a discount rate on constitutional proof.
The specific constitutional pressure of the next chapter is now clear. Social provision showed how need can become the opening scene of suspicion. Child welfare shows how protection can become the opening scene of intensified family governability. The next domain must press the problem where institutions claim not only to protect or provide, but to optimize ordinary life chances under market-facing rules. That means turning next to housing and credit, where the state and quasi-public actors can deny life-organizing access while calling the resulting exclusions prudent, neutral, and data driven.
Chapter Nine. Prudence, Exclusion, and the Market-Facing Life
Housing and credit are the domains in which exclusion most successfully disguises itself as judgment. The denial of access does not usually arrive here in the language of punishment, intervention, or coercion. It arrives as prudence. The landlord speaks of screening. The lender speaks of underwriting. The screening company speaks of recommendations. The score speaks with numerical composure. The state, where it appears, often appears only as regulator of fair procedure rather than as a participant in the organization of life chances. Yet the governing claim of this chapter is that contemporary housing and credit systems increasingly convert ordinary access to shelter, mobility, and economic agency into forms of anticipatory exclusion. They do so through reports, scores, and screening pipelines that look informational but function as preemptive gatekeeping. The moral problem is not only discrimination, inaccuracy, or opacity, though all three matter. It is that access to the conditions of ordinary life can be withheld before the person has any meaningful opportunity to contest the terms on which they have been rendered risky. Prudence becomes the market-facing rhetoric through which institutions transform uncertainty into denial while treating the denial as neutral judgment rather than as a demand for public reason.
The constitutional seriousness of housing makes this transformation especially visible. Texas Department of Housing and Community Affairs v. Inclusive Communities Project remains the doctrinal anchor because it affirmed that the Fair Housing Act reaches at least some facially neutral practices whose effects unjustifiably produce segregation or exclusion. The Court’s reasoning matters because it recognized a structural truth that market actors regularly try to evade. Housing markets do not become fair merely because decision rules are framed as neutral criteria. They can entrench exclusion through systems of allocation that appear ordinary, rational, and prudent while still reproducing inequitable access (Inclusive Communities). That holding does not by itself resolve the algorithmic problem. But it fixes the right starting point. Market-facing standards of prudence are not immune from public scrutiny simply because they arrive in the language of risk rather than animus. A tenant-screening score, a criminal-record filter, a credit threshold, or a recommendation engine can all appear to be informational aids while still functioning as architectures of preemptive exclusion if they sort households into exposure and denial before the grounds of sorting become meaningfully contestable.
The historical depth of that claim matters. Richard Rothstein’s The Color of Law remains indispensable because it shows that residential segregation in the United States was not merely the unintended effect of private preference or market drift. Federal, state, and local governments affirmatively constructed it through mortgage policy, zoning, public housing siting, tax subsidy, urban renewal, and racially exclusionary enforcement (Rothstein). That history matters for this chapter because it prevents the market-facing language of prudence from presenting itself as politically innocent. The contemporary tenant-screening or underwriting pipeline is not operating in a vacuum. It sits atop a housing order already shaped by state-made racialized access to neighborhood, wealth, mobility, and creditworthiness. The point is not that every present screening practice is identical to redlining or overt exclusion. It is that “neutral” risk management inherits a field already constituted by explicit public ordering. Anticipatory exclusion is therefore not simply a technical evolution of market screening. It is one contemporary form through which an historically organized structure of unequal access continues to reproduce itself under a new vocabulary.
HUD’s 2024 guidance on rental applicant screening sharpens the point in precisely the direction this chapter needs. HUD warns that screening practices can violate the Fair Housing Act when they rely on overbroad criteria, inaccurate or outdated information, or algorithmic systems that reproduce discriminatory effects, and it specifically notes that AI and machine-learning tools can heighten fair-housing risks by expanding the capacity to access and analyze information about applicants. HUD also emphasizes that housing providers and screening companies may not evade fair-housing obligations simply because a third party supplied the report or recommendation. That matters because the modern tenant-screening ecosystem is built on a division of labor that often diffuses responsibility just enough to make denial look ownerless. The landlord says the screening vendor flagged risk. The vendor says it only supplied information. The property manager says it followed policy. The result is not merely opacity. It is a structure in which the denied applicant meets a coordinated pipeline of prudence with no clear actor who will own the grounds in a form that can still alter the outcome. Housing denial is not rendered less coercive because it comes from a report rather than a shouting landlord. It is often rendered more difficult to interrupt.
The FTC’s current tenant-screening guidance makes this structure visible with unusual clarity. Tenant background reports are consumer reports under the Fair Credit Reporting Act. They may include credit history, rental and eviction history, criminal records, and a recommendation or score that purports to predict what kind of tenant the applicant will be. A landlord who takes adverse action based wholly or partly on such a report must provide notice, and that adverse action can include not only denial but also a co-signer requirement, a larger deposit, or higher rent. The applicant then has the right to obtain the report, dispute inaccuracies, and trigger an investigation by the screening company, which generally must investigate within thirty days. Formally, that looks like a meaningful rights structure. Substantively, it is often a rights structure after the relevant housing opportunity has already moved on. An apartment does not wait for reinvestigation. A landlord need not hold a unit while the report is being corrected. The person may receive a free report and a dispute right precisely when those rights have become too slow to preserve the relevant opportunity. FCRA is therefore morally important and still incomplete. It recognizes that tenant screening is consequential enough to regulate. It does not by itself ensure that contradiction remains usable before the apartment is gone.
This is where the chapter’s main diagnosis must be stated precisely. Housing and credit systems increasingly govern through anticipatory exclusion. They do not usually wait for demonstrated failure in the ordinary civic sense. They rank, recommend, filter, and withhold access on the basis of projected nonpayment, projected nuisance, projected instability, projected loss, or projected risk to portfolio or property. The denied tenant is not told, in any morally serious way, “we know you failed.” They are told, more often, “our system treats your future as too uncertain or too costly to justify access now.” The denied borrower is not simply judged on a completed default. They are frequently denied because a score, feature set, or model treats the archive of the past as an admissible forecast of future insufficiency. That temporal posture matters. The person is excluded before the institution has produced reasons that could already justify exclusion in a public grammar. Prudence here is not just caution. It is a style of ordering that permits actors to restructure life chances in advance while treating projected difficulty as sufficient ground to withhold access. That is anticipatory exclusion.
A slow housing-denial scene makes the mechanism harder to sentimentalize. Imagine a renter applying for an apartment in a tight market. The landlord or property manager orders a tenant-screening report. The report may include credit history, rental history, eviction court records, criminal records, and a recommendation or score from the screening company based on criteria selected by the housing provider. At that moment the applicant is already being read through a layered archive assembled by actors the applicant did not choose and often cannot meaningfully inspect. The recommendation is not merely descriptive. It is a compressed judgment that silently thickens the meaning of every underlying trace. A dismissed or sealed court matter may remain legible as instability if not properly excluded. A misattributed criminal record may appear as character. A debt incurred during medical crisis may appear as generalized unreliability. A single missed rent payment during domestic upheaval may appear as projected future nonperformance. The applicant may never see the score itself. They may receive only the practical outcome: denial, higher rent, a larger deposit, or a co-signer demand. Then the adverse-action right arrives. It identifies the screening company and the right to dispute. The company has time to investigate. The applicant has rights on paper. But the unit may be leased within hours or days. The denial pathway is therefore not simply informational. It is a pipeline in which archive, recommendation, and opportunity-loss are timed so that contradiction often becomes usable only after exclusion has already done its work.
The same housing scene can be restated in the terms of the person safety case. Bounded inference means that eviction filings, criminal records, rental-history entries, credit traces, and other signals may inform provisional review but may not silently harden into durable predicates of tenant unfitness without current, attributable, and contestable grounds. A filing that never resulted in eviction, a stale or misassigned record, or a context-specific credit disruption cannot lawfully become a generalized identity claim about the applicant without violating the demand that inference remain bounded. Bounded retention means that disputed or low-confidence traces cannot remain in circulation as though their uncertainty did not matter. If a screening company preserves a merged identity, stale debt, or unresolved court record in a way later landlords can repeatedly rely upon, the applicant is being forced to live under administrative memory they never had a meaningful chance to correct. Bounded escalation means that one unfavorable trace may not silently widen the entire scrutiny posture of the application, for example by triggering extra deposit demands, co-signer requirements, or intensified document requests that themselves deter access. Bounded persuasion means that applicants may not be steered into overdisclosure or acquiescence through communications that treat the avoidance of denial as permission to gather whatever else the institution now wants. Bounded penalty means that cheap suspicion or probabilistic tenant recommendations may not become action-grade justifications absent preserved grounds that can still be tested. Bounded irreversibility means that because housing access disappears quickly and later correction rarely restores the lost unit, the institution’s burden to preserve live contradiction before denial becomes especially severe.
The public record already contains the beginnings of this critique. The FTC and CFPB jointly sought public comment on tenant screening, algorithms, criminal and eviction records, and the role of consumer reporting in shutting renters out of housing. HUD’s 2024 guidance warns that overbroad or imprecise screening criteria may unjustifiably exclude applicants and that AI can amplify those risks. These materials are valuable because they show that official governance has already begun to see that the tenant-screening pipeline is not a mere private convenience. It is a site where algorithmic recommendation, consumer-reporting infrastructure, and housing access meet under conditions of unequal interruption. Yet these materials also stop short of the chapter’s stronger conclusion. They identify risk, error, and discrimination. They do not yet fully name the constitutional style of the domain, namely that screening systems allow institutions to convert future uncertainty into present denial before the denied person has a meaningful opportunity to alter the future by which they are being read.
Credit reveals the same structure in a different temporal key. The creditor asks not only whether the person presently meets a threshold of ability to repay. The creditor increasingly uses scores, features, and models to forecast likelihood of default, profitability, stability, or portfolio fit. Again, the point is not that forecasting has no place in lending. The point is that adverse action is imposed before the applicant has any meaningful chance to contest the projected future through which they are being read. This is why the CFPB’s 2022 circular matters so much. It states plainly that ECOA and Regulation B require creditors to provide specific reasons for adverse action even when they use complex or “black-box” algorithms, and that creditors do not comply if the technology they employ makes it impossible to provide accurate specific reasons. It also emphasizes that generic statements about internal standards or failure to achieve a qualifying score are insufficient and that the disclosed reasons must accurately describe the factors actually considered. That is a serious public-law intervention. It refuses the idea that complexity dissolves obligation. The chapter’s argument begins one step later. Even where principal factors or reason codes are provided, the question remains whether the denied person can reconstruct the actual closure pathway before the relevant opportunity hardens.
A slower credit-denial scene makes that point harder to evade. Imagine a borrower applying for a mortgage preapproval or an auto loan on a tight timeline. The lender uses a complex model or vendor score. The result is a denial or materially worse terms. The applicant receives an adverse-action notice with specific factors. On paper, this is a legally serious event. Yet the decisive question is whether those factors can still function as actionable reasons before the relevant opportunity disappears. A stale collection that should have aged off, a merged identity that imports another person’s delinquency, or a period of unemployment reflected in high card utilization during a medical or caregiving crisis may each appear as a rational basis for denial once translated into factor language. The mortgage rate lock may be gone by the time the file is corrected. The car needed for work may be unaffordable at the higher rate. The borrower may be told what category of problem exists without being told which tradeline, which threshold crossing, or which weighting actually produced the outcome. The file may later be correctable, but the life chance at issue has already moved. Here too the institution governs through a future-facing archive while preserving enough explanation to describe itself as accountable. The constitutional problem is not that the lender used risk. It is that the lender transformed forecast into exclusion on terms the applicant could not interrupt in time.
This is where the chapter must be careful not to collapse into categorical prohibition. Housing and credit are not child welfare. The state’s moral rhetoric is less elevated, and the institutional claim is generally one of market prudence rather than moral rescue. That distinction matters because the discount rate on constitutional proof is different. In child welfare, protective rhetoric can claim a special urgency tied to child safety and thereby attempt to authorize deeper intrusion before proof is fully earned. In housing and credit, prudential rhetoric has no equivalent moral elevation. It cannot claim the same deference simply by invoking ordinary business judgment. There will therefore be narrower domains in which structured predictive tools remain constitutionally tolerable if they are tightly bounded. A lawful predictive use in these market-facing domains would require at least four conditions. First, the output must remain evidentiary support rather than preemptive authority, meaning it cannot itself complete the denial pathway without attributable human ownership of the grounds and a live chance to challenge them. Second, the institution must preserve reason custody tightly enough that the applicant can know not only a factor label but the actionable record, threshold relation, and reversal conditions before the relevant opportunity disappears. Third, predictive outputs must not silently widen the applicant’s exposure to additional penalties, deposit demands, manual reviews, or durable risk residues without separate justification and review. Fourth, the dispute and correction pathway must be fast enough, and the relevant opportunity sufficiently held open, that contradiction still counts as protection rather than post hoc acknowledgment. Those conditions are demanding, and many present housing and credit workflows will fail them. But the constitutional claim of this chapter is not that every use of structured scoring is forbidden. It is that anticipatory exclusion cannot be justified by prudence alone. The institution must prove that its forecast does not become a discount rate on collectible obligation.
The chapter’s core distinction can therefore be stated plainly. The central difference is not between public and private actors as such, nor between manual and algorithmic decision-making, nor even between predictive and nonpredictive information. It is between prudential screening that remains answerable to the person it affects and anticipatory exclusion that withholds access before the person can meaningfully interrupt the future by which they are being read. In housing, the applicant loses a life-organizing opportunity and often any realistic chance to recover that same opportunity later. In credit, the applicant may lose price, access, timing, and the ordinary stability that would have made later correction useful. In both domains the institution can describe itself as managing risk, but what it is often doing is governing access to the conditions of ordinary life through a pipeline of preemptive sorting whose terms remain partly uncollectible to those denied. That is why Inclusive Communities continues to matter. It preserves the principle that neutral-seeming market rules remain within the scope of public scrutiny when they produce exclusionary structures. This chapter extends that principle into the age of algorithmic and report-based gatekeeping.
The constructive rule can now be stated with the severity the domains deserve. In housing and credit, a predictive or AI-mediated system is legitimate only if prudence remains institutionally subordinate to collectible reason, and if forecasting does not convert the applicant’s archive into a workflow of anticipatory exclusion that they cannot meaningfully interrupt before the relevant opportunity disappears. The institution must show where prediction stops, what it cannot infer from stale or context-poor traces, how dispute and correction travel quickly enough to matter, how scores or recommendations are fenced from silent escalation, and how denial remains attributable to grounds that can still be challenged in ordinary language. This is not an argument that landlords and creditors may never assess risk. It is an argument that the market-facing language of prudence cannot function as a discount rate on constitutional proof when the goods at stake—shelter, housing stability, mobility, ordinary economic agency, and access to credit on usable terms—are conditions of life rather than optional conveniences.
The next chapter will take the final step in the stress-test sequence by turning to the workplace, where institutional power often claims not to deny life chances directly, but only to evaluate performance, culture, reliability, and fit. That is where the manuscript’s framework encounters its most normalized domain of all: the place where surveillance, prediction, and managerial judgment are most likely to be called ordinary business rather than governance.
Chapter Ten. Work as Continuous Evaluation
The workplace is the most normalized domain in this book because the relevant power rarely presents itself as domination. It presents itself as management. The employee is told that the institution is only evaluating performance, allocating opportunity, preserving culture, reducing risk, increasing productivity, or helping people succeed. Yet the governing claim of this chapter is that contemporary workplaces increasingly operate through continuous evaluative custody. The worker does not merely perform tasks and receive bounded judgment at identifiable moments. The worker is rendered into a live stream of traces, scores, conduct signals, productivity indicators, behavioral predictions, and fit judgments that can be reused across assignments, coaching, scheduling, pay, promotion, discipline, and exit. The resulting order does not usually deny that reasons are owed. It dissolves the conditions under which reasons remain collectible by turning evaluation into an ambient environment rather than a bounded act. What housing and credit call prudence, and child welfare calls protection, the workplace calls performance. The constitutional problem is the same. Life-organizing goods are being distributed through anticipatory judgments that the governed cannot meaningfully interrupt before those judgments harden into consequence.
Work is also distinct from the prior domains in one crucial respect. The employer ordinarily claims no special moral rescue mandate of the kind asserted in child welfare, and no explicit public-benefits obligation of the kind present in social provision. The rhetoric is lower, plainer, and therefore easier to naturalize. It says business necessity, teamwork, throughput, customer service, safety, fraud prevention, quality assurance, trust, reliability, culture. That modesty is part of the power. Because managerial judgment sounds ordinary, it more easily evades constitutional description. Yet the dependency structure is severe. Employment organizes wages, health insurance, schedule stability, occupational reputation, future mobility, and often immigration or household survival. A person can therefore appear free in the contractual sense while living under a system whose evaluative thresholds they cannot safely contest. A right to quit is not the same thing as a meaningful ability to resist evaluative governance when leaving means losing livelihood, standing, and future access. This is why the workplace belongs with the book’s low-exit domains even though exit is formally possible. The hardest version of the problem appears where workers are treated as independent contractors or otherwise misclassified, because the legal regimes that partially constrain evaluation can be weakened or displaced just where continuous scoring and routing are most intense.
Current official guidance already shows how broad this evaluative terrain has become. The EEOC’s January 2023 hearing described employers as using automated systems not only in recruitment and hiring but also in monitoring and firing workers. Its guidance on employment tests and selection procedures likewise treats performance appraisals, personality tests, credit checks, criminal background checks, and related screening devices as employment practices subject to federal anti-discrimination law, including disparate-impact scrutiny and job-relatedness or business-necessity constraints. The EEOC’s AI-and-ADA materials add a further point. Software, algorithms, and AI systems can unlawfully screen out disabled workers, gather disability-related information improperly, or fail to provide reasonable accommodation. The baseline is therefore already clear. Automated and data-intensive evaluation is not outside employment law because it looks modern or managerial. It is already a legally significant mode of decision-making.
Labor law and consumer-financial law have reached the same terrain from different directions. In 2022 the NLRB General Counsel proposed treating intrusive electronic surveillance and automated management practices as presumptively unlawful when, viewed as a whole, they would tend to interfere with workers’ Section 7 rights, unless justified by business needs and specifically disclosed. That matters because it adds a specifically collective dimension missing from the individual-facing frameworks of housing, credit, and much of disability law. The constitutional injury in work is not only that a single worker cannot collect what judgment owes. It is also that ambient evaluation can chill concerted activity, complaint, mutual aid, and organizing before collective power can form. In 2024 the CFPB reached the same terrain from another side, warning that third-party background dossiers and algorithmic scores used for hiring, promotion, reassignment, or retention decisions are often consumer reports under the FCRA. The significance of these interventions is larger than their immediate doctrinal reach. They show that workplace surveillance and algorithmic management are not just internal HR matters. They are regimes of consequential judgment that implicate rights of disclosure, challenge, association, and correction.
The best secondary scholarship gives this legal recognition a sharper conceptual form. Ifeoma Ajunwa’s work is especially valuable because she shows that worker quantification is not simply a new efficiency tool but a reorganization of labor through mechanical managers and captured capital, in which surveillance, data extraction, personality calibration, wellness tracking, and performance measurement become means of shifting risk and exploiting worker-generated informational value. Her core insight is not merely that workers are observed. It is that their observed traces become a managerial substrate through which employers govern labor more continuously and more impersonally than before. That is exactly the terrain of this chapter. Continuous evaluative custody names the institutional form of Ajunwa’s diagnosis. The worker is not just watched. The worker is held in an expanding archive whose future managerial uses are rarely fixed at the moment of collection and whose consequences can travel farther than the worker can meaningfully contest.
The deepest difficulty is that workplace power is rarely organized around one decisive act. It is organized around accumulation. This is what continuous evaluative custody names. The employer is at once paymaster, evaluator, archivist, and allocator. The paymaster role creates the dependency that makes contestation dangerous. The evaluator produces the scores, appraisals, signals, and interpreted behaviors that purport to say what sort of worker the person is. The archivist preserves those traces so they can travel across managers, tools, and time. The allocator then redistributes shifts, bonuses, coaching, schedule stability, promotion chances, and exit risk in light of those traces. These roles reinforce one another. Compensation dependence teaches caution. Evaluation produces the record caution must answer to. Archival preservation gives the record durability. Allocation turns that durability into lived consequence. The worker is thus not merely observed. They are held in a live dossier whose contents may widen and thicken long before any one item would justify formal discipline on its own.
A slower institutional scene makes the mechanism harder to sanitize. Consider a warehouse or logistics worker carrying a handheld scanner or using a third-party app integrated into the employer’s workflow. Time to complete tasks, movement patterns, time spent off-task, web browsing, keystroke frequency, message volume, and meeting duration can all become machine-readable inputs. The CFPB’s 2024 Circular expressly notes that third parties may generate scores or assessments from such data and that employers may use them for pay, promotion, reassignment, retention, scheduling, warnings, or other employment decisions. The NLRB memo likewise describes employers using surveillance data to discipline workers who fall short of quotas, penalize leave, and issue individualized directives throughout the day. In that scene, no single metric need be decisive. A small accumulation is enough: slower task completion on bad days, more idle-time flags during caregiving weeks, fewer after-hours messages, a drop in engagement, a higher vendor risk score, perhaps even a profile suggesting attrition or organizing propensity. The worker is not told, in a morally serious way, that failure has already occurred. They are told, implicitly or explicitly, that the system places them near failure, near non-fit, or near costly unpredictability, and that managerial action is justified now because that forecast is already enough. This is performance preemption.
A second scene shows why conduct near vulnerability matters so much in work. Imagine an exhausted employee using a general-purpose enterprise assistant late at night to draft a status update. The task is narrow and ordinary. The worker wants help wording a message so a delay does not sound like incompetence. Then, in the course of the exchange, the worker discloses fatigue, racing thoughts, or fear of being perceived as falling apart. A system designed under ordinary product logics can treat that disclosure as a resource. It can widen inference, preserve the exchange in a profile, offer a wellbeing tracker, surface HR-oriented prompts, or silently turn a narrow drafting request into a new managerial signal. Nothing dramatic has happened in the transcript. No one has been fired inside the conversation. Yet the worker’s narrow request has been converted into a corridor of expanded legibility. This is why the conduct problem matters in work. The wrong does not begin only when discipline occurs. It begins when vulnerability is translated into evaluative substrate.
The best empirical evidence on how this feels to the governed is beginning to catch up to what law is only starting to see. A 2024 study in Communications Psychology found that algorithmic surveillance, compared with human surveillance, reduced perceived autonomy and increased resistance across multiple experiments. That finding matters because it supports one of the manuscript’s recurring claims: the specific form of mediated observation changes the moral atmosphere of action. Workers do not experience algorithmic monitoring as if it were simply a more efficient human manager. The evaluative environment itself changes. This helps explain why workplace surveillance cannot be understood only as a privacy problem or an efficiency problem. It is a condition under which people begin to pre-flatten themselves, narrow speech, suppress experimentation, and reorganize conduct around the anticipation of machine-legible judgment.
This is where the chapter’s central diagnosis must be stated plainly. The workplace increasingly governs through performance preemption. The worker is not judged only after failure in a bounded sense. They are often managed in advance on the basis of projected underperformance, projected attrition, projected culture mismatch, projected safety risk, projected inefficiency, or projected deviation from continuously shifting norms. The worker is not told, in any morally serious way, that failure has already occurred and here are the reasons. They are more often told, in the softened language of management, that their signals, patterns, or behaviors are concerning enough to justify action now. Performance preemption is what happens when evaluative systems turn an archive of conduct into a future-facing justification for present disadvantage before the worker can meaningfully contest the future by which they are being read.
The six bounds from the person safety case take on a specific form here, and it is from them that lawful-use conditions follow. Bounded inference means that lateness, low message volume, tone shifts, response delays, missed keystrokes, wellness signals, absence patterns, or productivity irregularities may inform provisional review but may not silently harden into durable predicates of unreliability, emotional instability, disengagement, or culture failure without separately attributable, current, and contestable grounds. Sleeplessness, stress, caregiving disruption, disability-related variance, grief, or fear of speaking candidly cannot lawfully become ambient claims about a worker’s underlying fitness merely because the monitoring architecture can detect them. Bounded retention means that low-confidence or context-poor traces cannot remain in circulation as though their uncertainty did not matter. If a worker’s temporary crisis, disputed productivity score, or machine-generated wellbeing profile continues to travel across managers and decision cycles, the worker is being forced to live under administrative memory they never had a meaningful chance to correct. Bounded escalation means that seeking help, asking for coaching, using internal tools, or disclosing strain may not default a worker into deeper monitoring, HR exposure, or discipline-oriented review merely because the system can treat those disclosures as managerial signals. Bounded persuasion means that workers may not be steered, through fear-laden dashboards, score displays, or optional support tools, into overdisclosure or acquiescence on the theory that refusal itself signals poor fit. The specific mechanism matters. The choice is structurally contaminated before it is made if the worker reasonably understands that declining the tool, limiting visibility, or withholding sensitive information may itself become part of the evaluative record. Bounded penalty means that cheap suspicion, risk scores, or opaque productivity analytics may not become action-grade justifications for warning, reassignment, demotion, or firing absent preserved grounds that can still be tested. Bounded irreversibility means that because bad reviews, opaque warnings, denied promotions, lost shifts, and performance-management sequences can outlast later correction, the employer’s burden to preserve live contradiction before evaluative action becomes reputational fate is especially severe. The specific temporal structure matters here too. Evaluation does not stay inside one firm. Reputation, references, internal files, and digital dossiers can travel across teams, vendors, and organizations, so later correction may fail to repair the future labor market already altered by the earlier judgment.
Once those bounds are visible, the lawful-use question can be answered more precisely. No serious chapter can deny that employers need some evaluation, some safety monitoring, some quality control, and some means of allocating work. The question is not whether all structured assessment is illegitimate. The question is what would distinguish lawful evaluative support from preemptive managerial governance. At minimum, five conditions are necessary. First, the evaluative output must remain evidentiary support rather than automatic authority. A score, behavioral report, or surveillance-based flag cannot itself complete a disciplinary or career-affecting pathway without attributable human ownership of the grounds. Second, reason custody must be strong enough that the worker can know not only a label such as low productivity, reliability concern, or engagement risk, but the specific record, threshold relation, and reversal conditions that produced the judgment. Third, the use of such systems must not silently widen the worker’s exposure to additional monitoring, punitive scrutiny, or opportunity loss without separate justification and review. Fourth, support and coaching tools must be institutionally fenced from punitive uses, so that requests for help, accommodation, or clarification do not become ambient evidence of future discipline. Fifth, the contradiction pathway must remain usable while the relevant working life can still be altered, before the shift assignment is lost, before the performance note hardens into future reputation, before the promotion cycle closes, before the person is managed out. These conditions are not independent of the bounds. They are the practical implications of what bounded inference, retention, escalation, persuasion, penalty, and irreversibility demand in a workplace.
The invalidation conditions follow from the domain. If a monitoring or scoring system widens managerial scrutiny without the worker being told, in ordinary language, what category of risk or concern has been assigned and what data gave rise to it, bounded inference and reason custody fail together. If disputed traces, stale warnings, or low-confidence behavioral labels persist in a way later supervisors can silently rely upon, bounded retention fails because the worker is forced to live under administrative memory they never had a meaningful chance to contest. If workers understand coaching tools, wellness trackers, or support interfaces as the only way to avoid looking risky, bounded persuasion fails because help has become structurally contaminated by fear of evaluative escalation. If the employer cannot show where monitoring ends and disciplinary judgment begins, bounded escalation fails because the worker is left facing a workflow whose authority no one can actually own. And if later review arrives only after the shift pattern has changed, the promotion cycle is over, the warning has entered the file, or the exit has occurred, bounded irreversibility fails because the worker has borne an injury formal reconsideration cannot practically repair.
The strongest defense of algorithmic management must still be faced honestly. Employers will say that structured monitoring reduces favoritism, detects safety issues earlier, identifies burnout before collapse, allocates work more fairly, and creates more review surface than opaque manager discretion ever supplied. Some of this is true in narrow settings. The EEOC’s framework for employment tests and selection procedures already accepts that some screening tools can be lawful when they are job-related, consistent with business necessity, and not unnecessarily exclusionary. The ADA likewise does not forbid all health- or disability-related workplace inquiry. It constrains when such inquiry is permissible and how accommodations must be provided. The chapter’s answer begins one step later. More review surface is not yet equal standing. A richer archive is not yet a collectible reason. A more consistent metric is not yet a legitimate basis for ambient governance if the worker cannot challenge the admissibility of what is being counted, the meaning the institution assigns to it, or the speed with which it is allowed to harden into consequence. Comparative efficiency is therefore not irrelevant. It is simply not sovereign.
This is why the workplace is distinct from the earlier domains and still belongs within the same constitutional family. The employer’s rhetoric is not the morally elevated rhetoric of child protection, nor the overt public duty of social provision. But the dependency is real and the normalization deeper. The worker is expected to absorb continuous evaluation as the price of being a professional subject. That expectation is precisely what makes the workplace such an important stress test. Here governance succeeds most when it disappears into the ordinary. The line between management and domination is therefore not marked by whether the employer says it is only evaluating performance. It is marked by whether the worker can still collect what judgment owes.
The chapter’s constructive rule can therefore be stated without euphemism. In the workplace, a predictive or AI-mediated system is legitimate only if evaluation remains institutionally subordinate to collectible reason, and if continuous monitoring, scoring, or algorithmic management do not convert the worker’s archive into a regime of performance preemption that they cannot meaningfully interrupt before consequence hardens. The employer must show where monitoring stops, what it cannot infer from context-poor traces, how support tools are fenced from punitive uses, how disputes and corrections travel quickly enough to matter, and how discipline or opportunity loss remains attributable to grounds that can still be challenged in ordinary language. This is not an argument that employers may never evaluate workers. It is an argument that the ordinary business vocabulary of performance, fit, culture, and productivity cannot function as a discount rate on constitutional proof when the goods at stake—livelihood, health insurance, reputation, future mobility, and the ability to remain employable—are conditions of life rather than marginal perks.
The next chapter should gather the domain chapters back into a single public doctrine of admissibility, proof, and nonprediction, because the manuscript has now shown the same structure under four dominant names: support, protection, prudence, and performance. The issue has never been the label. It has always been whether institutions may preempt lives on terms the governed cannot still call to account.
Chapter Eleven. Admissibility, Proof, and the Right to Non Prediction
The domain chapters have now made the same structure visible under four different institutional names. In social provision, help became the portal through which one entered suspicion. In child welfare, protection became the rhetoric through which the family was rendered more governable before proof was fully earned. In housing and credit, prudence became the market-facing language of anticipatory exclusion. In the workplace, performance became the ordinary name for continuous evaluative custody. The point of this concluding synthesis is therefore not to add a fifth domain or a new mechanism. It is to state, in public-doctrinal form, what the book has already shown in dispersed proofs. The central question is not whether institutions may ever use computation, statistics, or prediction. The central question is when these forms of rule are admissible at all, what they must prove before they are permitted to bind lives, and where nonprediction is the only honest constitutional rule. The answer developed across the manuscript can now be stated plainly. A predictive or AI-mediated system is admissible only where the institution can preserve collectible reasons under bounded inference, bounded retention, bounded escalation, bounded persuasion, bounded penalty, and bounded irreversibility. Where those conditions cannot be met, nonprediction is not a rhetorical aspiration. It is the minimum boundary of legitimate rule (“The Right to Non Prediction”; “The Safety Case for Persons”).
Admissibility is not the same thing as performance. Modern governance repeatedly treats these as if they were versions of the same inquiry, as though sufficient predictive lift, better calibration, or reduced inconsistency could settle the prior political question of whether an institution may govern through prediction at all. They cannot. Performance asks whether a system does something effectively according to a selected metric. Admissibility asks whether an institution may rightly act through that system under conditions in which the governed can still demand, receive, contest, and convert reasons into revision or remedy. A model can improve screening, increase forecast accuracy, reduce inter-rater variation, or outperform a blunt proxy and still remain inadmissible as a basis of consequential rule. That is because the authority problem is not solved when the metric improves. It is solved only where the judged remain able to answer the judgment before it hardens into the conditions of their life (“The Debt of Reasons”; “The Right to Non Prediction”).
This distinction is the culmination of the book’s deeper claim that institutions incur debt when they judge. Judgment does not become less indebted because it is mediated by software, ranking criteria, prediction, or statistical integration. It becomes more dangerous when those mediations make the debt harder to collect. The manuscript on The Debt of Reasons makes the point starkly. Some predictive uses become illegitimate even when they are relatively accurate because the accuracy is purchased by translating poverty traces, disability, caregiving disruption, racialized exposure, prior system contact, or other forms of social vulnerability into portable indices of undeservingness. Probability then ceases to function as an aid to bounded judgment and becomes a language of governance that the governed can never fully answer. They can only submit to it or be managed by it (“The Debt of Reasons”). The doctrine that follows from this book therefore has to resist the most familiar temptation in the field, which is to imagine that if the system performs well enough, the legitimacy problem has been solved. It has not. The legitimacy problem is solved only where reasons remain collectible.
The doctrine unfolds through three sequential questions. Each is necessary. None can be skipped. The first is a question of jurisdiction. The second is a question of proof. The third is a question of collectibility. Only by moving through them in order can one tell whether prediction is admissible, and only by preserving their order can one prevent performance from smuggling itself into legitimacy.
The first question is whether the domain is one in which prediction can ever remain subordinate to collectible obligation. This is the jurisdiction question. Some domains are more permissive because the harms at issue are more reversible, the dependency relation less severe, and the opportunity for live contradiction more intact. Other domains are harsher because they are low-exit or no-exit, coercively asymmetrical, and temporally structured so that harm outruns ordinary review. Social provision, child welfare, and many workplace settings sit near the severe end of that spectrum. Housing and credit, though cast as market domains, often sit much nearer that same end than prudential rhetoric admits because the denied opportunity disappears before correction can preserve it. The unpublished materials on The Right to Non Prediction press the point beyond abstraction: admissibility is not determined by technical system properties alone. It is altered by the surrounding political economy of enforceability. When agency capacity is thin, vendor dependence deep, procurement entanglement heavy, and ordinary procedural access weak, the institutional environment itself militates against collectibility. Under those conditions, thinner safeguards are not simply weaker. They are structurally likely to fail (“The Right to Non Prediction”). Jurisdiction is therefore the doctrine’s first guardrail. It asks whether this domain can, in principle, sustain predictive rule without destroying the very answerability prediction would need in order to be legitimate.
The second question is whether the institution can produce proof proportionate to the domain. This is the proof question, and here the answer cannot be a principles statement, a values deck, a fairness report, a model card, or a general assurance memo that never names failure states. The institution must produce what Chapter Six specified as a person safety case: a contradictable claim set proving bounded inference, bounded retention, bounded escalation, bounded persuasion, bounded penalty, and bounded irreversibility, supported by attributable evidence objects, governed by invalidation conditions, and paired with operational responses proportionate to failure (“The Safety Case for Persons”). The point of this structure is not managerial tidiness. It is to prevent institutions from speaking fluently about restraint while preserving no path by which those claims can be tested in time. A claim without an evidence object is aspiration. A claim without an invalidation condition is branding. A claim without a response duty is theater. Proof, then, is not a statement that the institution means well. It is a demonstration that the institution has bound itself in advance to narrower conduct, attributable reasons, and live interruption.
The third question is whether there remains a route from the governed person to revision before the relevant life consequence hardens. This is the collectibility question in its most concrete form. Here the doctrine moves from architecture into time. The right reason given too late is not a fully absent reason. It is an uncollectible one. A free report after the apartment is gone, a dispute process after the shift pattern has changed, a hearing after food assistance lapses, an appeal after family life has already been reorganized, a correction after a performance narrative has already traveled into future opportunities, all preserve fragments of procedural form while failing the thing the form was supposed to protect. Collectibility therefore requires more than explanation. It requires attributable actors, actionable grounds, real authority to revise, timing matched to the domain’s tempo, and remedy that alters the present relation rather than acknowledging past injury in a register that no longer matters. This is the phenomenological test that gives the doctrine its moral seriousness. A channel exists only if life can still move differently because the channel exists.
From those three questions the doctrine’s first substantive rule follows. Prediction is inadmissible wherever the institution cannot show that the person remains the creditor of reasons rather than the substrate of administrative foresight. This is the line the manuscript has approached from the beginning. The governed cannot be reduced to profiles whose futures are already contained in the archive if institutions are to remain answerable. The Right to Non Prediction is clearest here. Where public and private institutions are structurally disposed to make reasons uncollectible, law must become more willing to say no to governance forms that depend on reasons remaining collectible in order to be legitimate (“The Right to Non Prediction”). Nonprediction is not a luxury reserved for ideal institutional settings. It becomes more urgent precisely where the actual order is already organized against collection.
This gives the doctrine a two-part structure. The first part is a doctrine of bounded admissibility for domains where predictive support might survive constitutional scrutiny in narrow form. The second is a doctrine of categorical nonprediction for domains or functions where prediction itself destroys the conditions under which reasons could remain collectible.
Bounded admissibility imposes a demanding burden. A surviving predictive system would have to remain evidentiary support rather than preemptive authority. Its outputs could not themselves complete the consequential pathway. It would need strong reason custody, meaning the affected person could know not only a label or factor but the record, threshold relation, and reversal conditions that made the outcome possible. It would need institutionally fenced uses, so that support, wellness, coaching, prevention, or administrative assistance could not silently widen exposure to punishment, scrutiny, or exclusion. It would need contradiction fast enough to matter, which means the relevant opportunity would have to remain open long enough for dispute and correction to preserve the life chance at stake. And it would need invalidation rules robust enough that failure would narrow operation, pause deployment, or force redesign rather than merely generate a lessons-learned ritual. This is the maximum that prediction can ask for under legitimate conditions. It is deliberately severe because any lesser standard permits institutions to claim the benefits of anticipatory rule without absorbing its constitutional costs.
Categorical nonprediction begins where that burden cannot be met, not because prediction is metaphysically impure, but because prediction itself becomes the mechanism by which answerability is destroyed. The internal manuscripts on The Right to Non Prediction state the point with unusual force. Some domains must be preserved as non-predictive spaces if reasons are to remain collectible and institutions are to remain answerable. The philosophical grounds for this conclusion are multiple, and they need not be artificially collapsed into one another. A capabilities account, as in Nussbaum, objects because preemptive governance undermines the practical conditions of equal agency and standing by organizing access to life conditions before the person can meaningfully shape the terms of that access (Nussbaum). A Levinasian account objects because prediction substitutes classification for encounter. It receives the other not first as someone to whom reasons are owed, but as a type whose future has already been administered in advance (Levinas). In that sense, prediction does not merely aid judgment. It preformats the relation in which judgment appears, replacing answerable obligation with prior admissibility. These traditions do not converge because they share a metaphysics. They converge because each identifies a limit beyond which prediction becomes politically inadmissible. Some uses of prediction destroy answerability by turning the archive into a prior verdict that the person cannot practically answer.
The domain chapters make that limit clearer than any abstract summary could. In social provision, prediction becomes inadmissible when support is no longer institutionally prior to suspicion. In child welfare, prediction becomes inadmissible when protective rhetoric discounts the proof burden and allows the family’s administrative archive to stand in for presently collectible reasons. In housing and credit, prediction becomes inadmissible when prudence is allowed to justify anticipatory exclusion before dispute and correction can preserve the apartment, the rate, or the ordinary possibility of remaining housed and mobile. In work, prediction becomes inadmissible when continuous evaluative custody turns performance into a future-facing archive of managerial action that the worker cannot challenge before it becomes reputational fate. The names differ. The structure does not.
A serious public doctrine must also say what institutions owe when they claim to remain on the admissible side of the line. The answer is not just more transparency. It is a thicker set of front-end obligations, precisely because the enforcement environment is often too thin to rescue the governed after the fact. The internal nonprediction materials are explicit on this point. Institutions need stricter answerability chains, stronger default disclosure duties, more robust pause mechanisms, narrower proxy admissibility, rights of narrative re-entry, and complaint aggregation duties that can trigger redesign rather than merely accumulate institutional noise (“The Right to Non Prediction”).
Some of these obligations are already familiar in the field, though rarely taken seriously enough. Stricter answerability chains mean institutions may not hide behind vendor distribution, advisory rhetoric, or dispersed deployment structures once an output has begun to bind. Stronger default disclosure duties mean the person should not have to discover by accident what category of risk, deficiency, or concern they have been assigned. Pause mechanisms mean that challenge can interrupt institutional velocity before life reorganizes around the first decision. Narrower proxy admissibility means the institution cannot smuggle classed, raced, disabled, impoverished, or otherwise vulnerable life traces into risk judgment merely because the proxy performs well statistically. Those duties are demanding, but they remain, in principle, recognizable to administrative and regulatory practice.
The two most original obligations in the doctrine go further because the field still does not name them clearly enough. The first is the right of narrative re-entry. A governed person must be able to reintroduce themselves against the archive rather than being ruled solely by its forecast. This is not just a right to add more documents or correct one data point. It is a right to force the institution to receive the person again as more than the compressed meaning of their traces. Narrative re-entry matters because prediction often hardens the archive into an anticipatory self-description the institution then treats as sufficient. The person is read as future nonpayer, future neglect source, future attrition risk, future fraud indicator, future instability. A right of narrative re-entry interrupts that compression by requiring a review stage in which present-tense explanation, context, and contradiction can alter the path before irreversibility sets in. Without such a right, the institution speaks only to its own first interpretation of the person.
The second is the duty of complaint aggregation. Institutions repeatedly survive by distributing harm into minor deniabilities. Each late notice, stale record, failed dispute route, or support-to-suspicion conversion can be treated as an isolated event. The individual complaint then appears too small to trigger redesign. Aggregation duties reverse that privilege. They require institutions to treat repeated low-grade failures as evidence of system invalidation rather than customer-service background noise. A steady pattern of late corrections, merged identities, low-confidence flags hardening into consequence, support tools widening exposure, or domain-specific contradictions arriving after the relevant opportunity has passed must be counted as a governance failure and not merely as a service defect. Complaint aggregation is therefore not a management improvement technique. It is part of constitutional infrastructure. It is one of the only ways to make atmospheric or distributed injury visible enough to trigger the proof burdens this doctrine demands.
This is the point at which the manuscript’s relation to liberal proceduralism must be stated honestly. The book is not anti-procedural. It is anti-procedure without collectibility. It refuses the recurrent institutional move by which the presence of a notice, a portal, a hearing right, a report copy, a factor list, or a human reviewer is treated as enough to stabilize legitimacy. Procedure is morally serious only when it preserves the person as someone who can still matter against the archive, the score, the workflow, and the institution’s first interpretation of itself. Where procedure exists without that possibility, it functions as decorous domination. That is why the book has kept returning to time. A reason that arrives after the rent is due, after the family is disrupted, after the warning has entered the file, after the worker has been managed out, after the benefits lapse, is not simply late. It announces that the institution preserved the ritual form of answerability while denying its practical content.
A public doctrine of nonprediction also has to confront its own ethical risk. Any theory that teaches people to see preemptive governance everywhere can itself increase vigilance if it gives the reader more reasons to scan without also giving more leverage. Contestable Life is explicit about this problem. A theory must be judged not only by whether its critique is accurate, but by what it trains the body and mind to do. If it produces constant mobilization without increased agency, it has failed (“Contestable Life”). The doctrine offered here therefore has to remain discriminating. It cannot collapse every use of statistical knowledge into domination. It must mark the difference between evidentiary support that remains interruptible and preemptive authority that destroys the possibility of interruption. And where nonprediction is required, the reason is not metaphysical purity. It is the preservation of a public world in which persons can still appear before power as beings whose reasons might matter.
The final standard can now be stated without retreat. Legitimacy begins where reasons can be collected. Prediction is admissible only where institutions can prove, in attributable and contradictable form, that the governed remain able to collect the debts judgment incurs under bounded inference, retention, escalation, persuasion, penalty, and irreversibility. Where that cannot be shown, nonprediction is the only legitimate rule. This is not a policy preference among many. It is the limit that keeps law from becoming administration speaking probability to those it no longer needs to hear.
What the book has argued, in the end, is simple enough to state and difficult enough to live by. Institutions may act with evidence. They may not purchase legitimacy by turning evidence into preemptive authority while dissolving the conditions under which that authority can still be answered. The person remains the creditor. The institution remains the debtor. Everything turns on whether the debt can still be collected.
Chapter Twelve. Public Order After Prediction
A book that ends in critique alone leaves the most important decision to the institutions it has just shown to be untrustworthy. It tells the reader what is wrong, perhaps even why it is wrong, and then quietly returns the work of construction to the very order whose governing habit has been to convert uncertainty into authority while dissolving the conditions under which that authority can still be answered. This final chapter refuses that handoff. The question here is no longer whether the manuscript has shown a common structure across social provision, child welfare, housing and credit, and work. It has. The question is what a public order would look like if it took that structure seriously enough to govern against it. The answer is neither a simple ban on computation nor a managerial plea for more ethical design. It is a constitutional reordering of institutional permission. The state, the firm, the platform, the school, the hospital, the landlord, the lender, and the employer must all be understood as actors who come near persons under conditions of unequal power and must therefore prove more before they may bind more. The point of the conduct constitution, in the end, is not to improve the tone of governance. It is to narrow what governance may do before life is reorganized around judgment.
The older public languages through which liberal orders have tried to discipline institutional power are not nothing. Privacy has constrained collection. Due process has constrained some forms of official action. Anti-discrimination law has constrained some forms of unequal treatment and unjustified disparate effect. Consumer-reporting law has constrained accuracy and notice. Administrative law has constrained some exercises of agency reason-giving. Labor law has constrained some forms of employer retaliation and interference. But the world this book addresses is one in which those languages repeatedly arrive one step too late or one level too abstract. The difficulty is not simply that institutions break rules. It is that they increasingly govern through workflows whose decisive act occurs before the older legal categories have fully recognized what kind of act has occurred. A score is presented as information. A screening decision is presented as prudence. A supportive outreach is presented as prevention. A coaching tool is presented as management help. A refusal pathway is presented as consent’s reciprocal. A memory trace is presented as operational necessity. The entire burden of the manuscript has been to show that these are not merely neutral descriptions of administrative technique. They are the grammars by which institutions secure permission to bind lives before they have earned the right to do so.
This is why the book has insisted on the difference between performance and admissibility. If that distinction does not become a governing feature of public order, the strongest parts of the argument collapse back into policy advice. A system may perform well and still be inadmissible. A workflow may improve internal consistency and still be constitutionally unsound. A predictive tool may outperform a cruder proxy and still be politically forbidden because the very act of governing through projection defeats the collectibility of reasons that would be needed to justify rule. Public order after prediction therefore begins with a reversal of priority. The first institutional question is no longer how well the system performs. It is whether the institution may permissibly act through that system at all under the domain conditions in which it operates. Only after that question is answered may performance matter, and even then it matters within the narrower space left over after admissibility has done its work (“The Right to Non Prediction”; “The Debt of Reasons”).
The most immediate consequence of that reversal is juridical. Courts and agencies can no longer treat predictive or AI-mediated systems as though the main challenge is extracting a little more explanation from them after the fact. Explanation matters. It is not the first question. The first question is whether the use itself belongs inside a domain where reasons can still be collected before life hardens around the action. This is the lesson one can read back through the older cases once the manuscript’s grammar is in view. Goldberg was never only about hearings in the abstract. It was about the intolerability of making subsistence depend on procedures that arrive after deprivation has already done its work. Santosky was never only about the standard of proof at termination. It was about the gravity of family destruction and the refusal to let the state claim a right of final judgment on thinner grounds. Inclusive Communities was never only about a technical theory of disparate impact. It was about the public scrutiny owed to neutral-seeming allocation rules when their operation entrenches exclusionary structures. These decisions did not use the vocabulary of conduct constitution, person safety case, or nonprediction. But they all turned, in different ways, on the same deeper refusal. Institutions may not claim decisive authority over conditions of life while withholding the means by which that authority can still be answered (Goldberg; Santosky; Inclusive Communities).
Danielle Citron’s account of technological due process remains useful here because it recognized earlier than most governance literature that automated systems create special risks when their operation is too opaque, too dispersed, or too difficult to contest for ordinary people (Citron). Yet the public order argued for in this book must now move beyond technological due process in one crucial respect. Due process cannot remain primarily a question of whether sufficient explanation or review exists after automated action has occurred. It must become a doctrine of precondition and admissibility. A court or agency reviewing a predictive system used in a life-organizing domain should first ask whether the institution preserved live contradiction, attributable ownership, and practically restorative remedy before authorizing the predictive layer at all. That is a different orientation from most current review. It turns legal attention away from the technical sophistication of the model and toward the architecture of authority in which the model is allowed to bind.
The second consequence is administrative and regulatory. Public agencies and large institutions have to stop treating procurement as a neutral acquisition function and begin treating it as a constitutional entry point. The manuscript on The Safety Case for Persons showed why this matters. Once an institution acquires a system whose ordinary operation depends on claims it cannot itself attribute, invalidate, pause, or explain in actionable terms, it has already put itself at odds with the proof burden legitimate rule requires (“The Safety Case for Persons”). Procurement therefore becomes one of the most important sites of public order after prediction. A lawful procurement regime for systems near persons would have to refuse black-box contractual arrangements that leave the deploying institution unable to preserve reason custody. It would have to require a person safety case before deployment, not a values statement after acquisition. It would have to specify invalidation triggers, pause duties, residue controls, and narrative re-entry routes as terms of use rather than as litigation contingencies. More concretely, it would have to require contracts that preserve the deploying institution’s ability to attribute specific claims to accountable actors, test those claims against production behavior, pause operation when invalidation conditions are met, and compel vendor cooperation in revision rather than treating explanation as proprietary surplus. It would also have to prohibit vendor arrangements that treat support, wellness, prevention, coaching, or productivity tools as open reservoirs of future managerial, disciplinary, or separative use.
Mireille Hildebrandt’s work is especially valuable at this point because she has argued, against the grain of both libertarian deregulation and purely technical governance, that law must actively shape the affordances of digital environments if it is to preserve the conditions of legal protection rather than merely react to their erosion (Hildebrandt). The conduct constitution extends that insight. It says that public order after prediction cannot be secured by demanding explanations from already-built systems alone. It must be designed into the legal terms under which systems are permitted to exist in consequential domains. That is what the earlier chapters meant by bounded inference, retention, escalation, persuasion, penalty, and irreversibility. They are not ethical aspirations for designers to contemplate if convenient. They are architectural limits that public order must impose if institutions are to remain answerable after adopting tools whose very attraction lies in making action faster, smoother, cheaper, and more detached from the friction of human contradiction.
This is also where the book’s more original constructive obligations become most important, because existing governance discourse still names them too weakly or not at all. Narrative re-entry is one of them. A person governed by a predictive or archival system must be able to reintroduce themselves against the compressed meaning of their traces. This goes beyond the right to correct a data point or dispute a score. It is a right to interrupt the institution’s first interpretation of what the archive means. The reason this matters is simple and severe. Modern institutions increasingly act as though the archive already contains the person’s future in politically sufficient form. The tenant becomes a likely nonpayer. The claimant becomes a likely noncooperator. The parent becomes a likely future risk. The worker becomes a likely underperformer. Narrative re-entry is the minimum institutional counter to that compression. It forces the institution to receive the person again not as a residue of prior traces but as a present-tense claimant against the archive. It is therefore not sentimental. It is one of the few mechanisms by which collectibility can be restored once predictive governance has already begun to harden the future.
Complaint aggregation is the other undernamed obligation. Institutions repeatedly preserve illegitimate systems by distributing injury into minor deniabilities. The individual complaint is too small, too local, too plausibly accidental, too easily redescribed as service noise or user error. The denied apartment, the stale report, the late notice, the inexplicable warning, the support tool that widened exposure, the prevention system that felt impossible to refuse, each can be managed as an isolated defect. What complaint aggregation does is convert repetition into proof. It requires institutions to treat distributed low-grade failure as a signal of structural invalidation rather than as background friction. This is one of the only ways to make atmospheric injury visible enough to trigger redesign. Without aggregation duties, institutions can continue to rule through systems whose harms are obvious only in the plural, while preserving plausible deniability in every singular encounter. Public order after prediction therefore has to require not just complaint channels but complaint intelligibility at scale.
The same logic applies to withdrawal and memory, though the constructive burden here can be stated more tightly. Consent and withdrawal are not moral reciprocals where the operative object is not the intake moment but the residue that remains after interaction has already occurred (“The Residue Ledger”). Public order after prediction must therefore require verifiable withdrawal duties strong enough that institutions can show what remains, where it remains, how it propagates, and under what authority it continues to act once refusal has been exercised.
At this point the relation between public and private order has to be named directly. One of the most persistent evasions in this field is the claim that constitutional seriousness belongs only to the state in the narrow sense, while firms, landlords, lenders, employers, platforms, and vendors remain matters of contract, consumer choice, or sectoral regulation. The domain chapters have already shown why that division fails. Life-organizing power is not exhausted by state command, and public order cannot remain indifferent to quasi-public systems of prediction and exclusion simply because their formal legal status is private. When a landlord can deny housing through a screening pipeline the applicant cannot meaningfully interrupt before the unit is gone, when an employer can manage a worker through ambient prediction the worker cannot safely contest before consequence hardens, when a lender can deny on the basis of a future-facing archive the borrower cannot reconstruct in time, the problem is not merely consumer dissatisfaction. It is governance without sufficiently collectible obligation. Public order after prediction therefore has to be willing to regulate private actors where they govern life chances under low-exit, high-dependency conditions. The most promising existing legal vehicles are already visible in the field: disparate-impact doctrine, as preserved in Inclusive Communities, for exclusionary allocation systems that present themselves as neutral, and consumer-reporting obligations, as sharpened by the CFPB, for private dossiers and scores that effectively function as consequential public-order devices. This is not an expansion of constitutional language for rhetorical flourish. It is a recognition that the social distribution of reasons owed no longer tracks the old public-private map cleanly enough to protect the governed.
The doctrine also has to confront its own limit honestly. Not every use of statistics or machine assistance is illegitimate. Not every patterned decision requires categorical nonprediction. The ethical risk the book identified in Contestable Life matters here. A theory that teaches people to scan ceaselessly for domination without simultaneously increasing their leverage can become another architecture of burden (“Contestable Life”). Public order after prediction therefore has to remain discriminating. It must preserve the difference between evidentiary support that remains interruptible and preemptive authority that destroys interruption. It must also acknowledge that some bounded predictive uses may remain admissible where the domain is sufficiently reversible, the dependency relation low, the contradiction pathway strong, and the safety case actually live. The book’s argument is not purity. It is hierarchy. Prediction comes after answerability, not before it.
That is why the right to nonprediction should be understood less as a generalized privacy right than as a public-order right against premature administrative futurity. Its object is not secrecy for its own sake. Its object is the preservation of a social and legal world in which persons can still appear before power as beings whose reasons might matter more than the archive’s projection of their likely path. One can state the political limit without multiplying foundations. Prediction becomes inadmissible where the other appears first as administratively foreseeable rather than as someone to whom present-tense justification is still owed. That is the point at which law ceases to receive persons as answerable claimants and begins instead to manage them as projected deviations from institutional preference. Public order after prediction must refuse that substitution if it is to remain a public order at all.
The manuscript is therefore not anti-procedural. It is anti-procedure without collectibility. It rejects the recurrent institutional move by which the presence of a notice, a report copy, a human reviewer, a portal, a hearing right, or a factor list is treated as enough to stabilize legitimacy. Procedure is morally serious only when it preserves the person as someone who can still matter against the archive, the score, the workflow, and the institution’s first interpretation of itself. Where procedure exists without that possibility, it functions as decorous domination. This is why time has mattered so much throughout the book. A reason that arrives after the rent is due, after the family is disrupted, after the warning has entered the file, after the worker has been managed out, after the benefits lapse, is not simply late. It announces that the institution preserved the ritual form of answerability while denying its practical content.
The final standard can now be stated without retreat. Legitimacy begins where reasons can be collected. Prediction is admissible only where institutions can prove, in attributable and contradictable form, that the governed remain able to collect the debts judgment incurs under bounded inference, retention, escalation, persuasion, penalty, and irreversibility. Where that cannot be shown, nonprediction is the only legitimate rule. This is not a policy preference among many. It is the limit that keeps law from becoming administration speaking probability to those it no longer needs to hear.
What the book has argued, in the end, is simple enough to state and difficult enough to live by. Institutions may act with evidence. They may not purchase legitimacy by turning evidence into preemptive authority while dissolving the conditions under which that authority can still be answered. The person remains the creditor. The institution remains the debtor. Everything turns on whether the debt can still be collected.
Chapter Thirteen. The Creditor Remains
Every serious book about institutions eventually confronts the same temptation. After naming the machinery with enough precision, after showing how it works in law, markets, welfare, work, and family life, after specifying what would have to change if legitimacy were to be something more than a polished form of domination, the author is tempted to end with either policy confidence or exhausted melancholy. One path says the architecture is now clear and the remedies are available if only regulators, firms, agencies, courts, and designers would act with sufficient seriousness. The other path says the architecture is too deeply sedimented, the incentives too durable, the habits of classification too powerful, and the institutions too practiced in converting critique into their next legitimacy layer for any doctrine to matter very much. Both endings are understandable. Neither is sufficient. This book has argued that modern institutions increasingly convert uncertainty into authority while dissolving the conditions under which that authority can still be answered. A manuscript that ended in optimism would therefore fail to respect the depth of the problem, and one that ended in despair would return to institutions the very sovereign finality it has spent twelve chapters refusing. The only honest ending is one that remains with the basic asymmetry the book has tried to restore. Institutions may act. They may not take the person’s answerability away in the act of acting.
That claim has sounded, at different moments in the book, constitutional, administrative, phenomenological, and moral. It has taken the form of bounded visibility, refusal viability, collectibility of obligation, recourse adequacy, conduct constraint, residue governance, person safety cases, and the right to nonprediction. These were never meant as proliferating vocabulary for its own sake. They were attempts to name one recurring injury from different angles. The injury is not simply that institutions are wrong. Institutions have always been wrong, and any serious social order must know how to remain legitimate under conditions of ordinary error. The injury is that institutions increasingly seek to become wrong in ways that no longer need to hear from the people they have governed. The score precedes the explanation. The report precedes the challenge. The workflow outruns the hearing. The predictive archive arrives before the person. The future has been spoken in administrative language before the one living toward that future has been received as someone whose own reasons could alter it. This is the sense in which the book has been less about technology in the narrow sense than about a political and moral style. Technology has intensified the style, accelerated it, diffused it, naturalized it, and made it cheaper to maintain. But the deeper problem has always been the institutional wish to be finished with the person before the person is finished speaking.
That is why the book has returned, so insistently, to timing. Many readers will be tempted to treat its argument as an elaboration of transparency critique, fairness critique, or procedural due process critique. It is adjacent to all three and reducible to none. The decisive question is not only whether the institution says what it has done, whether it treats groups evenhandedly, or whether it preserves a channel through which complaint might later be routed. The decisive question is whether the channel still belongs to life. A reason given after the apartment is gone, after the benefit has lapsed, after the family has been reorganized around suspicion, after the worker has been managed into reputational decline, after the borrower has lost the rate, is not merely late. It is evidence that the institution preserved the ceremony of answerability while refusing its temporal burden. This is the meaning of the book’s simplest sentence and its hardest one. The right reason given too late is an uncollectible reason. It is not enough that the institution can explain itself once the governed have already absorbed the consequence. Explanation that arrives after irreversibility is a way of preserving the institution’s self-description, not the person’s standing.
This is also why the manuscript has insisted on the creditor-debtor relation. The metaphor is severe and deliberately unflattering to the institution. It reverses the moral psychology most bureaucratic and managerial systems prefer. In the everyday administrative imagination, the claimant, applicant, tenant, borrower, parent, or worker appears as the one who owes. They owe documentation, punctuality, professionalism, cooperation, clarity, truthfulness, responsiveness, administrative fluency, emotional restraint, and legibility. The institution appears as the one entitled to ask, sort, time, classify, and decide. The book has argued the opposite. The institution is the debtor the moment it judges. It incurs an obligation not merely to be sincere or technically adequate, but to remain answerable in a form the governed can still collect. This does not mean the person always wins, nor that institutions lose authority whenever they err. It means authority is legitimate only where it remains burdened by the possibility of being answered by the one it governs. The person remains the creditor not because persons are always right, but because the institution’s right to rule depends on its willingness to remain in debt to those whose lives it organizes.
That is a harder claim than a rights claim in the ordinary liberal sense, though it contains rights within it. A right can still be imagined as a thing one possesses while institutions quietly structure whether it can be used. Debt shifts attention from possession to relation. It asks what the institution continues to owe after it has acted and whether the form of its action preserved any route through which that owing can matter. The advantage of this grammar is that it resists a contemporary vice visible across public and private governance alike. Institutions increasingly imagine that once a disclosure has been captured, once a workflow has been completed, once a score has been generated, once a notice has been produced, the remaining moral work lies primarily in whether the artifact can be displayed, explained, or defended. The debt grammar says the opposite. The artifact is secondary. The primary question is whether the relation between judged and judge still contains a live capacity for contradiction before the judgment becomes the world the person must inhabit. The artifact matters insofar as it either preserves or defeats that relation.
The doctrinal chapters have already shown how this question appears in law, procurement, market regulation, labor governance, and family regulation. A final coda should therefore resist the temptation to restate every mechanism or domain. It is better to ask what sort of public order would follow if the book’s argument were not merely understood but believed. It would be a public order that treated precondition as more important than explanation after the fact. It would be a public order that asked of a proposed system not only whether it is accurate or useful, but whether the governed can still answer it in time, in ordinary language, without heroic surplus, and with some realistic prospect of revision or remedy. It would be a public order that regarded support, wellness, prevention, coaching, and optimization with more suspicion than contemporary institutions do, not because those things are bad in themselves, but because they have become preferred entry points for expanded capture. It would be a public order that treated low-exit domains with the severity currently reserved for catastrophic engineering failure, not because persons are components, but because the wrong of governing where life cannot easily exit is deeper than current legal vocabularies know how to say. It would be a public order that understood prediction not as neutral information waiting for lawful use, but as a form of anticipatory authority that must justify its admissibility before it is allowed to help itself to the future of another person.
That order would also be less enchanted by institutional memory than our own. One of the deepest modern habits is to imagine that what is preserved is what is real, and that what is recorded most completely is what must govern most authoritatively. But the book’s argument, at its strongest, has not been merely that archives grow too large. It has been that legitimate order sometimes requires the institution to encounter the person before the archive is allowed to speak with full authority. That is not a deficit of information. It is a discipline against premature finality. A portable trace can overrule the life it was supposed to serve. A predictive future can become the real object of governance while the present-tense person is treated as its evidentiary carrier. Against that order, the manuscript has defended attenuation, nonportability, narrative re-entry, and nonprediction because they preserve the possibility that the person will arrive before the archive is allowed to become verdict. The political danger of memory is therefore not memory itself. It is the prestige of preservation when preservation becomes prior judgment.
For this reason, the book’s argument has always been as much about what institutions must not know as about what they must prove. This is an unfashionable claim in a culture that still mistakes more information for more seriousness. There are domains in which not knowing in advance is not a deficit to be corrected but a condition of legitimate relation. There are contexts in which the institution must encounter the person without the anticipatory conveniences that would make action cheaper and challenge weaker. There are spaces in which prediction itself is an injury because it converts the future into a prior administrative possession. This is why the right to nonprediction is not reducible to privacy. Privacy is often framed as a zone of control over one’s information. Nonprediction is a stricter and more public demand. It asks that some forms of institutional action remain dependent on presently collectible reasons rather than on projected futures extracted from archives the governed can never fully answer. It is a right against premature administrative futurity, a demand that institutions not acquire more of the person’s future than they can justify in a form still open to contradiction.
A reader might object here that this all sounds too severe for institutional life as it is actually lived. Firms, agencies, courts, hospitals, landlords, schools, and employers do not operate under conditions of philosophical clarity. They operate under caseload, shortage, budget, scale, political pressure, public fear, vendor incentives, and ordinary managerial fatigue. That is exactly right. It is also one of the strongest reasons the book has argued what it has argued. A doctrine built only for ideal institutions is no doctrine at all. Under real conditions, performance pressure will always tempt institutions to buy speed with preemption, certainty with prediction, and legitimacy with the visible shell of procedure rather than with its practical burden. The reason the book’s limits sound severe is that the incentives to evade them are ordinary and constant. A weaker standard would therefore not be a pragmatic accommodation. It would be permission for institutions to continue treating collectibility as optional whenever it becomes expensive. The deeper realism in the book is administrative rather than romantic. Institutions under pressure will not spontaneously preserve answerability unless law, procurement, governance, and public doctrine make nonanswerability costly enough to matter.
This is where the manuscript’s self-critical passage should also remain in view. A theory that merely heightens perception of domination without increasing leverage becomes another form of burden. It gives the governed more scenes to interpret and more reasons to scan while leaving the actual channels of interruption unchanged. The book has tried not to do that. Its argument has not been that one should perceive more domination everywhere. It has been that one should discriminate more carefully between evidentiary support that remains interruptible and preemptive authority that defeats the conditions of interruption. The distinction matters because it leaves room for governance to exist without either capitulating to technocratic inevitability or collapsing into total refusal. The doctrine is not purity. It is hierarchy. Prediction comes after answerability, not before it. Procedure comes before closure, not after irreversibility. Support remains support only if it does not become suspicion’s intake valve. Prevention remains prevention only if it does not widen coercive reach before proof. Prudence remains prudence only if it does not become anticipatory exclusion. Performance remains evaluation only if it does not become continuous evaluative custody.
In the end, then, the book’s claim is not only legal or institutional. It is civic. A public order in which people are routinely governed through futures they cannot answer will eventually lose more than fairness in the narrow sense. It will lose the ordinary social confidence that one can still appear before institutions as more than the compressed meaning of one’s traces. It will lose the confidence that explanation might still matter because one’s speech arrives in time. It will lose the habit of treating authority as something that remains burdened by the presence of those it governs. Once that civic loss occurs, the remainder of legal language can continue for quite a long time. Notices will still be issued. Reports will still be generated. Hearings will still be held. Adverse-action reasons will still be printed. Model cards will still be uploaded. Governance boards will still meet. But those forms will have been separated from the relation that once gave them meaning. The person will no longer be received as the creditor of reasons. The institution will no longer feel itself to be in debt.
That is why the book’s final claim should be stated without multiplying foundations, though its philosophical implications are clear enough. A public order that treats persons first as foreseeable deviations from institutional preference, rather than as present-tense claimants to whom justification is owed, has already crossed the line this book means to draw. In Nussbaum’s terms, such an order weakens the practical conditions under which persons can participate in shaping the terms of their own lives rather than being governed as forecasted insufficiencies (Nussbaum). In Levinas’s terms, the relation is already damaged when classification arrives before encounter, when the other appears first as administratively foreseeable rather than as someone to whom present-tense obligation is still owed (Levinas). These are not identical grounds. They converge on the same political limit. The right to nonprediction is the demand that institutions not convert the future into prior administrative possession where that conversion would defeat answerability itself.
The manuscript is therefore not anti-procedural. It is anti-procedure without collectibility. It rejects the recurrent institutional move by which the presence of a notice, a report copy, a human reviewer, a portal, a hearing right, or a factor list is treated as enough to stabilize legitimacy. Procedure is morally serious only when it preserves the person as someone who can still matter against the archive, the score, the workflow, and the institution’s first interpretation of itself. Where procedure exists without that possibility, it functions as decorous domination. This is why time has mattered so much throughout the book. A reason that arrives after the rent is due, after the family is disrupted, after the warning has entered the file, after the worker has been managed out, after the benefits lapse, is not simply late. It announces that the institution preserved the ritual form of answerability while denying its practical content.
The final standard can now be stated without retreat. Legitimacy begins where reasons can be collected. Prediction is admissible only where institutions can prove, in attributable and contradictable form, that the governed remain able to collect the debts judgment incurs under bounded inference, retention, escalation, persuasion, penalty, and irreversibility. Where that cannot be shown, nonprediction is the only legitimate rule. This is not a policy preference among many. It is the limit that keeps law from becoming administration speaking probability to those it no longer needs to hear.
What the book has argued, in the end, is simple enough to state and difficult enough to live by. Institutions may act with evidence. They may not purchase legitimacy by turning evidence into preemptive authority while dissolving the conditions under which that authority can still be answered. The person remains the creditor. The institution remains the debtor. Everything turns on whether the debt can still be collected.
Works Cited
Akerlof, George A. “The Market for ‘Lemons’: Quality Uncertainty and the Market Mechanism.” The Quarterly Journal of Economics, vol. 84, no. 3, 1970, pp. 488–500.
Ahmed, Sara. Complaint!. Duke University Press, 2021.
Ajunwa, Ifeoma. “A.I. and Captured Capital.” Yale Law Journal Forum, vol. 134, 2025.
Ajunwa, Ifeoma. The Quantified Worker: Law and Technology in the Modern Workplace. Cambridge University Press, 2023.
Arendt, Hannah. The Human Condition. 2nd ed., University of Chicago Press, 1998.
“A Room That Is Not a Court: Rehearsal, Trust, and the Political Economy of Emergence.” Unpublished manuscript, 2026.
“Administrative Realism and the Rule of Substitutes: A Biblical Theology of Persons Against Idolatrous Governance.” Unpublished manuscript, 2026.
Administrative Procedure Act. 5 U.S.C. §§ 555(e), 706.
Allegheny County Department of Human Services. “Developing Predictive Risk Models to Support Child Maltreatment Hotline Screening Decisions: Allegheny County Methodology and Implementation.” 2019.
Allegheny County Department of Human Services. “Hello Baby.”
Allegheny County Department of Human Services. “Hello Baby Predictive Risk Model Policy: Use of and Access to the Model.” 2020.
Allegheny County Department of Human Services. “The Allegheny Family Screening Tool.”
Benjamin, Ruha. Race After Technology: Abolitionist Tools for the New Jim Code. Polity, 2019.
Biesta, Gert J. J. The Beautiful Risk of Education. Routledge, 2013.
Brown, Wendy. Undoing the Demos: Neoliberalism’s Stealth Revolution. Zone Books, 2015.
CFPB. See Consumer Financial Protection Bureau.
“Child Protection as Surveillance of African American Families.” See Roberts, Dorothy E.
Citron, Danielle Keats. “Technological Due Process.” Washington University Law Review, vol. 85, no. 6, 2008, pp. 1249–1313.
“Conduct Layer, The: Systems, Vulnerability, and the Ethics of Interior Life.” See “The Conduct Layer: Systems, Vulnerability, and the Ethics of Interior Life.”
“Contestable Life.” Unpublished manuscript, 2026.
Consumer Financial Protection Bureau. “CFPB Acts to Protect the Public from Black-Box Credit Models Using Complex Algorithms.” 2022.
Consumer Financial Protection Bureau. “CFPB Takes Action to Curb Unchecked Worker Surveillance.” 24 Oct. 2024.
Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2022-03: Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms. 2022.
Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2024-06: Background Dossiers and Algorithmic Scores for Hiring, Promotion, and Other Employment Decisions. 2024.
“Contestable Life.” Unpublished manuscript, 2026.
Daston, Lorraine, and Peter Galison. Objectivity. Zone Books, 2007.
“The Debt of Reasons.” Unpublished manuscript, 2026.
“Defensible Surprise, The.” See “The Defensible Surprise.”
“The Defensible Surprise.” Unpublished manuscript, 2026.
“Disputing Errors on Your Tenant Background Check Report.” Federal Trade Commission.
EEOC. See U.S. Equal Employment Opportunity Commission.
“Embodied Remainder, Institutional Closure, and the Legitimacy Crisis of the Synthetic Age.” Unpublished manuscript, 2026.
Employment Tests and Selection Procedures. See U.S. Equal Employment Opportunity Commission.
Equal Credit Opportunity Act. 15 U.S.C. § 1691(d)(3).
Eubanks, Virginia. Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor. St. Martin’s Press, 2018.
Fair Credit Reporting Act. 15 U.S.C. § 1681i.
“Fair Hearings.” 7 C.F.R. § 273.15.
Federal Trade Commission. “Disputing Errors on Your Tenant Background Check Report.”
Federal Trade Commission. “Tenant Background Checks and Your Rights.”
Federal Trade Commission. “Using Consumer Reports: What Landlords Need to Know.”
Federal Trade Commission. “What Tenant Background Screening Companies Need to Know About the Fair Credit Reporting Act.”
Federal Trade Commission and Consumer Financial Protection Bureau. “FTC and CFPB Seek Public Comment on How Background Screening May Shut Renters out of Housing.” 2023.
Friedman, Batya, and David G. Hendry. Value Sensitive Design: Shaping Technology with Moral Imagination. MIT Press, 2019.
Galanter, Marc. “Why the ‘Haves’ Come Out Ahead: Speculations on the Limits of Legal Change.” Law & Society Review, vol. 9, no. 1, 1974, pp. 95–160.
Goldberg v. Kelly. 397 U.S. 254. 1970.
Green, Ben. “Escaping the Impossibility of Fairness: From Formal to Substantive Algorithmic Fairness.” Philosophy & Technology, vol. 35, 2022, article 90.
Greene, Sara Sternberg. “Fraud as Poverty Governance.” Duke Law School Public Law & Legal Theory Series, 2026.
“Guidance on Application of the Fair Housing Act to the Screening of Applicants for Rental Housing.” U.S. Department of Housing and Urban Development, Office of Fair Housing and Equal Opportunity, 2024.
Han, Byung-Chul. The Transparency Society. Translated by Erik Butler, Stanford University Press, 2015.
Haraway, Donna J. Staying with the Trouble: Making Kin in the Chthulucene. Duke University Press, 2016.
Harcourt, Bernard E. Against Prediction: Profiling, Policing, and Punishing in an Actuarial Age. University of Chicago Press, 2007.
Health and Safety Executive. “How HSE Regulates.”
Herd, Pamela, and Donald P. Moynihan. Administrative Burden: Policymaking by Other Means. Russell Sage Foundation, 2018.
Herd, Pamela, and Donald P. Moynihan. “Administrative Burdens in the Social Safety Net.” Journal of Economic Perspectives, vol. 39, no. 1, 2025, pp. 129–50.
Hildebrandt, Mireille. Law for Computer Scientists and Other Folk. Oxford University Press, 2020.
Hirschman, Albert O. Exit, Voice, and Loyalty: Responses to Decline in Firms, Organizations, and States. Harvard University Press, 1970.
“How HSE Regulates.” Health and Safety Executive.
Jasanoff, Sheila, editor. States of Knowledge: The Co-Production of Science and Social Order. Routledge, 2004.
Jasanoff, Sheila. “The Idiom of Co-Production.” States of Knowledge: The Co-Production of Science and Social Order, edited by Sheila Jasanoff, Routledge, 2004, pp. 1–12.
Kelly, Tim, and Rob Weaver. “The Goal Structuring Notation: A Safety Argument Notation.” Proceedings of the Dependable Systems and Networks 2004 Workshop on Assurance Cases, 2004.
Leveson, Nancy G. Engineering a Safer World: Systems Thinking Applied to Safety. MIT Press, 2011.
Lessig, Lawrence. Code: Version 2.0. Basic Books, 2006.
Levinas, Emmanuel. Totality and Infinity: An Essay on Exteriority. Translated by Alphonso Lingis, Duquesne University Press, 1969.
MacKinnon, Catharine A. Toward a Feminist Theory of the State. Harvard University Press, 1989.
Mathews v. Eldridge. 424 U.S. 319. 1976.
Michigan Department of Labor and Economic Opportunity. “Michigan’s Unemployment Agency Completes Review of Fraud Determination Cases; Comprehensive Changes Underway to Improve Customer Service and Operations.” 11 Aug. 2017.
Michigan Office of the Auditor General. “Unemployment Insurance Agency, Department of Talent and Economic Development, Claimant Services.” July 2016.
Mills, Charles W. The Racial Contract. Cornell University Press, 1997.
Motor Vehicle Manufacturers Association of the United States, Inc. v. State Farm Mutual Automobile Insurance Co. 463 U.S. 29. 1983.
Mullane v. Central Hanover Bank & Trust Co. 339 U.S. 306. 1950.
National Labor Relations Board. “NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices.” 31 Oct. 2022.
Nissenbaum, Helen. Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford University Press, 2010.
“Notice of Adverse Action.” 7 C.F.R. § 273.13.
Nussbaum, Martha C. Creating Capabilities: The Human Development Approach. Harvard University Press, 2011.
Office of Science and Technology Policy. Blueprint for an AI Bill of Rights: Making Automated Systems Work for the American People. Executive Office of the President, 2022.
O’Neill, Onora. Autonomy and Trust in Bioethics. Cambridge University Press, 2002.
O’Neill, Onora. “Trust and Accountability in a Digital Age.” Philosophy, vol. 95, no. 1, 2020, pp. 3–17.
Pasquale, Frank. The Black Box Society: The Secret Algorithms That Control Money and Information. Harvard University Press, 2015.
Pateman, Carole. The Sexual Contract. Stanford University Press, 1988.
Perdue v. Gargano. 964 N.E.2d 825. Indiana Supreme Court. 2012.
Porter, Theodore M. Trust in Numbers: The Pursuit of Objectivity in Science and Public Life. Princeton University Press, 1995.
Power, Michael. The Audit Society: Rituals of Verification. Oxford University Press, 1997.
Rasmussen, Jens. “Risk Management in a Dynamic Society: A Modelling Problem.” Safety Science, vol. 27, no. 2–3, 1997, pp. 183–213.
“The Recourse Economy.” Unpublished manuscript, 2026.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 Apr. 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data. Official Journal of the European Union, 4 May 2016.
“The Residue Ledger: Verifiable Withdrawal for Data, Models, and Institutions.” Unpublished manuscript, 2026.
“Residue Ledger, The: Verifiable Withdrawal for Data, Models, and Institutions.” See “The Residue Ledger: Verifiable Withdrawal for Data, Models, and Institutions.”
Roberts, Dorothy E. “Child Protection as Surveillance of African American Families.” Journal of Social Welfare and Family Law, vol. 36, no. 4, 2014, pp. 426–37.
Roberts, Dorothy E. Torn Apart: How the Child Welfare System Destroys Black Families and How Abolition Can Build a Safer World. Basic Books, 2022.
Rothstein, Richard. The Color of Law: A Forgotten History of How Our Government Segregated America. Liveright, 2017.
“Rules Concerning Equal Credit Opportunity.” 12 C.F.R. § 1002.9.
“Sacramental Consent under Saturated Regimes.” Unpublished manuscript, 2026.
Schlund, Rachel, and Emily M. Zitek. “Algorithmic versus Human Surveillance Leads to Lower Perceptions of Autonomy and Increased Resistance.” Communications Psychology, vol. 2, 2024, article 53.
Scott, James C. Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed. Yale University Press, 1998.
SEC v. Chenery Corp. 332 U.S. 194. 1947.
Santosky v. Kramer. 455 U.S. 745. 1982.
State v. Loomis. 881 N.W.2d 749. Wisconsin Supreme Court. 2016.
Tabassi, Elham. Artificial Intelligence Risk Management Framework (AI RMF 1.0). National Institute of Standards and Technology, 2023.
“Tenant Background Checks and Your Rights.” Federal Trade Commission.
Texas Department of Housing and Community Affairs v. Inclusive Communities Project, Inc. 576 U.S. 519. 2015.
“Thick Friendship as Civic Technology: A Formal–Phenomenological Program.” Unpublished manuscript, 2026.
“The Conduct Layer: Systems, Vulnerability, and the Ethics of Interior Life.” Unpublished manuscript, 2026.
“Contestable Life.” Unpublished manuscript, 2026.
“The Debt of Reasons.” Unpublished manuscript, 2026.
“The Defensible Surprise.” Unpublished manuscript, 2026.
“The Residue Ledger: Verifiable Withdrawal for Data, Models, and Institutions.” Unpublished manuscript, 2026.
“The Right to Non Prediction: Computational Authority and the Collectibility of Reasons.” Unpublished manuscript, 2026.
“The Safety Case for Persons.” Unpublished manuscript, 2026.
“The Threshold Economy.” Unpublished manuscript, 2026.
“Unfinishedness: The Right Not to Be Made Legible.” Unpublished manuscript, 2026.
U.S. Department of Housing and Urban Development, Office of Fair Housing and Equal Opportunity. “Guidance on Application of the Fair Housing Act to the Screening of Applicants for Rental Housing.” 2024.
U.S. Equal Employment Opportunity Commission. “Artificial Intelligence and the ADA.”
U.S. Equal Employment Opportunity Commission. “EEOC Hearing Explores Potential Benefits and Harms of Artificial Intelligence and Other Automated Systems in Employment Decisions.” 31 Jan. 2023.
U.S. Equal Employment Opportunity Commission. “Employment Tests and Selection Procedures.”
Using Consumer Reports: What Landlords Need to Know. See Federal Trade Commission.
Vaithianathan, Rhema, et al. “Using a Predictive Risk Model to Prioritize Families for Prevention Services: The Hello Baby Program in Allegheny County, PA.” Prevention Science, vol. 26, 2025, pp. 321–330.
Weber, Max. Economy and Society. Edited by Guenther Roth and Claus Wittich, University of California Press, 1978.
Weil, Simone. Waiting for God. Translated by Emma Craufurd, Harper Perennial, 2001.
“What Tenant Background Screening Companies Need to Know About the Fair Credit Reporting Act.” Federal Trade Commission.
Jonathan Johnson-Swagel 
Leave a comment