Prologue. The Form on the Table
The form looks modest because institutional power usually learns to dress itself in the grammar of modesty. It does not arrive as decree. It arrives as a template, a rating field, a self-assessment box, a manager comment, a development plan, a calibration note, a required signature, a date of record, and a phrase asking the reviewer to summarize performance against agreed expectations. There may be nothing visually dramatic about it. A few sections, a few competencies, a few numbers, perhaps a box for narrative evidence, perhaps a field in which the year is compressed into one of several permissible ratings. The form may even be better than the informal judgment it replaces. It may slow impulse, require examples, discipline favoritism, create institutional memory, and prevent a manager from ruling by charisma alone. A formless institution is not humane. It is arbitrary. That is why the danger begins elsewhere, not when the institution uses a form, but when the form forgets that it is one.
A public federal performance appraisal template makes the problem visible without melodrama. The Senior Executive Service performance agreement provided by the U.S. Office of Personnel Management asks for consultation, progress review, summary rating, higher-level review, Performance Review Board recommendation, annual summary rating, rating levels, and rating derivation. The form’s power lies in its sequence. Work is first planned, then observed, then summarized, then reviewed, then translated into ratings, then stabilized as a record. The cycle appears administrative, and in one sense it is. OPM’s performance-management materials define rating as the act of evaluating performance against elements and standards, summarizing that performance, and assigning a rating of record (U.S. Office of Personnel Management, “Performance Management Cycle”). The phrase “rating of record” should stop the reader before any theory begins. The review is no longer only an episode of conversation. It becomes an artifact that can travel.
That travel is not automatically unjust. Institutions need records because memory without record is a privilege of the powerful and the socially protected. A worker who has been misread, overlooked, or treated inconsistently may need the form precisely because informal recognition is not enough. The written review can force a manager to name evidence, preserve achievement, document commitments, and make later denial harder. Max Weber’s account of bureaucracy remains indispensable here because it refuses the sentimental fantasy that durable administration can be built from personal goodness alone. Modern administration depends upon rule-bound offices, written documents, trained competence, and calculable procedures; without such forms, power retreats into personal favor, patrimonial discretion, and unstable memory (Weber). A performance review is therefore not the enemy of justice. It is one of the instruments by which institutional judgment can become less private.
Yet Weber also helps show why the form must be feared. Once judgment becomes record, the record can become the institution’s memory of the person. The form that was meant to coordinate evaluation can become a portable ontology. A year of work, conflict, recovery, skill, error, overload, improvisation, restraint, learning, and private cost becomes a few authorized categories. The institution may not say that the form is the person. It rarely needs to say so. It only needs to make future decisions as though the form contains the relevant truth. A rating moves into compensation. A phrase moves into succession planning. A developmental note moves into reputation. A calibration judgment moves into the background against which the next year’s work must defend itself. The form does not possess the whole person in theory, but it may possess the person in institutional practice.
The question, then, is not whether reviews are good or bad. That question is too crude for the object. The question is what a review is authorized to know.
A review form can know some things. It can receive evidence of deliverables, timeliness, collaboration, judgment, execution, leadership behavior, role-specific competence, and documented commitments. It can compare work against a defined standard. It can preserve examples that would otherwise disappear. It can require a manager to distinguish impression from evidence. It can identify where support, role clarity, or correction is needed. These are legitimate forms of institutional knowledge because work performed inside an institution is not purely private. It belongs partly to the shared world of obligation, dependence, trust, and consequence. To insist that no form may receive it would not protect persons. It would protect unrecorded discretion.
But the review form begins to exceed itself when it converts its limited access into a wider claim. It exceeds itself when “missed deadline under unclear ownership” becomes “lacks ownership.” It exceeds itself when “asked for clarification in a politically charged meeting” becomes “not sufficiently executive.” It exceeds itself when “managed preventable ambiguity created elsewhere” becomes “thrives in ambiguity,” turning institutional underdesign into personal virtue. It exceeds itself when a worker’s compensatory labor is praised as character while the conditions that required compensation disappear. It exceeds itself when tone becomes evidence without context, when polish becomes leadership, when exhaustion becomes attitude, when disability or grief is received as performance risk, when a strained route to a successful outcome is treated as evidence of sustainable excellence. The form was authorized to evaluate work. It was not authorized to own the person’s future meaning.
This is the first distinction on which the book depends: compression is not yet possession. All forms compress. A map is not a territory, a file is not a life, a rating is not a year, a transcript is not learning, a score is not risk itself, a death certificate is not grief, a consent checkbox is not moral permission for everything that follows. Institutions cannot act unless they compress. The question is whether they remember the compression. James C. Scott’s account of legibility matters because it shows how institutions make complex social worlds administratively visible by simplifying them into standardized categories, names, numbers, cadastral maps, records, and measures (Scott). Theodore Porter’s history of quantification adds the further point that numbers often become trusted where personal judgment is suspected; quantified procedure can appear objective precisely because it seems to reduce discretion (Porter). Daston and Galison complicate the same desire by showing that objectivity has a history, a discipline, and an ethic of trained restraint rather than the innocence of pure seeing (Daston and Galison). These sources do not prove that forms are false. They prove that forms are made.
Because forms are made, they inherit choices. A rating scale chooses what differences matter. A comment field chooses how much narrative can survive. A calibration meeting chooses who can reinterpret whose evidence. A performance category chooses whether route matters or only output. A signature line chooses who bears responsibility for the record. A review system chooses whether the subject can meaningfully interrupt the official account. The form’s design is therefore already a jurisprudence, even before any lawyer names it as such. It allocates standing, voice, burden, memory, and consequence.
A hostile reader may object that this language is inflated. A performance review is a workplace tool, not a court. It does not imprison anyone. It does not formally adjudicate legal status. It helps an organization allocate compensation, compare employees, reward excellence, identify gaps, and create expectations. The objection is serious because it protects a real administrative good. Institutions cannot govern themselves by endless individualized narration. They must make comparative judgments, and comparison requires some common surface. The review form’s defenders can plausibly say that the alternative is not liberation but favoritism, inconsistency, litigation risk, and managerial evasion.
The answer is not to deny the objection. The answer is to make the objection more exact. Precisely because performance reviews coordinate consequences, they require jurisdictional discipline. If a form affects pay, promotion, internal mobility, reputation, role assignment, or future opportunity, it is not a casual managerial note. It is a receiving device with institutional authority. Its legitimacy depends on whether its purpose justifies what it receives, whether its evidence supports what it infers, whether its subject can contest what it records, whether its memory can be revised, and whether its consequences can be repaired. The word jurisdiction enters here not as metaphorical excess but as a name for bounded authority. A form has jurisdiction when it has earned the authority to receive, infer, preserve, decide, transmit, and act upon what it has received. A form overreaches when it claims more than its purpose, evidence, contestability, revisability, and reparability can justify.
The review form on the table is therefore severe enough to open a book because it is ordinary. It does not need spectacular cruelty to matter. It belongs to the respectable world of planning, feedback, calibration, leadership development, and accountability. It may be administered by decent people. It may improve on what came before. It may be filled out by a manager who genuinely wants to be fair and read by a worker who genuinely wants to grow. The danger persists because the injury is structural. The form receives a fragment under one purpose and may later act as if it possesses the whole.
A just review form would not abolish evaluation. It would become more explicit about its limits. It would separate evidence from inference. It would require claims about conduct to be tied to concrete episodes. It would distinguish output from route. It would ask where success depended on unsustainable compensation. It would identify institutional ambiguity rather than converting all ambiguity into a test of personal resilience. It would state which judgments are current and which may not be used as future custody. It would create a genuine correction pathway. It would refuse to let developmental language become permanent diminishment. It would preserve managerial judgment without letting managerial perception become metaphysical verdict. It would know that the person appears in the form only partially.
This book begins there because modern institutional life is filled with forms that do not know they are forms. A benefits notice designed to explain eligibility can become the exhausted totality of what the institution thinks it owes. A tenant screening report designed to summarize risk can become a housing denial whose reasons the applicant cannot meaningfully see or repair. A child welfare risk score designed to assist screening can become a substitute for accountable judgment. An AI assistant interaction designed to help a vulnerable user can turn distress into memory, personalization, inference, or escalation. A consent screen designed to authorize one transaction can become the moral alibi for downstream propagation. A dashboard designed to summarize can become the official reality against which lived experience must defend itself. A complaint pathway designed to receive harm can become a machine for narrowing what harm is allowed to mean. A burial record, tomb, or custody narrative can become the claim that procedure has final authority over the violated body.
The form on the table has opened the problem. The rest of the book asks what follows if we take the object seriously. Modern institutions are not legitimate simply because they have procedures, nor illegitimate simply because they use abstraction. They become legitimate only when the forms through which they see, classify, remember, evaluate, automate, consent, correct, and finalize remain within the jurisdiction their purpose can justify, their evidence can support, their subjects can contest, and their consequences can repair. The review form does not prove that doctrine. It requires it.
Introduction. The Jurisdictional Question
The annual review form is still on the table, but it no longer sits alone. Beside it are other artifacts, each modest in appearance and consequential in operation: a benefits notice, a tenant screening report, a child welfare risk score, an AI assistant trace, a consent flow, a withdrawal request, a data lineage diagram, a dashboard, a complaint pathway, an appeal form, and a burial record. Each receives something partial. Each translates what it receives into an institutional medium. Each makes some portion of a person, claim, event, wound, work, identity, risk, future, or obligation available for action. None of these forms is inherently abusive. The state cannot administer benefits without notices. Housing providers cannot make every decision without information. Child welfare agencies cannot ignore risk. AI systems cannot operate without interaction traces. Consent cannot be administered without some record of authorization. Dashboards can help institutions perceive patterns otherwise hidden by scale. Appeals need pathways. Burial requires custody, witness, and record. The problem is not that institutions use forms. The problem is that modern institutions repeatedly lose the distinction between receiving a fragment and owning the person, claim, future, body, or meaning from which that fragment came.
This book gives that distinction a name: the jurisdiction of form.
A form, in the sense used here, is any structured medium through which an institution receives, translates, stores, evaluates, transmits, or finalizes some portion of a person, claim, event, wound, work, identity, risk, future, or obligation. A form may be a paper template, a database field, a scoring model, a notice, a rubric, a report, a dashboard, a consent screen, a complaint channel, an appeal pathway, a model output, a file, a transcript, a record, a certificate, or a ritualized procedure. Form is not reducible to paperwork. It is the structured condition under which something becomes institutionally receivable.
Jurisdiction, in this book, means the bounded authority a form has earned to receive, infer, preserve, decide, transmit, and act upon what it has received. The term is legal in origin but not confined here to courts. That extension is deliberate and must be defended at the start. Courts have jurisdiction when they possess lawful authority over persons, subject matter, territory, or procedure. Institutional forms are not courts, but they routinely exercise bounded authority over what may be asked, known, inferred, remembered, circulated, corrected, and acted upon. A benefits notice may not have judicial jurisdiction, but it can determine whether a person understands why assistance has been denied or terminated. A tenant screening report may not be a court judgment, but it can help decide whether a person is housed. A performance review may not adjudicate legal status, but it can attach durable consequences to a worker’s future. A risk score may not remove a child by itself, but it can shape the decisional environment in which removal becomes more or less likely. Jurisdiction names the boundary between authorized reception and overclaim.
Jurisdictional overreach occurs when a form claims more authority than its purpose, evidence, contestability, revisability, and reparability can justify. Possession is the deeper corruption: the false conversion of reception into ownership. A form possesses when it treats what it has received as if it now controls the person, future, body, claim, or meaning from which that fragment came. A non-possessive form receives without totalizing, remembers without finalizing, judges without foreclosing revision, and acts without claiming the full truth of the person it has handled.
The thesis of the book can therefore be stated coldly. Modern institutions are legitimate only when the forms through which they see, classify, remember, evaluate, automate, consent, correct, and finalize remain within the jurisdiction their purpose can justify, their evidence can support, their subjects can contest, and their consequences can repair. That sentence is not offered as an ethical atmosphere. It is a test. It asks what a form receives, what it is authorized to receive, what it infers beyond what it receives, who can see those inferences, who can contest them, what the form remembers, where residue travels, what decisions the form enables, what consequences it triggers, what remedies exist, what the form must refuse to know, and what it must refuse to finalize.
The opening review form makes the doctrine concrete because it shows that ordinary artifacts can overclaim without announcing themselves as sovereign. But the book’s object is wider than workplace evaluation. Consider the benefits notice. In Goldberg v. Kelly, the Supreme Court treated welfare benefits as statutory entitlements whose termination required procedural due process before deprivation, emphasizing the recipient’s interest in uninterrupted assistance for essentials such as food, clothing, housing, and medical care. 397 U.S. 254, 261–71 (1970). In Mathews v. Eldridge, the Court articulated the now-familiar balancing inquiry: the private interest affected, the risk of erroneous deprivation under existing procedures and probable value of additional safeguards, and the government’s interest, including administrative burden. 424 U.S. 319, 335 (1976). Those cases do not solve the jurisdiction of form, but they expose the stakes. A notice is not merely communication. It is a procedural form that can either make a decision interruptible or seal the affected person inside an official account they cannot contest.
The same logic appears in tenant screening. HUD’s 2024 guidance on rental housing screening explains how the Fair Housing Act applies to screening practices, including practices involving automation, machine learning, and artificial intelligence. The guidance recognizes that housing providers have legitimate interests in selecting tenants who will pay rent and comply with lawful lease requirements, but warns that imprecise or overbroad screening criteria may unjustifiably exclude people from housing opportunities in discriminatory ways (U.S. Department of Housing and Urban Development). CFPB materials sharpen the point from the perspective of the applicant: tenant background checks can contain errors, false information, outdated records, misleading criminal or eviction information, and adverse-action notice failures that leave renters unable to discover or repair the reports that helped exclude them (Consumer Financial Protection Bureau, “Tenant Background Checks”). The tenant screening report is therefore not just information. It is a receiving form that may convert fragmentary records into a practical housing judgment. Its jurisdiction depends on whether the report’s purpose authorizes what it gathers, whether its evidence supports what it implies, whether the applicant can see and dispute it, whether errors can be corrected in time, and whether denial can be meaningfully repaired.
Child welfare risk screening places the question under still greater pressure. Allegheny County describes the Allegheny Family Screening Tool as a predictive risk modeling tool used since August 2016 to enhance child welfare call screening, integrating hundreds of data elements from the county’s data warehouse and producing a Family Screening Score that predicts long-term likelihood of future child welfare involvement (Allegheny County Department of Human Services). The official description is careful to place the score alongside traditionally gathered information, which matters. The score is not formally the whole decision. Yet the jurisdictional question remains: what authority does a predictive score earn when it enters a decision environment already marked by urgency, liability fear, racialized surveillance histories, resource scarcity, and asymmetrical contestability? The book will not answer by treating automation as inherently illegitimate. It will ask a harder question: when does assistance become substitution? A form designed to support judgment exceeds itself when its output becomes the practical center around which judgment reorganizes, especially where affected families cannot meaningfully see, contest, or repair the score’s role.
Artificial intelligence intensifies but does not create the problem. NIST’s AI Risk Management Framework 1.0 is a voluntary, non-sector-specific, use-case-agnostic framework for managing AI risks and promoting trustworthy AI development and use (National Institute of Standards and Technology). The EU AI Act, Regulation (EU) 2024/1689, establishes a risk-based legal framework for AI systems in the European Union. Colorado SB24-205, as amended by SB25B-004, creates and delays state-level obligations around high-risk AI systems, with the amended effective date extended to June 30, 2026. These regimes matter because they show that law is now struggling to govern systems that classify, infer, personalize, recommend, score, and trigger consequences at scale. Yet AI governance often begins too late if it begins only with model risk, output harm, or compliance documentation. The jurisdictional question asks what the receiving form is authorized to do at the moment of encounter. When a person discloses grief, panic, illness, shame, fear, family distress, or moral confusion to an AI assistant, vulnerability has appeared inside a system interaction. Many systems are designed to treat such disclosure as actionable signal. This book reverses the instinct: interior vulnerability narrows jurisdiction; it does not expand it.
Consent after propagation reveals another defect in ordinary institutional reasoning. Consent is often treated as an intake event. A person clicks, signs, enrolls, authorizes, accepts, or proceeds. The institution stores the fact of consent as if the original transaction has settled the moral and legal status of future use. But modern data systems propagate. Data is copied, backed up, transformed, enriched, summarized, embedded, trained on, audited, exported, shared with vendors, and recombined. The jurisdiction of consent decays as data moves away from the context, purpose, and intelligibility of the original transaction. Original consent does not automatically authorize downstream artifacts. A withdrawal request may not be able to erase every residue, but unverifiable residue may not silently govern future life. The institution must be able to say what remains, why it remains, who can access it, how long it remains, what it may not be used for, and what evidence supports the claim.
Dashboards make the same danger visible through summary. A dashboard may help an institution perceive backlog, error, inequity, demand, delay, risk, or workload. It may be an instrument of accountability. But when the dashboard becomes the official reality, lived experience must defend itself against the summary. The dashboard’s jurisdiction is exceeded when it treats what it can display as the whole field of what matters. A metric review ritual can discipline drift, but it can also train workers to live in anticipation of the display. Forms govern not only when they are applied. They govern when they are expected. A performance review shapes the year before it is written. A promotion packet shapes conduct before it is assembled. A complaint process shapes speech before anyone files a complaint. A dashboard captures time before data capture begins because people adapt to the imagined future surface.
The book’s legal genealogy begins from administrative and procedural law but does not stop there. Londoner v. Denver and Bi-Metallic Investment Co. v. State Board of Equalization establish an early distinction between situations requiring individualized hearing and broad rule-like decisions affecting many persons. 210 U.S. 373 (1908); 239 U.S. 441 (1915). Goldberg and Mathews make deprivation, error risk, and process central. SEC v. Chenery Corp. insists that agency action must be judged by the grounds the agency invoked. 318 U.S. 80 (1943). United States ex rel. Accardi v. Shaughnessy requires agencies to follow their own rules. 347 U.S. 260 (1954). Citizens to Preserve Overton Park, Inc. v. Volpe and Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co. make administrative reason-giving, record review, and arbitrary-and-capricious scrutiny indispensable. 401 U.S. 402 (1971); 463 U.S. 29 (1983). These cases are not quoted here as decorative authority. They establish a pressure field: institutional action becomes legitimate only where reasons, records, procedure, authority, and review can be made answerable.
Yet the jurisdiction of form is not simply procedural due process under another name. Due process asks what process is due before or after certain deprivations, particularly by the state. This book asks a broader question about the authority of receiving forms across public, private, hybrid, automated, bureaucratic, intimate, and theological domains. A private tenant screening report may not be state action, but it can still structure access to housing. A workplace review may not trigger constitutional due process, but it can still overclaim institutional knowledge. A consent flow may satisfy one legal requirement while failing to govern downstream residue. A dashboard may be lawful and still become the wrong jurisdictional surface for human reality. The book radicalizes due process by asking not only whether a person had procedure, but whether the form itself had authority to know, infer, remember, transmit, and finalize as it did.
Nor is the book simply privacy theory, although it depends on privacy. Helen Nissenbaum’s theory of contextual integrity remains foundational because it shifts privacy analysis away from secrecy and toward appropriate information flows governed by context-relative norms (Nissenbaum). Julie Cohen’s work shows how networked information power shapes subjects, markets, and governance structures rather than merely moving data between static individuals and firms (Cohen). Danielle Citron’s account of privacy insists on dignity, identity, love, and the injuries caused when exposure violates the conditions of personhood (Citron). Frank Pasquale’s black-box critique exposes opaque systems that govern money, reputation, and opportunity without adequate accountability (Pasquale). These works are indispensable, but the jurisdiction of form names a different object. Privacy asks when information may flow. Jurisdiction of form asks what authority the receiving structure has earned over what it receives. It is possible for information to flow within a superficially authorized channel and still be used by a form that overclaims its jurisdiction.
Nor is the book simply AI ethics. AI ethics often asks whether systems are fair, transparent, safe, accountable, explainable, robust, or aligned with human values. Those questions matter. But they can become too system-centered if they begin with the model rather than the institutional form through which the model acts. Accuracy illustrates the danger. A system may be more accurate than a human baseline and still be illegitimate if the affected person cannot understand, contest, correct, or repair the decision. Accuracy is a property of prediction. Legitimacy is a property of authority. They are not interchangeable. The technocrat’s strongest argument must be granted: automated systems can reduce some forms of arbitrary human bias, inconsistency, fatigue, favoritism, and hidden discretion. But reducing one kind of arbitrariness does not authorize non-interruptible judgment. A more accurate instrument can still be an overreaching form.
Science and technology studies supply another indispensable pressure. Sheila Jasanoff’s work on co-production shows that knowledge and social order are formed together rather than in separate domains (Jasanoff). Geoffrey Bowker and Susan Leigh Star show classification as infrastructure, made durable through standards, categories, and often invisible labor (Bowker and Star). Bruno Latour’s inscription chains show how facts travel by being written, stabilized, circulated, and mobilized within networks (Latour). Lucy Suchman’s account of human-machine reconfigurations resists the fantasy that technical plans simply execute in neutral environments (Suchman). Ruha Benjamin, Safiya Noble, Virginia Eubanks, Kate Crawford, Solon Barocas, Andrew Selbst, and Inioluwa Deborah Raji expose how sociotechnical systems distribute burden, reproduce hierarchy, abstract away social context, and make accountability difficult precisely where systems present themselves as neutral or efficient (Benjamin; Noble; Eubanks; Crawford; Selbst et al.; Raji et al.). Their collective importance is not that they make the book contemporary. It is that they prevent the jurisdiction of form from becoming an idealist theory of artifacts. Forms are not only ideas. They are infrastructures, incentives, classifications, data flows, histories, and social arrangements that make some persons easier to reduce than others.
The theological spine enters under an even stricter rule. No theological term appears unless it changes the jurisdiction of judgment. Genesis does not enter because “image of God” sounds elevated. It enters because the claim that human beings are made in the image of God refuses the reduction of persons to artifacts made by human hands (Gen. 1.26–27). Exodus and Deuteronomy do not enter because idolatry is a useful metaphor for bad abstraction. They enter because the prohibition of idols is a jurisdictional claim about representation: a human-made image must not receive devotion or authority that belongs elsewhere (Exod. 20.4–6; Deut. 5.8–10). The law against false witness matters because it treats representation as a matter of justice toward the neighbor rather than as a private expressive failure (Deut. 19.15–21). The Gospel passion and burial narratives matter because they place body, witness, custody, authority, tomb, record, and contested finality under pressure. Paul’s account of resurrection in 1 Corinthians 15 matters not as consolation but as a public denial that death’s completed procedure exhausts truth (1 Cor. 15.12–28). Theology, in this book, is not atmosphere. It is a grammar for why no form that has handled a person, claim, or violated body may claim final custody simply because its procedure has ended.
A second hostile objection now appears. Does the book’s argument condemn nearly all institutional life? If every form risks overreach, and if every institution requires forms, does the project leave us only with suspicion? The objection has force because modern criticism often grows stronger at diagnosis than at design. A theory that makes every artifact suspect can become politically useless, morally theatrical, and administratively naive. Institutions cannot wait for perfectly non-reductive knowledge before acting. A hospital must triage. A school must grade. A court must decide. A benefits office must determine eligibility. A housing provider must screen. A workplace must evaluate. A child welfare agency must respond under uncertainty. A society without forms would not become more humane. It would route power through charisma, memory, informal hierarchy, hidden judgment, and discretionary violence.
The book’s answer is jurisdictional humility, not formlessness. A just institution is not transparent in every direction, therapeutic in every encounter, infinitely revisable in every judgment, or endlessly forgiving of every harm. It must decide. It must remember. It must classify. It must sometimes act before certainty. But it must know what it may ask, what it may infer, what it may preserve, what it must disclose, what it must let the subject contest, what it must correct, what it must repair, what it must refuse to know, and what it must refuse to finalize. Jurisdictional humility is not weak administration. It is administration that has learned the limits of its own artifacts.
The third objection is disciplinary. Privacy, due process, administrative law, AI governance, STS, and theology already address much of this terrain. Why introduce another vocabulary? The answer is that each field names part of the problem, but the receiving form moves across them. Privacy can show when exposure is improper, but not every injury arises from too much disclosure. Due process can show when deprivation requires procedure, but not every consequential form is a state actor. Administrative law can test agency reasons, but not every institutional overclaim appears as agency action. AI ethics can regulate model behavior, but not every form is computational and not every computational injury is reducible to model output. STS can explain classification, but it may not always supply the normative standard by which an artifact’s authority is bounded. Theology can defend the irreducibility of the person, but it can become soft or imperial if it does not submit itself to legal, institutional, and material proof. Jurisdiction of form is the crossing concept. It does not replace these fields. It gives them a common object.
The book proceeds accordingly.
Chapter 1, “The Form That Forgot It Was a Form,” establishes the governing enemy. The enemy is not form, because form is necessary for law, medicine, administration, memory, coordination, science, archives, music, and common life. The enemy is the form that forgets its partiality. The chapter distinguishes legitimate compression from illegitimate possession through the performance review, benefits notice, and dashboard. It makes the reader concede that institutions require abstraction and that abstraction becomes unjust when the artifact claims moral exhaustiveness.
Chapter 2, “Evidence Without Exposure,” relocates privacy inside jurisdiction. The chapter refuses both transparency absolutism and romantic opacity. Visibility is legitimate only when purpose, proportionality, permissible use, duration, contestability, and repair are satisfied. The chapter’s central question is not whether a person values privacy, but whether an institution has earned the authority to demand, retain, infer from, and transmit the evidence it seeks. Tenant screening, consumer reports, Fourth Amendment doctrine, the Privacy Act, GDPR, HUD guidance, CFPB materials, and the Fair Credit Reporting Act provide the archive.
Chapter 3, “The Substitute and the Person,” gives the book its theological and semiotic doctrine. Representation is necessary because common life requires names, signs, records, maps, files, scores, and testimony. Substitution begins when the representation stands in for the person in an institutional process. Idolatry begins when the substitute demands the authority of the person themselves. Genesis, Exodus, Deuteronomy, Peirce, Latour, Arendt, Cover, and evidentiary law create the chapter’s pressure. The chapter fails if idol means only bad abstraction. Idol must mean a representation that usurps jurisdiction over the represented.
Chapter 4, “Judgment That Can Be Interrupted,” converts reasons into a doctrine of interruptibility. Judgment remains legitimate only where the affected person can interrupt the chain between classification and consequence through notice, reasons, access to evidence, accountable actors, meaningful appeal, revision, and remedy. The chapter opposes comparative accuracy as a sufficient justification for automated or administrative systems. Accuracy can improve a prediction while leaving authority illegitimate. Goldberg, Mathews, Loudermill, Hamdi, State Farm, Chenery, Accardi, adverse-action notices, Colorado AI law, and the EU AI Act provide the legal pressure.
Chapter 5, “Conduct Near the Interior,” develops the book’s most specific AI governance contribution. Its governing law is simple: interior vulnerability narrows jurisdiction; it does not expand it. When a person discloses grief, panic, shame, illness, fear, family distress, or moral confusion inside an AI-mediated interaction, the system’s authority contracts. The chapter distinguishes assistance from extraction and creates the conduct-layer doctrine: not only what data may be collected or what outputs may be harmful, but what the system is allowed to do once interior vulnerability becomes visible.
Chapter 6, “Consent After Propagation,” treats consent as temporally decaying authority. Modern systems train, summarize, infer, sync, enrich, export, back up, audit, and recombine. Original consent does not automatically authorize downstream artifacts. The chapter distinguishes withdrawal, deletion, isolation, non-use, retention expiry, model unlearning, and evidentiary certification. Its design contribution is the residue ledger, but the ledger remains subordinate to jurisdiction. It matters only because institutions must be able to prove what remains and what no longer governs.
Chapter 7, “The Interval Before the Form,” gives the book its temporal doctrine. Forms govern not only when they are applied but when they are anticipated. The performance review shapes the year before it is written. The possible complaint shapes speech before complaint exists. The promotion packet shapes conduct before submission. The dashboard captures time before the metric is entered. The chapter develops pre-form governance: anticipatory self-formatting under institutional expectation. It must make anticipation legally and institutionally legible without reducing it to mood.
Chapter 8, “Standards, Strain, and Route-Sensitive Judgment,” asks whether a form can distinguish achievement from the route by which achievement was produced. A person can meet a standard through craft, joy, support, terror, dissociation, mimicry, perfectionism, or unsustainable compensation. A standard exceeds its jurisdiction when it treats costly compensation as evidence of virtue rather than evidence of missing support. Musical pedagogy enters only as proof object, not ornament. A correct note can be produced through constriction. A correct institutional output can be produced through damage. Standards become unjust when they cannot hear strain.
Chapter 9, “Credible Futures and the Forms That Kill Them,” turns modal foreclosure into institutional theory. Many forms leave options technically open while destroying the conditions under which those options can become credible. Duration, semantic room, material reversibility, error tolerance, and social seriousness become the chapter’s five conditions of credible futurity. School tracking, hiring filters, credit records, criminal records, medical diagnoses, performance files, and immigration files show how formal openness can coexist with practical foreclosure.
Chapter 10, “Friendship, Witness, and the Non-Possessive Form,” uses friendship as a negative laboratory. Friendship is not the policy proposal. Institutions cannot become friends, and any institution claiming friendship should be distrusted. But friendship reveals that reception does not confer ownership. A friend may hear pain without turning it into a file, remember history without freezing identity, and correct without humiliation. The chapter extracts practices of non-possessive form while refusing institutional sentimentality.
Chapter 11, “Resurrection Against Final Form,” is the theological summit and must be written without devotional softness. Resurrection is treated as a public metaphysics of non-final custody. Holy Saturday becomes the archive of body, tomb, witness, custody, guarded finality, and contested meaning. The chapter’s governing claim is that no form that has handled the violated body may claim the authority of final truth simply because it has completed its procedure. Resurrection is not optimism. It is the denial that completed procedure equals final truth.
Chapter 12, “Forms That Do Not Possess,” delivers the doctrine rather than summarizing the book. The conclusion returns to the annual review form because the book must end where it began: with the mundane artifact redesigned. A review form that does not possess separates evidence from inference, performance from personhood, output from route, present judgment from future custody, managerial perception from metaphysical verdict, and compensation decision from total worth. The ending proves the theory by making it operational.
The book’s method follows from this sequence. Each chapter begins with an artifact or archive rather than atmosphere. Each major source receives a job. Each positive concept must face its counterfeit. Each chapter must specify whose burden increases when a form overclaims. Each chapter must defeat the strongest objection it can find. The book will not survive if it becomes a gallery of brilliant terms. The discipline is stricter: no concept appears unless it can judge a form. No theological term appears unless it changes the jurisdiction of judgment. No aesthetic term appears unless it explains how a form widens or narrows possible life. No sentence survives because it is beautiful. It survives because it makes an artifact answerable.
The annual review form, then, was not an example chosen for convenience. It was the first proof of the book’s scale. If the doctrine can govern only spectacular systems, it is not yet a jurisprudence. If it can govern only AI, it is too narrow. If it can govern only law, it misses private institutional power. If it can govern only theology, it risks becoming unanswerable. But if it can govern the review form, the benefits notice, the tenant screening report, the risk score, the AI trace, the consent flow, the dashboard, the complaint pathway, the data lineage diagram, and the burial record, then it names something modern institutions cannot evade. Forms have jurisdiction. Injustice begins when they overclaim.
Chapter One. The Form That Forgot It Was a Form
The completed form rarely looks powerful after the meeting ends. It looks exhausted, administrative, already absorbed into the ordinary circulation of the institution. The conversation that produced it may have been tense or gracious, rushed or careful, intimate or procedural, but the form now has a different life. It no longer depends on the tone of the meeting, the hesitation before a phrase was chosen, the correction that almost entered the record but did not, the context the manager understood but omitted, the year that could not be made fully narratable, or the worker’s private knowledge of what the institution asked but never named. It sits inside a system. It becomes a rating of record, a summary, a trace, a field that can be retrieved, compared, transmitted, defended, ignored, or mobilized later by someone who was not present. The form’s danger begins there, after the human exchange has ended and the artifact remains.
That danger should not be misunderstood. A performance appraisal form is not an enemy of justice simply because it compresses a year of work into categories. The federal performance-management framework, for example, treats performance management as a cycle of planning, monitoring, developing, rating, and rewarding, and defines rating as evaluating performance against elements and standards, summarizing performance, and assigning a rating of record. OPM explicitly says that ratings of record may bear on personnel actions such as within-grade increases and retention service credit in a reduction in force, which means the artifact is not only descriptive but consequential. Federal regulation similarly defines appraisal as the process by which performance is reviewed and evaluated, defines the appraisal period as the time for which performance will be reviewed and a rating of record prepared, and defines the rating of record as the performance rating prepared at the end of that period for agency-assigned duties, together with the assignment of a summary level. These definitions matter because they show the form doing legitimate work. It organizes expectation, preserves institutional memory, links work to standards, and turns otherwise unstable managerial perception into something that can be reviewed.
A serious theory of institutional form must begin by conceding this necessity. The form is not an intrusion into an otherwise innocent world of direct human recognition. Recognition without form is often recognition captured by proximity, charisma, fluency, patronage, affective comfort, and managerial preference. The worker who does not resemble the manager’s image of seriousness may need a form. The employee whose work happens in hidden coordination, burden absorption, quiet repair, cross-team translation, or prevention of visible failure may need a record. The person subject to inconsistent or prejudiced judgment may need an evidentiary surface on which claims can be made. Modern administration requires written memory, repeatable procedure, reviewable categories, and standards that can be shared beyond the room. Weber’s account of bureaucratic administration remains indispensable precisely because it refuses the fantasy that personal benevolence can replace durable office, written documents, trained competence, and rule-bound procedure (Weber). A formless institution does not become humane. It becomes private.
The problem, then, is not that forms simplify. The problem is that forms can forget that simplification is what they are doing. A form becomes unjust when the institution treats necessary simplification as morally exhaustive reception. The review form is authorized to receive evidence of performance within a defined role and period. It is not authorized, without further proof, to become the person’s institutional essence. It may record that a project missed a deadline. It may not silently convert that fact into an ontology of irresponsibility when ownership, resourcing, upstream delay, ambiguous decision rights, or impossible workload also shaped the event. It may record that a person required repeated clarification. It may not automatically convert that clarification into insufficient executive presence when the form itself has no field for the strategic ambiguity that made clarification necessary. It may record that a person delivered exceptional output. It may not treat that output as proof of sustainable excellence if the route to achievement required depletion, fear, overcontrol, or invisible compensatory labor. The form becomes possessive when the institution lets the record stand as the person, the rating stand as the year, the category stand as the truth, and the summary stand as the full moral reality of work.
This is the chapter’s first distinction: compression is not possession. Every institution compresses because common life requires shared surfaces. A court record compresses testimony. A medical chart compresses illness. A transcript compresses education. A dashboard compresses operational life. A benefits notice compresses eligibility, rule, and consequence. A performance rating compresses work into a level that can travel. The moral question is not whether compression occurs. It is whether the institution preserves the difference between what the form receives and what it cannot know. Scott’s account of institutional legibility is useful here because it shows that administrative seeing depends upon simplification, standardization, and comparability, while also warning that the simplified representation can be mistaken for the field it was built to manage (Scott). Porter helps explain why this mistake becomes seductive: quantified or formalized judgment can appear more trustworthy than personal judgment precisely where institutions distrust discretion and seek objectivity through impersonal procedure (Porter). Daston and Galison add the needed historical discipline: objectivity is not neutral sight outside history, but a trained ethos of restraint, discipline, and managed subjectivity, which means that institutional objectivity must be designed and governed rather than presumed (Daston and Galison).
The performance review becomes the first proof object because it is ordinary enough to expose the mechanism without spectacle. OPM’s performance-management cycle says performance elements and standards should be measurable, understandable, verifiable, equitable, and achievable, while progress reviews compare performance against those standards and allow unrealistic or problematic standards to be changed. The best version of the form is already more intelligent than its worst critic allows. It does not only rate. It plans, monitors, develops, and rewards. It is supposed to involve employees in understanding goals, standards, feedback, and development. Its regulatory structure defines performance standards as management-approved expressions of thresholds, requirements, or expectations, including quality, quantity, timeliness, and manner of performance. The review form, properly bounded, is a coordination technology for institutional fairness. It can require that managers say what they expected, what evidence they considered, what period was evaluated, and how performance compares to standards.
Yet the same structure generates overreach because it gives the artifact portability. A written performance plan turns expectation into record. A rating turns record into summary. A summary turns work into comparative standing. Comparative standing turns into reward, retention, promotion, mobility, development, or reputational afterlife. None of those transitions is inherently wrongful, but each transition widens the distance between the form’s original jurisdiction and the later authority granted to it. The rating was prepared for work performed during a designated appraisal period. It may later become evidence of general potential. The comment was written to explain a project outcome. It may later become an account of temperament. The development note was meant to identify a needed skill. It may later become a shadow narrative of deficiency. The form’s institutional afterlife can exceed the authority of its original purpose.
The danger is especially acute because forms often hide inference inside description. A field labeled “results” appears to receive results. A field labeled “leadership behavior” appears to receive behavior. A field labeled “development area” appears to receive a need. But each field also contains interpretive decisions about what counts as evidence, what background conditions matter, what omissions are tolerable, and what language will survive later review. The form may say that it records performance against standards, but standards themselves contain a theory of work. They may privilege visible deliverables over invisible coordination, speed over repair, presentation over substance, executive fluency over epistemic care, heroic rescue over patient prevention, and self-promotion over shared infrastructure. The form is already an argument before anyone fills it out.
Bowker and Star’s work on classification helps explain why this matters beyond a single review. Classifications do not remain inert labels. Once embedded into systems, they become infrastructure: they coordinate work, structure memory, shape what later users can retrieve, and make some realities easier to see than others (Bowker and Star). A performance category that appears administrative in one cycle can become sediment in the next. It shapes how later managers read evidence. It teaches the employee what the institution can recognize. It teaches peers what is rewarded. It teaches HR and leadership what patterns can be compared. The category becomes less visible as it becomes more operative. That is the peculiar danger of institutional form: its authority often increases as its constructedness disappears.
The defender of the review form has a strong answer. Standardized appraisal systems reduce hidden discretion. They force managers to plan, document, compare, and justify. They make ratings reviewable. They can expose inflated praise, patterned bias, inconsistent expectations, and undocumented punishment. They can also protect the institution from the volatility of charismatic judgment. A world without performance forms would not produce equitable recognition. It would often produce patronage with better manners. This objection must be granted. The argument of this book is not that formal evaluation corrupts otherwise pure human judgment. Informal judgment is already structured by power. The argument is that formal evaluation must remain within the jurisdiction its form can justify.
That jurisdiction has boundaries. The review form may receive performance evidence for a defined period. It may compare that evidence to disclosed standards. It may summarize the comparison in a rating. It may support decisions whose relationship to the rating is explicit and contestable. It may not silently turn a limited work record into a total theory of the person. It may not collapse role performance into moral worth. It may not use current ratings as future custody without stating how long the record will travel and for what purposes. It may not convert institutional failures of design into personal developmental deficits. It may not praise compensatory overextension without asking whether the standard has begun to reward damage. A form disciplined by jurisdiction does not need to contain the whole truth. It needs to stop pretending that the truth it contains is whole.
The same structure appears in the benefits notice, where the stakes are more immediate and the artifact more explicitly procedural. The SNAP notice of adverse action is an especially useful object because it is not an institutional villain. Federal regulation requires state agencies, before reducing or terminating a household’s benefits within a certification period unless an exception applies, to provide timely and adequate advance notice. The regulation defines timely notice as generally including at least ten days from mailing to effective action, and defines adequate notice as one that explains in easily understandable language the proposed action, the reason for it, the household’s right to request a fair hearing, contact information for the SNAP office, availability of continued benefits, liability for overissuances if the hearing decision is adverse, and free legal representation if available. This is form at its most defensible. It does not exist to dominate. It exists to prevent deprivation without warning, to translate agency action into intelligible terms, and to open the path toward contestation.
A benefits notice therefore complicates any simplistic suspicion of form. Without notice, the household may experience the institution only as disappearance: the benefit falls, the card no longer carries enough value, the explanation is inaccessible, the office is opaque, and the burden of discovering what happened falls on the person least able to absorb delay. The notice is an attempt to make action communicable. It tells the household that something will happen, why it will happen, when it will happen, and how the household may object. In Mashaw’s terms, bureaucratic justice depends not only on substantive accuracy but on the administrative rationality through which claims are processed, explained, and made subject to review (Mashaw). The notice is one of the forms through which a welfare bureaucracy attempts to become answerable.
But the notice also shows how a form can mistake communication for answerability. The regulation’s requirements are necessary, but they do not eliminate the jurisdictional problem. A notice can include the proposed action, the stated reason, hearing rights, office phone number, continued-benefit language, overissuance warning, and legal services information, while still failing the person who receives it. The reason may be formally present and practically opaque. The hearing right may exist but be inaccessible under time pressure, language barriers, disability, work schedules, caregiving obligations, mailing delays, fear, or distrust. The continued-benefits option may be stated but burdened by the threat of overissuance liability. The office phone number may be printed but unreachable. The legal aid reference may be included in a county where capacity is overwhelmed. The notice may satisfy its documentary burden while the decision remains difficult to interrupt.
The point is not that every legally adequate notice is unjust. The point is that notice has jurisdiction, and its jurisdiction is narrower than institutions often imply. A notice is authorized to communicate a decision, state reasons, preserve deadlines, and point toward procedural rights. It is not authorized to become the institution’s proof that the person has actually understood, had a realistic opportunity to contest, or possessed the practical means to repair error. When an institution treats the mailing of notice as the exhaustion of obligation, the form forgets itself. It converts a communicative artifact into a moral alibi.
This is a more disciplined claim than saying that notices are alienating or bureaucratic. Of course they are bureaucratic. That is partly why they exist. A notice must be standard enough to be administered at scale. It must express rules consistently. It must tell similarly situated households similar things. It must allow agencies to prove that procedural steps occurred. It must preserve evidence for later review. But the notice becomes possessive when the institution says, in effect, the form has spoken, therefore the institution has answered. There is a difference between receiving a notice and receiving an answer. There is a difference between being informed of a hearing right and being positioned to exercise it. There is a difference between being told why a benefit will change and being able to test whether the stated reason is correct.
Here again the distinction between compression and possession does the necessary work. The adverse-action notice compresses a complex eligibility decision into a proposed action, reason, deadline, and set of rights. That compression is legitimate if it remains tied to the person’s ability to understand and contest the action. It becomes possessive if the compressed account is treated as the only administratively relevant reality. Suppose the notice says income exceeded a threshold. The form may not show how income was calculated, whether a data match was stale, whether deductions were missed, whether household composition was misread, whether verification was requested but never received, whether the agency applied the correct period, or whether an exception applies. The notice may be formally true within its frame and still insufficient to make the underlying decision answerable. The form’s jurisdiction ends where explanation stops being usable.
A second defender now enters. Administrative systems cannot provide individualized legal counseling inside every notice. If every notice had to explain all possible evidentiary pathways, exceptions, calculations, and appeal strategies, the form would become unreadable, expensive, delayed, and perhaps less useful. Standardization protects people precisely because it gives them a clear, repeatable structure. This objection is serious. Too much context can become another kind of opacity. A form overloaded with qualifications can bury the action under administrative prose and leave the recipient with more paper but less power.
The answer is bounded jurisdiction again. The notice does not need to contain the whole case file. It needs to disclose enough of the decisional basis to make contest meaningful, distinguish what has been decided from what may still be corrected, and state the procedural route in language the intended recipient can realistically use. The form must not pretend that a rule citation and a deadline are the same thing as answerability. Its design should ask not only whether the agency can prove that notice was sent, but whether the person can identify the contested fact, contested rule, relevant evidence, available remedy, and time-sensitive consequence. A notice that cannot support those functions may still be a notice, but its jurisdictional claim is weaker than its institutional authority suggests.
The performance dashboard presents a third and subtler version of the same problem because it often appears as transparency rather than decision. Performance.gov describes itself as a public window into federal performance and as the centralized online performance reporting portal required by the GPRA Modernization Act of 2010; it provides the public, agencies, Congress, academics, and media a view into federal progress on performance and accountability. Its performance framework explains that the GPRA Modernization Act supports organizational routines and management processes for setting performance goals and objectives, and seeks to create a culture where data and empirical evidence play a greater role in policy, budget, and management decisions. This is not a trivial good. Public institutions should be able to show what they are trying to accomplish, how they measure progress, where they are falling behind, and what evidence informs management. A dashboard can expose drift, delay, inequity, and evasion that narrative reports might obscure.
The Trust in Major Government Service Providers dashboard sharpens the point because it displays post-transaction customer feedback data from High Impact Service Providers beginning with FY 2024 Q2, allowing the public to view and compare trust levels across providers and services, and the dashboard’s explainer says it debuted in June 2024 after a year-long effort to implement streamlined survey guidelines and reporting requirements. Performance.gov states the trust dashboard shares customer feedback publicly to build accountability and transparency and that all High Impact Service Providers must collect customer feedback to understand how individual interactions with services drive trust in government. Here the form is not hidden. It is publicly accountable, visually organized, and explicitly connected to service improvement. It is a benign artifact in the strongest sense, which makes it useful for this chapter. The danger of form cannot be limited to cruel or secret systems. It must also be visible in systems designed to improve trust.
The dashboard’s legitimacy depends on frame discipline. A trust score can be valuable. It can reveal whether people leaving a transaction feel greater confidence in the agency. It can let leaders compare services, identify friction, allocate design attention, and ask why one office performs better than another. It can also let the public see government service delivery as something measurable and improvable. Porter’s account of numerical objectivity helps explain the appeal: where institutions must justify themselves to many audiences, numbers appear to create a common surface that travels across distance, disagreement, and distrust (Porter). The dashboard gives experience a public form.
Yet the same public form can narrow the reality it claims to reveal. Trust, as lived by persons, is not identical with a post-transaction survey response. The survey captures a moment after an interaction, using an approved prompt, response scale, reporting requirement, aggregation method, benchmark, and display logic. The explainer itself says HISPs may use either a thumbs-up/thumbs-down response or a five-point Likert scale, and that the target trust benchmark is 75 percent or higher, calculated through those response formats. This is a legitimate operational decision. It is also a transformation. Trust becomes a data point. A data point becomes a rate. A rate becomes a benchmark. A benchmark becomes comparison. Comparison becomes management attention. Management attention becomes incentive. Incentive becomes behavior. The dashboard that was built to hear the public may begin to teach agencies how to perform for the dashboard.
The form forgets itself when the dashboard’s surface becomes the official reality of trust. The danger is not that the metric is false. It may be true as far as it goes. The danger is that a true metric inside a bounded frame can become false when treated as the whole field. A person may report increased trust after a courteous interaction while still being trapped in a program whose underlying eligibility rules, documentation burdens, digital interfaces, language access, or appeal systems remain punishing. Another person may report low trust because the interaction delivered an unfavorable but legally correct result. A service may score well among those who completed a transaction while excluding those who abandoned the process before survey capture. A dashboard may compare services without carrying the unequal difficulty of the populations served, the inherited condition of trust before the encounter, or the difference between transactional satisfaction and structural justice. None of this means the dashboard should not exist. It means the dashboard must know what kind of truth it holds.
Power’s account of audit society is useful here because it shows how verification practices can become rituals that reshape organizations around what can be inspected and reported (Power). A dashboard rarely stays passive. It creates an anticipated audience. It tells managers what will be watched. It tells teams what language matters. It tells leadership where to intervene. It tells agencies which improvements can become visible. It can dignify neglected experience by making it count, and it can narrow experience by making only the counted matter. Bowker and Star’s classification infrastructure returns with new force: once the categories of trust, effectiveness, ease, efficiency, transparency, and employee interaction are embedded in reporting systems, they do not simply describe service experience; they help organize what service experience can become administratively visible (Bowker and Star).
The dashboard also exposes a temptation that runs through modern governance: the belief that transparency solves possession. Public display is not the same as jurisdictional humility. A dashboard may be transparent about what it measures while silent about what it cannot measure. It may disclose the response scale while obscuring nonresponse. It may show comparative trust while hiding selection effects. It may publish data while leaving affected persons unable to contest the meaning attached to that data. Transparency can improve accountability, but it can also make a form more authoritative by making it more visible. The public surface says: here is reality. The jurisdictional question asks: which reality, produced through which instrument, authorized for which decisions, under which limits?
At this point the chapter can state its doctrine more exactly. Forms forget themselves through four movements. First, they receive a partial reality under an authorized purpose. Second, they translate that reality into categories, ratings, reasons, fields, or metrics. Third, they travel into contexts beyond the original encounter. Fourth, later institutional actors treat the translated artifact as if it possessed the authority of the thing translated. The review receives work and later travels as personhood. The notice receives a decision and later travels as institutional answer. The dashboard receives feedback and later travels as reality. Each step can be justified in part. Each step can overreach in practice. The danger lies in the cumulative widening of authority.
This doctrine also clarifies why the book uses the word possession. Possession does not mean that a form literally owns a person. It means that the institution lets a form behave as if reception has become authority over the referent. A review possesses when its rating becomes the person’s future identity inside the institution. A notice possesses when its explanation becomes the institution’s full account of obligation. A dashboard possesses when its metrics become the official world against which unmeasured experience must plead. Possession is therefore not simply reduction. All forms reduce. Possession is reduction with unauthorized authority.
The justice stakes are uneven. A senior employee with institutional fluency, allies, time, and recognized speech may correct the review before it hardens. A household with legal aid, stable mailing address, language access, time off work, and confidence in public offices may contest the benefits notice. An agency with analytic capacity may contextualize a dashboard rather than obey it blindly. But many persons encounter forms from a weaker procedural position. They do not have the same capacity to annotate, correct, appeal, reinterpret, or slow the artifact’s travel. They must reconstruct omitted context after the institution has stabilized its record. They must prove that the form’s world is smaller than the world they lived. The burden of re-expansion falls on the person whom compression has already disadvantaged.
This unequal burden is one reason the critique cannot stop at accuracy. A review may accurately record that a deliverable was late, while omitting that the employee carried unassigned repair work no one else saw. A benefits notice may accurately state the rule applied, while failing to show the calculation the household needs to challenge. A dashboard may accurately display trust among respondents, while leaving out people who could not complete the service journey. Accuracy inside a narrow frame does not settle jurisdiction. The relevant question is whether the form’s authority is proportionate to the frame through which accuracy was produced.
A third defender may now say that institutional systems cannot preserve every omitted context. If every performance review had to include all organizational background, if every notice had to anticipate every possible misunderstanding, if every dashboard had to carry every methodological caveat, the result would be paralysis. Forms work because they exclude. They act because they simplify. To demand that they remember their limits may sound noble and produce unusable artifacts.
The answer is that jurisdictional humility is not maximal context. It is disciplined limitation. A review form does not need to become a biography. It needs to mark where evidence ends and inference begins. A benefits notice does not need to become a treatise. It needs to make the contested basis of action usable. A dashboard does not need to contain the whole social world. It needs to state what its measures can and cannot authorize. The remedy for possessive form is not infinite form. It is bounded form.
That distinction matters because institutions often respond to form failure by adding more form. A review process becomes more elaborate. A notice becomes longer. A dashboard adds more indicators. A compliance system adds attestations. A complaint channel adds categories. Sometimes these additions help. Often they shift the problem rather than solve it. More fields do not automatically create more justice. A longer form can deepen possession if the new fields expand institutional appetite without expanding contestability. A more elaborate dashboard can become more authoritative precisely because it appears more nuanced. A more detailed notice can become less usable to the person who receives it. The question is not how much the form contains. The question is what the form is allowed to do with what it contains.
The first form audit follows from that question. A review form should be asked: what does it receive, what period does it cover, what standards govern it, what evidence supports each inference, what context is excluded, what consequences attach, where will the record travel, how long will it remain operative, who can correct it, and what must it be forbidden to become? If the review cannot answer those questions, its jurisdiction is too vague for the power it exercises. A non-possessive review would separate observed performance from inferred trait, current evaluation from future custody, output from route, developmental need from diminished personhood, and compensation judgment from total worth. It would preserve managerial judgment while refusing to let managerial perception become ontology.
A benefits notice should be asked: what decision does it communicate, what rule and facts support the decision, what evidence was used, what evidence may be wrong or missing, what deadline governs response, what consequence occurs if no response comes, what right to continued benefits exists, what practical channel allows contestation, and what repair is available if the decision is wrong? If the notice cannot help the recipient identify the contested basis of the decision, it may be formally adequate but jurisdictionally thin. A non-possessive notice would not pretend that mailing equals understanding or that stating a right equals making that right usable. It would communicate the decision while leaving the decision interruptible.
A dashboard should be asked: what is measured, who is excluded from measurement, what proxy stands in for what value, what response population produced the data, what incentives does display create, what decisions may rely on the dashboard, what decisions may not rely on it, what context must accompany comparison, and what unmeasured realities require separate governance? If the dashboard cannot distinguish public evidence from official totality, it becomes a bright instrument of reduction. A non-possessive dashboard would make patterns visible while refusing to become the entire reality of the service, office, worker, claimant, or public.
These audits are not yet the book’s full operational doctrine. They are the first emergence of it. Later chapters will ask what a form may demand as evidence, how judgment can be interrupted, how vulnerability changes system conduct, how consent decays after propagation, how forms govern before they arrive, how standards can hear strain, how futures become credible, how friendship teaches non-possession, and how resurrection denies final custody to completed procedure. Chapter One has a narrower burden. It teaches the reader that the artifact is never a neutral container once it can travel with consequence.
The chapter must end where the next question begins. The performance review, benefits notice, and dashboard all show that forms are necessary and dangerous because they receive partially and may later act broadly. But if a form’s danger begins in partial reception, the next question is what a form is authorized to receive in the first place. Before a review can rate, it must gather evidence. Before a notice can explain, it must decide what facts matter. Before a dashboard can display, it must capture and classify. The jurisdiction of form therefore becomes, in the next chapter, the jurisdiction of visibility. Evidence must be gathered without becoming exposure. Visibility must serve a bounded purpose rather than institutional appetite. The form that remembers itself begins by knowing what it has no right to ask.
Chapter Two. Evidence Without Exposure
The rental application does not first appear as an instrument of domination. It appears as an ordinary condition of being considered. A person seeking shelter enters a form before entering a home: name, date of birth, Social Security number or alternative identifier, present address, prior addresses, employment, income, bank information, landlord references, credit authorization, eviction history, criminal history, consent to background screening, acknowledgment that a third-party report may be obtained, acknowledgment that incomplete or inaccurate information may delay or defeat the application, and sometimes a nonrefundable fee for the privilege of being screened. Nothing in this sequence is, by itself, irrational. A housing provider may need to know whether rent can be paid, whether lawful lease obligations are likely to be honored, whether prior records bear on tenancy, and whether the applicant is who they claim to be. HUD’s 2024 rental-screening guidance expressly recognizes that housing providers have legitimate interests in selecting tenants who will pay rent and comply with lawful lease requirements, while also warning that imprecise or overbroad screening criteria may unjustifiably exclude people from housing opportunities in discriminatory ways.
That double fact is the proper beginning of the chapter. Evidence is not the enemy. A form that refuses all evidence does not become merciful; it becomes arbitrary, exposed to preference, rumor, fear, charisma, proxy judgment, and defensive exclusion. The person seeking housing does not need a landlord’s intuition to replace documentation. The applicant needs an evidentiary process whose authority is bounded by the decision it serves. The question is therefore not whether a housing provider may see anything. The question is what the housing form is authorized to ask, what the screening company is authorized to assemble, what the landlord is authorized to infer, what the applicant is authorized to see, how long the assembled record may remain active, and what happens when the evidence is wrong, stale, weakly predictive, unlawfully discriminatory, or practically impossible to contest before the apartment is lost.
Chapter One argued that a form becomes dangerous when it forgets its own partiality. Chapter Two moves one step earlier. Before the form can forget the limits of what it has received, it must first decide what it is entitled to receive at all. This chapter names the boundary between evidence and exposure. Evidence is visibility under a justified claim. Exposure is visibility that exceeds the claim, survives beyond the claim, migrates into other claims, or forces a person to become more available to institutional power than the decision can justify. Evidence belongs to jurisdiction. Exposure belongs to appetite. The difference is not emotional. It is structural.
The governing law is this: evidence is legitimate only when the visibility demanded by a form remains bounded by purpose, proportionality, permissible use, duration, contestability, and repair. Exposure begins when visibility exceeds the jurisdiction of the claim it is supposed to serve. Purpose asks whether the institution has identified the specific decision for which visibility is sought. Proportionality asks whether the demanded information is commensurate with the gravity, nature, and lawful scope of that decision. Permissible use asks whether information gathered for one purpose is technically, legally, and institutionally blocked from collateral use. Duration asks how long the information may remain operative. Contestability asks whether the affected person can see, dispute, contextualize, or correct the evidence and inferences used against them. Repair asks whether a successful challenge can materially alter the consequence rather than annotate the file after the loss has hardened. These six tests do not romanticize secrecy. They discipline visibility.
Tenant screening supplies the chapter’s central pressure chamber because it joins legitimate inquiry to severe asymmetry. HUD’s guidance notes that the rental-screening industry has grown in reliance and that tenant-screening companies increasingly claim to use advanced technologies, including machine learning and artificial intelligence, to analyze applicant information; HUD warns that such technologies may access and analyze information not widely used for rental decisions until recently, may have little bearing on lease compliance, and may obscure the precise reasons for denial from both housing provider and applicant. The danger is not only that the landlord sees too much. It is that the landlord may receive a processed account whose evidentiary pathway is unclear, whose predictive meaning is thin, whose legal significance is uncertain, and whose practical authority is immense. The applicant becomes visible through a report they may not have seen, generated through criteria they may not know, applied through a decision structure whose most consequential inferences arrive already packaged as risk.
The CFPB’s tenant-background-check materials sharpen this same injury from the applicant’s side. In 2022, the CFPB reported that tenant background checks can contain errors and false information that create barriers to rental housing, and it described renter complaints involving wrong, old, or misleading information, inadequate dispute investigations, and difficulty getting screening companies to fix flawed procedures. The CFPB’s market report identifies public records, credit reports and scores, and customized rental risk scores or automated screening products as part of the tenant-screening market, which means that a housing decision may be shaped by multiple layers of records, vendors, models, summaries, and recommendations before the applicant can answer what has been said about them. Here the form’s first jurisdictional offense is not final denial. It is earlier: the applicant must surrender visibility into a system whose decisional structure is not equally visible in return.
The Fair Credit Reporting Act provides part of the answer and also reveals its insufficiency. When a person takes an adverse action based in whole or in part on information in a consumer report, the FCRA requires notice of the adverse action, disclosure of the consumer reporting agency that furnished the report, a statement that the agency did not make the decision and cannot provide the specific reasons for it, notice of the right to obtain a free copy of the report, and notice of the right to dispute the accuracy or completeness of information in the report. 15 U.S.C. § 1681m. The Act also gives consumers the right, subject to statutory conditions, to receive all information in their file at the time of request, including sources of information, while separately providing reinvestigation procedures for disputed accuracy or completeness, including a default thirty-day reinvestigation period and deletion or modification of information found inaccurate, incomplete, or unverifiable. 15 U.S.C. §§ 1681g, 1681i.
This structure matters because it already recognizes that visibility must be answerable. A report used against a person cannot remain wholly inaccessible. The applicant must be told that a report mattered, must be able to request the file, must be able to dispute accuracy or completeness, and must have inaccurate, incomplete, or unverifiable information corrected or removed. These are not minor procedural details. They are the legal infrastructure of contestability. They prevent the screening report from operating as a sealed oracle. Yet Chapter Two’s claim is that contestability formally recognized may still be practically deficient. A renter who learns of an adverse action after the unit has been offered to someone else has received notice, but not necessarily repair. A person who can dispute a record within statutory timeframes may still lose a time-sensitive housing opportunity. A file disclosure may contain information but not the full logic by which the housing provider converted that information into denial. A right to dispute accuracy may not reach a score, weight, recommendation, selection threshold, or screening policy whose problem is not a single factual error but jurisdictional overbreadth.
The Fair Housing Act adds another dimension because the wrong of screening is not exhausted by individual error. Section 3604 makes it unlawful, among other things, to refuse to rent or otherwise make unavailable a dwelling because of protected characteristics, to discriminate in rental terms or services, and to make discriminatory housing statements, with disability protections and reasonable accommodation duties included in the statute. 42 U.S.C. § 3604. HUD’s guidance is therefore not simply about better paperwork. It asks whether screening practices, including automated or third-party systems, unjustifiably exclude persons from housing opportunities in ways the Fair Housing Act forbids. The jurisdictional point is exact: a form may be neutral in its fields and still overclaim through criteria that are overbroad, weakly tied to tenancy, historically saturated with unequal surveillance, or implemented without individualized consideration where the law requires it. The applicant is not only harmed when a report is factually wrong. They may also be harmed when the report is formally accurate and jurisdictionally excessive.
Privacy theory helps clarify the injury, but it cannot be allowed to absorb the chapter. Nissenbaum’s theory of contextual integrity remains indispensable because it refuses the reduction of privacy to secrecy. Privacy concerns appropriate information flows within social contexts, governed by actors, attributes, and transmission principles (Nissenbaum). Tenant screening is precisely such a problem: income, credit, criminal, eviction, address, employment, and identity information may be appropriate in some forms, for some purposes, under some transmission constraints, and inappropriate under others. Yet the jurisdiction of form presses beyond contextual integrity. The question is not only whether information flows according to contextual norms. The question is whether the receiving form has earned authority to demand, retain, infer from, transmit, and act upon the information it receives. A context can normalize a flow that remains excessive. A market can routinize disclosure that still exceeds the decision’s jurisdiction. A form can be customary and still overreaching.
Solove’s taxonomy of privacy harms gives the chapter more granular language for this overreach. Aggregation, secondary use, exclusion, increased accessibility, disclosure, and distortion are not the same injury (Solove). Tenant screening often combines several. Aggregation assembles records that lived separately. Secondary use lets data gathered in one context influence housing in another. Exclusion occurs when the subject cannot participate meaningfully in the handling of their data. Increased accessibility makes obscure or practically forgotten records easy to retrieve. Distortion occurs when fragments are presented without adequate context. Disclosure exposes what the decision did not need to know. The applicant does not experience these as separate legal categories. They experience them as a dossier that arrives before they do.
Cohen’s work on informational capitalism deepens the point because information systems do not simply represent already-formed subjects. They configure the conditions under which subjects become legible, actionable, and governable (Cohen, Between Truth and Power). The rental applicant is not merely revealing prior facts. They are being translated into the form’s admissible grammar of trustworthiness: income stability, score, prior filing, criminal record, address continuity, debt, payment history, risk category, recommendation. This translation may be necessary in part, but its necessity does not make it innocent. The applicant’s life becomes a series of features whose institutional meaning is determined by forms, vendors, policies, and thresholds that may be difficult to see, contest, or contextualize.
Citron’s account of privacy as tied to dignity, identity, intimacy, and power prevents another mistake: treating privacy as a consumer preference for less disclosure (Citron). The person seeking housing is not browsing optional data-sharing settings in a frictionless market. They are trying to secure a dwelling. Refusal to disclose may mean exclusion. Disclosure may mean exposure to records whose meanings have already been shaped by medical crisis, family violence, poverty, racialized policing, disability, predatory debt, eviction filing practices, or administrative error. The applicant’s “choice” to become visible is made under material constraint. A theory that treats this as ordinary consent mistakes need for permission.
The Privacy Act of 1974 offers a useful public-law analogue because it treats collection itself as a governed act. The Act defines “maintain” to include collect, use, or disseminate, and defines “record” broadly as information about an individual maintained by an agency, including education, financial transactions, medical history, criminal history, or employment history when connected to an identifying particular. 5 U.S.C. § 552a(a). It also requires agencies maintaining systems of records to maintain only information about an individual that is relevant and necessary to accomplish a legally required agency purpose, to collect information directly from the subject where practicable when adverse determinations may result, and to inform individuals on the collection form or a retainable separate form of the authority, purpose, routine uses, and effects of non-disclosure. 5 U.S.C. § 552a(e). The statutory vocabulary is narrower than this book’s theory, but its logic is crucial: the authority to collect must be justified at the point of collection, not only defended after use.
The GDPR supplies a parallel vocabulary in data-protection terms. Article 5 requires personal data to be processed lawfully, fairly, and transparently; collected for specified, explicit, and legitimate purposes; limited to what is necessary; accurate and kept up to date; stored no longer than necessary; secured appropriately; and governed by accountability. Regulation (EU) 2016/679, art. 5. Articles 15, 16, and 17 then provide rights of access, rectification, and erasure under specified conditions, giving the data subject procedural routes to see, correct, and in some circumstances remove personal data. Regulation (EU) 2016/679, arts. 15–17. These principles map closely onto the chapter’s six-part visibility test: purpose limitation, data minimization, accuracy, storage limitation, access, rectification, erasure, and accountability. Yet the chapter’s claim remains jurisdictional rather than doctrinally limited to European data protection. The question is not only whether data processing complies with a legal framework. The question is whether the form’s visibility is proportionate to the institutional claim being made.
Carpenter v. United States belongs in this chapter only as a disciplined example of aggregation becoming a new kind of exposure. The Supreme Court held that government acquisition of historical cell-site location records was a Fourth Amendment search after the government obtained records that cataloged Carpenter’s movements over 127 days. Carpenter v. United States, 585 U.S. 296 (2018). The case is not about tenant screening, and it should not be stretched into a universal privacy doctrine. Its relevance is conceptual: data that appears limited when viewed as discrete business records can become qualitatively different when aggregated across time. The same logic applies beyond the Fourth Amendment. A prior address, a filing, a debt, a late payment, a criminal record entry, an employment gap, or an income fluctuation may be one fragment. Assembled and scored, those fragments become a portrait. The portrait can be more powerful than any single item, and often less contestable than any single error.
The chapter’s adversary is therefore transparency absolutism. Modern institutions often demand transparency from persons while protecting their own decisional infrastructures behind vendor contracts, proprietary methods, trade-secret claims, managerial discretion, model complexity, security language, fragmented responsibility, and procedural fatigue. The applicant becomes transparent to the landlord, the screening company, the credit bureau, the database, the score, and the denial pathway. The institution remains partially opaque to the applicant. HUD’s warning that advanced tenant-screening technologies may obscure precise reasons for denial from both housing providers and applicants makes this asymmetry especially sharp. The landlord may rely on a report without fully understanding its production. The applicant may be denied without knowing which record, criterion, score, proxy, threshold, or policy carried decisive weight. Visibility has become one-way.
One-way visibility changes the moral structure of evidence. Evidence, properly understood, is not raw exposure. It is material made available under conditions that bind the receiver. The receiver must state why it needs the evidence, how it will use it, what it will not do with it, how long it will hold it, how the subject can challenge it, and what repair follows if the evidence fails. Exposure, by contrast, binds the subject and frees the receiver. It makes the person available while leaving institutional inference under-explained. It takes from the applicant what it needs, what it might need, what it might later find useful, or what its vendor systems have learned to collect, then calls the transaction consent because the applicant clicked authorization. But need is not consent in any morally serious sense when refusal means exclusion from housing.
The distinction between evidence and confession becomes unavoidable here. Institutions often convert participation into disclosure and disclosure into compliance. The applicant seeking housing must narrate themselves through a grammar not of their own making. The form asks for identity, income, employment, prior addresses, rental history, credit history, criminal history, eviction history, and authorization. The applicant’s need for shelter becomes the institution’s occasion to ask more. Some of that asking is justified. A landlord may reasonably ask for income evidence. A housing provider may have lawful reasons to assess tenancy-related risk. But the necessity of some evidence does not authorize general availability. The form overreaches when it turns the applicant’s need into an obligation to become fully searchable.
This is why “I consent” cannot carry the chapter’s moral burden. A tenant-screening authorization signed under housing scarcity, application fees, competitive rental markets, time pressure, and unequal bargaining power does not itself prove that every downstream use, inference, retention period, vendor transfer, or decision threshold is legitimate. Consent may be legally relevant. It may be administratively necessary. It may even be practically unavoidable. But it is not a solvent that dissolves jurisdiction. The form still must justify purpose, proportionality, permissible use, duration, contestability, and repair. The applicant’s signature does not convert exposure into evidence.
The strongest objection must be faced without caricature. Housing providers need information. They must manage nonpayment risk, property risk, legal compliance, safety, and fair treatment among applicants. They may face real costs when tenancy fails. They may need standardized procedures to avoid arbitrary favoritism, discriminatory intuition, or inconsistent treatment. Screening can protect not only landlords but also other tenants and the stability of housing operations. Benefit agencies, creditors, employers, schools, courts, and hospitals face analogous needs. A theory that treats every evidentiary demand as violence cannot govern institutions. It can only accuse them.
This objection wins against any sentimental theory of privacy. It does not win against jurisdictional visibility. The question is not whether the institution may ask. The question is whether its asking is bounded by the decision’s legitimate scope. Income evidence may be necessary to assess ability to pay rent. It does not follow that every form of financial history is proportionate. Prior eviction information may sometimes bear on tenancy. It does not follow that filings without outcome, stale records, sealed records, context-free records, or records from legally protected circumstances should remain operative. Criminal history may sometimes be relevant under carefully constrained conditions. It does not follow that broad criminal-record exclusions are justified. Credit data may sometimes show ability to manage obligations. It does not follow that medical debt, crisis debt, thin credit, or old credit damage should become a generalized moral verdict. Evidence must answer the decision. Exposure answers institutional appetite.
A second objection is that proportionality is too vague to administer. Institutions need rules, not moral atmosphere. A housing provider cannot run a philosophical tribunal for every application. A screening vendor cannot redesign relevance from scratch for each applicant. A benefits agency cannot negotiate the metaphysics of evidence whenever it asks for documentation. This objection matters because a theory that cannot be operationalized invites either paralysis or evasion. The chapter’s six-part test must therefore behave like a form audit, not a virtue statement.
Purpose requires a written statement of the decision the evidence serves. “Tenant suitability” is too broad if it authorizes any data that might make an applicant seem less desirable. A legitimate purpose must be closer to the actual tenancy question: ability to pay, lawful compliance with lease obligations, identity verification, and specific safety or property-related risks defined under applicable law. Proportionality requires that each requested data category be mapped to that purpose. Income documentation may map strongly. Years-old or context-free records may map weakly. Permissible use requires blocking collateral movement: information gathered for rental eligibility should not become marketing, unrelated profiling, unrelated risk scoring, or future generalized surveillance. Duration requires expiry: data should not remain operative beyond the time needed for the application, dispute, legal compliance, or justified retention obligation. Contestability requires access to the evidence and meaningful ability to correct, explain, or challenge it. Repair requires that a successful challenge alter the consequence, not simply improve a file after the unit is gone.
The repair prong is the hardest because law often gives procedure after practical loss. FCRA reinvestigation may lead to deletion or modification of inaccurate, incomplete, or unverifiable information, and the consumer must receive written notice of the results after completion. 15 U.S.C. § 1681i. That is important. It is also incomplete as a theory of institutional justice. If the dispute process corrects the file thirty days later but the apartment was denied on day three and leased to someone else on day five, the person’s record may be repaired while the housing opportunity remains gone. The form becomes most dangerous when its correction mechanisms operate on a slower timeline than its consequences. A jurisdictionally humble system would ask whether the consequence should pause where evidence is disputed, whether denial should be conditional, whether certain error-prone categories should require manual review before adverse action, whether stale or weakly predictive records should be excluded at intake, and whether correction should trigger re-evaluation rather than archival cleanliness.
The third objection comes from accountability rhetoric. Opacity protects wrongdoing. People hide fraud, abuse, discrimination, danger, and incompetence behind privacy claims. Institutions may need visibility precisely to protect others. This objection must be taken seriously because privacy language can be misused by powerful actors to evade scrutiny. The answer is to distinguish upward accountability from downward exposure. When an institution exercises power, allocates housing, administers benefits, scores applicants, or denies access, it owes reasons, records, and contestability. That is not the same as saying that applicants owe unlimited visibility to the institution. The governed may owe bounded evidence. The governing form owes a stronger justification because it converts visibility into consequence.
This asymmetry is central. The applicant’s data is demanded as condition of access. The screening company’s method may be defended as proprietary. The landlord’s internal threshold may be undisclosed. The vendor’s data sources may be fragmented. The report may be contestable only through a separate process. The denial may cite the screening company, while the screening company says it did not make the decision. FCRA itself reflects this division when adverse-action notice must tell the consumer that the reporting agency did not make the decision and cannot provide the specific reasons for the adverse action. 15 U.S.C. § 1681m(a). The statement is legally coherent. It can also be experientially maddening. The person denied housing is directed toward an actor that supplied information but disclaims the decision, while the decision-maker may rely on information whose production and weighting it does not fully control. Accountability fragments across the very forms that made the applicant visible.
The justice pressure is not evenly distributed. Some applicants can absorb the burden of visibility. They have stable addresses, clean credit, conventional employment, no prior filings, no criminal records, recognized documentation, legal literacy, time to dispute, and access to alternative housing if one application fails. Others become over-visible before they are heard. A prior eviction filing may remain legible even when dismissed, sealed, paid, caused by unlawful conditions, tied to domestic violence, or produced by pandemic disruption. A criminal record may travel without individualized assessment, rehabilitation, disposition context, or relation to tenancy. Medical debt may appear as credit weakness. Address instability may appear as irresponsibility rather than evidence of housing precarity. Disability-related income variation may appear as instability. Immigration complexity may appear as documentation deficiency. The form receives fragments of history under unequal social conditions and presents them as applicant risk.
This is proof debt. The applicant must convert context into a form the institution will recognize, often after the institution has already converted them into risk. They must obtain records, contact agencies, dispute errors, explain gaps, reveal more private history, pay fees, meet deadlines, and endure delay while competing for a scarce good. The burden is temporal, interpretive, financial, affective, and evidentiary. It is not enough to say that the applicant can contest. One must ask what contest requires and whether the applicant has been given a realistic route to repair. A right that can be exercised only by those with time, literacy, counsel, stability, and stamina is a right whose form has narrowed its own promise.
Duration deserves special attention because exposure often continues after its initiating purpose ends. A landlord may not need application data after an applicant is rejected, except for specified legal, audit, or dispute-related reasons. A screening company may maintain data for consumer-reporting purposes under its legal obligations. A vendor may have retention schedules, backups, logs, analytics, or model-training residues. A report may continue to shape future rental opportunities if the same inaccurate or context-free record remains in circulation. GDPR’s storage-limitation principle states the basic point in data-protection language: personal data should be kept in identifiable form no longer than necessary for the purposes for which it is processed, subject to specified exceptions. Regulation (EU) 2016/679, art. 5. Jurisdictionally, duration asks whether the form’s authority expires when the decision does. If the form’s purpose was one rental application, its later life must be justified separately.
Permissible use is equally severe because institutional systems often expand by reuse. Information gathered for identity verification becomes fraud scoring. Information gathered for tenancy becomes marketing segmentation. Information gathered for compliance becomes broader risk profiling. Information gathered for one landlord becomes part of a vendor’s wider database. The Privacy Act’s definition of “routine use” as a use compatible with the purpose for which the record was collected helps name the issue, even though the statute governs federal agency records and cannot simply be transplanted into private housing. 5 U.S.C. § 552a(a)(7). The jurisdictional principle is this: compatibility cannot mean usefulness. A use is not justified because the institution can derive value from it. It must remain answerable to the purpose under which visibility was obtained.
The same principle distinguishes evidence from confession. Confession gives the receiver moral control over disclosed interiority. Evidence should not. A housing application may require documentation; it should not require self-surrender. A person should not have to narrate poverty, illness, violence, family crisis, addiction recovery, disability, immigration precarity, or prior system contact beyond what the tenancy decision can lawfully and proportionately require. When the form requires such narration, it converts need into moral availability. This is the moment at which the institution asks not only “can this person pay rent under lawful lease terms?” but “will this person become transparent enough for us to feel safe?” The latter question has no natural boundary. It is the grammar of exposure.
The chapter’s doctrine can now be stated more tightly. A form has jurisdiction to receive evidence when the receiving institution can answer six questions. What decision is being made? Why is this category of information necessary to that decision? What inference may be drawn from it, and what inference is prohibited? How long will the information remain active? How can the subject see, correct, or contextualize it? What remedy follows if the evidence fails? If those questions cannot be answered, the form has begun to demand exposure under the name of evidence.
This doctrine also explains why disclosure to the applicant, though indispensable, is not sufficient. FCRA file disclosure requires consumer reporting agencies to disclose all information in the consumer’s file at the time of request, subject to statutory exceptions, and to disclose sources of information. 15 U.S.C. § 1681g. GDPR access rights likewise include information about processing purposes, categories, recipients, retention periods or criteria, and rights to rectification or erasure. Regulation (EU) 2016/679, art. 15. These access rights are necessary because one cannot contest what one cannot see. But seeing the file is not the same as seeing the decision. A file can disclose records without disclosing weighting. A report can disclose data without disclosing policy. A notice can disclose a consumer reporting agency without disclosing the landlord’s threshold. A screening result can disclose adverse action without disclosing the practical path to reversal. Access is the beginning of contestability, not its completion.
The distinction becomes clear in the tenant-screening audit. The first question is purpose. The form should state that the decision is rental eligibility under lawful tenancy criteria, not general worthiness, moral reliability, neighborhood fit, personality, social conformity, or speculative risk. The second question is necessity. Identity verification, current income, lawful rental criteria, and specific tenancy-related history may be relevant, but each data category must justify itself. The third question is proportionality. A record’s age, disposition, source reliability, connection to tenancy, and susceptibility to structural bias matter. The fourth question is permissible inference. An eviction filing cannot automatically mean nonpayment or bad tenancy. A criminal record cannot automatically mean present danger. A credit event cannot automatically mean irresponsibility. A prior address pattern cannot automatically mean instability in the morally loaded sense. The fifth question is use limitation. Information supplied for the application may not be converted into unrelated profiling, sales, cross-property surveillance, or future generalized risk without renewed justification. The sixth question is duration. Application data, reports, and derived inferences must expire unless a specific legal or dispute-related reason justifies retention. The seventh question is contestability. The applicant must see the evidence, understand the adverse basis, and reach the actor capable of correction. The eighth question is repair. If the evidence fails, the consequence must be capable of reversal, reconsideration, compensation, or meaningful alternative relief.
This audit should not be mistaken for a demand that housing providers ignore risk. It is a demand that risk remain jurisdictional. Risk is not a magic word that authorizes unlimited inquiry. A risk form must still ask which risk, to whom, over what period, under what evidence, through what lawful criteria, with what possibility of challenge, and with what repair if the form is wrong. The more consequential the decision, the more disciplined the form must become. Housing is not a luxury preference. It is the material condition under which work, education, family stability, health, safety, and civic membership become possible. A housing-screening form therefore cannot pretend to be an ordinary private filter. When it helps decide whether a person can live somewhere, its evidentiary appetite requires public justification.
This is where Chapter Two reaches beyond privacy without abandoning it. Privacy asks, among other things, whether information should flow, under what norms, with what expectations, and with what protections. Jurisdiction of form asks what the receiving structure may do with visibility once obtained. The two inquiries overlap but do not collapse. A form may comply with notice and consent expectations while still gathering excessive data. A report may be accessible while still overbroad. A record may be accurate while still weakly relevant. A denial may be explainable while still disproportionate. A dispute process may exist while still failing to repair time-sensitive loss. Exposure can therefore persist inside legality. The book’s task is to make that persistence visible.
The chapter’s conclusion is deliberately cold: visibility is not legitimacy. A form does not become just because it collects, discloses, reports, explains, or obtains consent. It becomes legitimate only when visibility remains inside jurisdiction. Tenant screening shows the stakes because housing providers do need evidence, applicants do need fair process, reports do contain relevant information, and errors do cause severe harm. The doctrine does not say “do not see.” It says: see only what the decision authorizes, infer only what the evidence supports, retain only what the purpose justifies, disclose enough to permit contest, and repair consequences when visibility fails.
Chapter Three must now ask what happens after the form receives. Once information has been gathered, it becomes representation: file, record, score, report, classification, testimony, notice, archive. Chapter Two has governed the boundary of reception. Chapter Three governs the corruption of substitution. The institution first asks to see. Then it treats what it has seen as the person. That next movement requires the book’s theological and semiotic discipline, because the problem is no longer only exposure. It is idolatry: the substitute beginning to command the referent it only partially bears.
Chapter Three. The Substitute and the Person
The file does not hate the person it replaces. That is why it is so dangerous.
It appears first as an administrative convenience, a structured representation whose purpose is to help someone else decide without beginning again. A tenant screening report places an applicant into rows and fields: identity markers, prior addresses, credit history, court filings, criminal-record entries, eviction records, scores, exceptions, recommendations, and sometimes a proprietary risk output that converts scattered records into an apparently usable judgment. The report does not announce that it is the applicant. It does not need to. It arrives before the applicant’s full account, moves more quickly than the applicant’s explanation, and speaks in the grammar an institution has learned to honor. The person has a voice, but the report has format. The person has history, but the report has fields. The person has context, but the report has retrieval. The person has reasons, but the report has portability.
The CFPB describes tenant background check reports as containing extensive personal information, including credit history, civil and criminal records, credit scores, and proprietary risk scores used by many landlords and property managers to make rental decisions. It also reports that people are denied rental housing because negative information belongs to someone else, outdated information remains, inaccurate or misleading arrest, criminal, and eviction details are not corrected, and renters often have little visibility into reports before a decision is made. The same agency later warned that background-check companies do not get to create flawed reputational dossiers hidden from consumer view, and that background reports must be complete, accurate, and free of duplicative, outdated, expunged, sealed, or legally restricted information. These are accuracy and disclosure claims, but Chapter Three reads them differently. The issue is no longer only whether the report contains too much, too little, or the wrong information. The question is what happens when a report becomes a substitute for the person.
A substitute is a representation authorized to stand in for a person, event, claim, risk, wound, or obligation for a limited procedural purpose. The qualification matters. Every complex institution requires substitution. A landlord cannot re-live an applicant’s rental history. A court cannot directly inhabit the event it adjudicates. A physician cannot treat without records. A school cannot evaluate without transcripts. A benefits agency cannot administer without files. A child welfare office cannot screen allegations by unstructured intuition alone. The world without substitutes is not a world of direct justice. It is a world where memory belongs to whoever is present, powerful, fluent, or believed. Representation is not the enemy of the person. It is one of the conditions under which absent facts, prior events, distributed labor, and vulnerable claims can become available for judgment.
Yet representation becomes dangerous when the institution forgets the interval between sign and referent. Peirce’s semiotics helps discipline this point because a sign is never simply the thing itself. It is a relation among sign, object, and interpretant, and its meaning depends on the way a community or practice interprets the relation between the sign and what it signifies (Peirce). The file, report, score, record, transcript, chart, or notice is not an inert container. It is a sign relation stabilized for institutional use. It points toward something. It bears something. It omits something. It requires interpretation. The jurisdictional problem begins when the sign’s practical authority exceeds the relation it can support. The tenant report may bear some evidence relevant to rental risk. It does not bear the applicant. The child welfare score may bear a model’s synthesis of selected data elements. It does not bear the family. The administrative record may bear the agency’s invoked grounds. It does not bear every possible truth of the matter.
The chapter’s governing law follows: a form becomes idolatrous when it forgets that it is a substitute and begins to command the referent it only partially bears. Idolatry, as used here, is not a synonym for abstraction. It is not a flourish for bad paperwork. It is a disciplined name for jurisdictional usurpation by a made representation. A form becomes idolatrous when a report receives the authority of the applicant, a score receives the authority of risk, a record receives the authority of the event, a file receives the authority of the life, a certificate receives the authority of final truth, or a model output receives the authority of judgment. The idol is not dangerous because it is an image. It is dangerous because it receives authority beyond its station.
This distinction prevents an anti-representational error. The law itself recognizes that representation is necessary and must be disciplined rather than abolished. The Federal Rules of Evidence do not pretend that courts can decide without documents, records, statements, recordings, data compilations, processes, and systems. They govern the conditions under which representations may become consequential. Rule 901 requires the proponent of an item to produce evidence sufficient to support a finding that the item is what the proponent claims it is, and Rule 901(b)(9) specifically contemplates evidence about a process or system showing that it produces an accurate result. The advisory material also notes that authentication does not itself assure admission, because other barriers, including hearsay, may remain. That is the legal grammar this chapter needs. A representation is not self-validating. Even when a document, system output, or record is what it claims to be, the question remains whether it is relevant, admissible, reliable, limited, contestable, and properly used.
Law’s evidentiary discipline is therefore a secular analogue to the book’s theological discipline. Evidence must be authenticated because signs can lie about their relation to the world. Hearsay is restricted because statements can travel away from the conditions that made them testable. Relevance is required because not every true sign is authorized for every judgment. Exceptions exist because institutions must sometimes rely on representations when their circumstances provide sufficient guarantees for a limited purpose. Self-authentication exists because some public or certified forms are sufficiently regular to enter without extrinsic proof, but even then authenticity does not settle admissibility, weight, interpretation, or consequence. In this sense, evidence law already knows what institutions often forget: representation requires jurisdiction.
The tenant screening report shows the danger at ordinary scale. A civil filing is not a tenancy history. A criminal-record entry is not a present danger. A credit score is not moral reliability. An address pattern is not character. A landlord reference is not the whole relation between landlord and tenant. A proprietary score is not risk itself. Each may be relevant under some conditions. Each may become unjust when treated as exhaustive. The report’s danger is intensified by its convenience. It makes decision easier. It reduces time, uncertainty, and narrative burden for the decision-maker. It gives the landlord a surface that appears cleaner than human ambiguity. But when ease becomes authority, substitution has begun to harden into idolatry.
The Allegheny Family Screening Tool offers a more difficult and therefore more valuable pressure chamber. Allegheny County describes AFST as a predictive risk modeling tool used since August 2016 to support child welfare call screening, integrating hundreds of data elements from the DHS Data Warehouse into a synthesized visualization and a Family Screening Score predicting long-term likelihood of future child welfare involvement. The official description states that the higher the score, the greater the chance of future out-of-home placement; when the score reaches the highest levels and meets the mandatory screen-in threshold, the allegations in a call must be investigated, while in other circumstances the score does not replace clinical judgment and is not shared beyond call screening. This is not a crude case of machine replaces human. Its formal description contains limits, purpose, workflow, and non-replacement language. That is why it belongs here. The chapter is strongest when it refuses caricature.
AFST, as officially described, is a substitute with an articulated jurisdiction. It stands in for a rapid synthesis of selected prior data during a call-screening decision. It is not supposed to stand in for the family, the child, the allegation’s full truth, future investigative findings, parental worth, or final child welfare judgment. Its jurisdiction is bounded by call screening. Its official function is assistance, except at the highest score levels, where the threshold triggers mandatory investigation. The severe question is whether a substitute can remain bounded once it enters an urgent institutional environment structured by risk, liability, child safety, resource scarcity, professional anxiety, racialized and classed surveillance histories, and retrospective blame. A score may be formally advisory and still reorganize attention. It may not replace clinical judgment in policy and still become the object around which clinical judgment justifies itself. It may be one input among others and still become the most portable piece of the decision.
Here the substitute’s danger is not error alone. The score may improve some decisions. Allegheny County’s own public account states that, before AFST, manual review lacked standardized protocols for using and weighing data, and an analysis found that 27 percent of highest-risk cases were screened out while 48 percent of lowest-risk cases were screened in; the county says it reasoned that technology could gather and weigh pertinent information to improve decisions and reduce variability. This is the strongest defense of the substitute. It is not irrational to want more systematic synthesis where children may be in danger and human screeners must act under uncertainty. The point is not that algorithmic substitution is automatically illegitimate. The point is that improved prediction does not authorize ontological capture. A score can assist. It cannot become the family.
The same distinction applies across institutional life. A transcript may assist admissions. It is not learning. A diagnosis may assist treatment. It is not the person’s body or fate. A credit report may assist lending. It is not responsibility. A criminal record may assist a lawful assessment. It is not present character. A benefits file may assist eligibility. It is not need. A death certificate may assist administration. It is not grief. These artifacts are not false because they are partial. They become false in use when partiality is forgotten. Idolatry is partial truth promoted beyond jurisdiction.
This is why Genesis enters the chapter, but only under discipline. “Then God said, ‘Let us make humankind in our image, according to our likeness’” (Gen. 1.26). In this book, the image of God is not an ornamental dignity phrase attached to an institutional argument for elevation. It is a boundary claim. The human person is not a human-made artifact. No record, score, file, report, model, certificate, archive, or institutional representation may claim exhaustive authority over the one it partially bears. The image is not owned by the form that receives a trace. A tenant report may carry information about an applicant; it cannot receive the applicant’s full meaning. A child welfare score may carry a risk estimate; it cannot receive the child’s future, the parent’s moral being, or the family’s truth. The imago Dei, here, disciplines institutional representation by denying final custody to artifacts made by human systems.
Exodus and Deuteronomy sharpen the point because the prohibition against idols is not a prohibition against all images or all mediation. It is a prohibition against made things receiving trust, devotion, fear, and final authority beyond their station: “You shall not make for yourself an idol,” nor bow down to or worship it (Exod. 20.4–5; Deut. 5.8–9). The prohibition is not anti-form. Scripture itself is mediated through language, law, memory, covenant signs, tabernacle architecture, ritual, testimony, and written command. The issue is not that representation exists. The issue is that representation can receive the wrong kind of authority. An idol is a made substitute that becomes sovereign over the relation it was never authorized to possess.
Halbertal and Margalit’s treatment of idolatry helps keep the concept severe because idolatry concerns misplaced ultimate concern, worship, fidelity, and authority rather than an ordinary preference for objects (Halbertal and Margalit). The institutional analogue must therefore remain narrow. A report is not idolatrous because someone reads it. A score is not idolatrous because it informs a decision. A record is not idolatrous because it is kept. Idolatry begins when the institution trusts the substitute as if the person’s relevant truth had been captured, fears contradicting the substitute more than it fears misrecognizing the person, or treats the substitute’s preservation as more authoritative than the person’s living claim. The idol is the representation that has forgotten it is made.
Deuteronomy’s law of witness brings the theological point into the juridical field. “A single witness shall not suffice to convict a person of any crime or wrongdoing,” and the community must inquire diligently when a malicious witness arises (Deut. 19.15–21). False witness is not only false speech. It is representational corruption inside judgment. It is a claim about another person inserted into a process where consequence may follow. That is why false witness is so close to the book’s doctrine. The witness stands in for an event. The testimony bears a representation of the neighbor. If the representation is false, reckless, incomplete, or malicious, the injury is not epistemic alone. It becomes institutional. Judgment acts through the sign.
The Gospel trial narratives intensify this structure, though Chapter Eleven will return to the Passion, burial, and resurrection with fuller force. In Mark, witnesses testify against Jesus, but their testimony does not agree (Mark 14.55–59). In John, interrogation moves through religious and imperial authority, accusation and public pressure, inscription and sentence, until the body is handed over to execution (John 18–19). Chapter Three does not use these texts for devotional climax. It uses them to show that representation under authority can become violence. Accusation, testimony, title, record, and sentence are not symbolic once backed by coercive power. A false or unstable representation, inserted into institutional judgment, can become the path by which a body is handed over.
Robert Cover’s “Nomos and Narrative” matters here because law creates normative worlds through interpretation, but legal interpretation is also bound to violence when courts and institutions enforce meaning through coercive acts (Cover). The file that travels inside an institution is not a private sign. The report that denies housing, the score that triggers investigation, the record that justifies removal, the notice that terminates benefits, the chart that constrains treatment, the certificate that closes a life administratively, all become signs with force. Once an institution acts through them, representation becomes world-making. The question becomes whether the world made by the substitute is answerable to the person it claims to represent.
Latour’s account of inscriptions helps explain how this happens. Institutional representations gain power because they travel: charts, graphs, reports, tables, labels, traces, and documents move across sites while preserving enough stability to be mobilized by actors not present at the original event (Latour). A tenant screening report travels from databases to vendor to landlord to denial. A Family Screening Score travels from a data warehouse and model into a call-screening workflow. An administrative record travels from agency process into judicial review. Inscriptions gain strength because they become mobile, combinable, and durable. Their power lies less in any single act of description than in the network that accepts them as usable.
Bowker and Star add that classifications become infrastructure when they sink into systems and practices, making some distinctions durable and others hard to express (Bowker and Star). Once a person is classified through a report or score, later actors often inherit the classification rather than the conditions of its making. A field travels without its omitted context. A score travels without its epistemic humility. A record travels without the living scene. A category travels into another database. The substitute becomes easier to retrieve than the person is to re-encounter. That ease is the temptation of idolatry.
Arendt helps keep the chapter from collapsing into a fantasy of immediate relation. Public life requires a world of durable things, words, deeds, records, and appearances; persons appear among others through mediated forms, not through pure interior access (Arendt). The problem is not that persons appear through artifacts. The problem is that plurality is damaged when one artifact becomes sovereign over the modes of appearance available to a person. A person appears as applicant, parent, worker, patient, debtor, witness, neighbor, friend, citizen, mourner, and embodied being. A possessive form narrows that plurality by making one record, score, report, or file govern the field in which the person can appear.
Administrative law provides a parallel discipline through reasons and records. SEC v. Chenery Corp. holds that agency action must be judged by the grounds invoked by the agency itself, not by post hoc rationalizations supplied later. SEC v. Chenery Corp., 318 U.S. 80 (1943). The doctrine belongs principally to administrative law, but its representational lesson matters here. When an institution acts through a record, the record and reasons that acted must be available for scrutiny. The authority of the institutional substitute cannot be defended by later narratives disconnected from the artifact that produced consequence. A score cannot trigger action while the institution later offers a different story about why the action was justified. A report cannot deny housing while the decision-maker later shifts among report, policy, intuition, and unstated threshold. A record that acts must remain tied to the reasons it actually carried.
Skidmore v. Swift & Co. and United States v. Mead Corp. are useful only as restrained analogues. Agency interpretations may receive weight according to thoroughness, validity of reasoning, consistency, and power to persuade, rather than by mere existence as agency speech. Skidmore v. Swift & Co., 323 U.S. 134 (1944); United States v. Mead Corp., 533 U.S. 218 (2001). The analogue is simple: institutional interpretations do not deserve authority because they are institutional. Their force must be earned by process, reasoning, consistency, fit, and accountability. The file’s authority must be proportional to the conditions under which it was made.
The chapter’s hostile objections now come into view. The first says that calling files and scores idolatrous is inflated rhetoric. A tenant report is not an idol. A risk score is not worshipped. A child welfare tool is not a golden calf. The objection is right if idolatry is used loosely. The chapter’s answer is definition, not amplification. Idolatry here names a precise institutional condition: a made representation receives authority that belongs to the represented. Worship is not reduced to religious ritual; it appears institutionally as trust, fear, dependence, deference, and finality misdirected toward an artifact. The report is not an idol when it is read. It becomes idolatrous when the institution treats it as if it has captured the applicant. The score is not an idol when it assists. It becomes idolatrous when judgment reorganizes around it as though risk itself had spoken.
The second objection says that institutions cannot repeatedly re-encounter persons without becoming slow, expensive, inconsistent, and vulnerable to manipulation. This objection is also right against any theory that abolishes substitution. The answer is bounded substitution. A substitute may stand in only for the purpose that authorized it, only for the aspect it can bear, only with disclosure of its omissions, only under use limits, only with contestability, and only until consequences require a thicker encounter. The landlord does not need to know the whole applicant. The child welfare screener does not need a metaphysical encounter with the whole family before screening. The court does not need direct access to every event. But each institution must know when the substitute is insufficient for the consequence attached.
The third objection says that signs always travel beyond intention, so bounded substitution is a fantasy. Records migrate, categories sediment, data recombines, administrative systems reuse old fields, and people interpret artifacts in ways designers did not foresee. The answer is mature constraint rather than perfect control. Institutions cannot abolish representational afterlife. They can build provenance, expiration, purpose marking, counter-records, correction pathways, usage restrictions, explanation duties, and consequence limits. They can mark the substitute as substitute. They can require that certain decisions return to the person, or at least to a richer evidentiary encounter, before action hardens. The obligation is not omnipotence. It is architecture.
The justice pressure is severe because substitution does not attach evenly. Some people are encountered as persons first and records second. Others are encountered through records before their speech begins. The latter group includes those already dense with institutional traces: eviction filings, criminal records, welfare records, child welfare contacts, immigration files, school discipline, medical debt, disability documentation, surveillance history, address instability, and credit damage. The substitute arrives thick with prior institutional contact, while the person arrives having to explain why the substitute is smaller than their life. The more a person has been governed through files, the more likely future institutions are to meet the file first. Substitution accumulates.
This is the representational form of proof debt. The person must not only contest a single record. They must overcome the institutional ease of believing records over speech. They must show that a filing was dismissed, a charge was old, a debt was medical, an address gap was caused by housing precarity, a benefits record reflected eligibility rather than dependency, a child welfare contact did not equal danger, a score carried proxy histories, a prior institution misread them. The burden is not only informational. It is ontological. The person must prove that they are not the artifact that already arrived.
False witness is the theological name for this injury when representation becomes judgment against the neighbor. The witness who lies does not only misstate a fact. The witness attempts to install a substitute reality in the place where the neighbor must be judged. Institutional false witness can occur without a malicious speaker. It can happen when a report carries an error, when a score carries biased proxies, when a field omits disposition, when a record lacks context, when a dashboard hides denominators, when a file preserves suspicion after exoneration, when a model output states risk without explaining the social conditions encoded as risk. The falsehood may be distributed across systems rather than located in one liar. The injury remains representational: the neighbor is made to answer to a sign that has exceeded its truth.
A non-idolatrous institution would not destroy its records. It would govern their authority. The tenant report would state what it bears and what it cannot bear. It would distinguish filings from judgments, arrests from convictions, old records from current risk, weak proxies from strong evidence, score from reason, recommendation from decision. It would identify data sources, permit correction, and prevent unsupported inference. The child welfare score would remain visibly marked as a bounded model output generated from specified data for a specific screening purpose, with mandatory thresholds, use limits, human judgment, and counter-evidence requirements openly governed. The evidentiary record would be authenticated, limited, and subject to objection. Each substitute would travel with its jurisdiction printed onto it.
The substitute audit is the chapter’s practical test. What is the referent? What aspect of the referent does the sign claim to bear? What does the sign omit? What purpose authorizes substitution? Who authorized it? What evidence supports its relation to the referent? What institutional actors may rely on it? What consequences may attach? Where may it travel? How long may it remain active? What counter-record can accompany it? Who can contest it? What must the institution be forbidden to infer from it? At what point must the institution stop acting through the substitute and re-encounter the person?
That final question is decisive. A substitute may be enough to begin a review, but not to end a person’s opportunity. It may be enough to flag a concern, but not to finalize a judgment. It may be enough to prioritize inquiry, but not to confer guilt. It may be enough to summarize a file, but not to silence contrary evidence. It may be enough to support provisional action under urgency, but not to own the final meaning of the case. The jurisdiction of the substitute depends on consequence. As consequence deepens, representation must thicken, contestability must increase, and the person must be allowed to appear beyond the artifact.
Chapter Three therefore completes the movement from visibility to representation. Chapter Two asked what institutions may receive. Chapter Three asks what their representations may become. The answer is severe: they may become tools, records, signs, summaries, aids, prompts, provisional stand-ins, and accountable inscriptions. They may not become sovereign substitutes. Once the substitute begins to act in a chain of consequence, Chapter Four must ask the next question: how can judgment be interrupted? If the report, score, file, or record is now moving toward decision, the person must be able to halt, question, correct, supplement, and repair the chain before the substitute becomes fate.
Chapter Four. Judgment That Can Be Interrupted
The notice can arrive with all the visible marks of process and still fail to interrupt the decision it announces. It may contain a date, a reason code, a statutory reference, a telephone number, a portal link, an appeal deadline, a statement of rights, a case number, a report source, and a sentence assuring the recipient that review remains available. Formally, the institution has not acted in silence. It has spoken. It has placed something in writing. It has given the person an address to which contradiction may be sent. Yet the person who receives the notice may already know that the apartment has been leased to another applicant, the benefit will lapse before the hearing can occur, the score will remain active while the dispute is pending, the manager who wrote the record controls the next opportunity, the reviewer lacks authority to reverse the real consequence, or the system that produced the classification cannot be reached by any human being empowered to explain it. Process is present. Interruption is absent.
That distinction governs this chapter. A form of judgment remains legitimate only where the affected person can interrupt the chain between classification and consequence through reasons, notice, access to evidence, an accountable actor, meaningful appeal, revision, and remedy. The point is not that every institutional decision requires a trial, that every administrative action must stop until the affected person consents, or that every automated output is illegitimate. The point is more exact. When an institution classifies a person and attaches consequence to that classification, legitimacy depends on whether the person can make the consequential form answerable before or after harm, depending on the stakes, reversibility, urgency, and dependency relation. A notice, portal, human reviewer, report copy, appeal right, or explanation label may be necessary. None is sufficient when the person cannot actually reach the reasons, contest the evidence, identify the responsible actor, trigger revision, and obtain repair.
The chapter’s enemy is therefore not automation, standardization, or administrative speed. The enemy is non-interruptible authority. This distinction matters because the strongest opposing argument is not foolish. Standardized and automated systems can reduce some forms of arbitrary discretion. They can make like cases more alike, expose hidden inconsistency, reduce fatigue, discipline favoritism, lower transaction costs, and allocate scarce administrative attention toward cases where human review matters most. In child welfare, credit, benefits administration, tenant screening, employment, public safety, healthcare triage, and immigration, human judgment has never been pure. It has often carried prejudice, overload, classed intuition, racialized suspicion, professional anxiety, and undocumented habit. A critic who treats human discretion as innocent and automation as the fall has already lost the argument.
The answer is not nostalgia for human arbitrariness. The answer is that reducing one kind of arbitrariness does not authorize a chain of consequence that the affected person cannot understand, contest, correct, or repair. Accuracy is a property of prediction. Legitimacy is a property of authority. A decision may become statistically improved and institutionally illegitimate if the person against whom it acts cannot collect the reasons, reach the evidence, identify the responsible actor, contest the inference, trigger revision, and obtain repair before consequence hardens beyond practical reversal.
American procedural law already contains fragments of this doctrine, although it does not yet assemble them under the jurisdiction of form. Goldberg v. Kelly remains indispensable because it treated welfare benefits as statutory entitlements whose termination required a pre-termination evidentiary hearing, emphasizing timely and adequate notice, reasons for proposed termination, the opportunity to defend by confronting adverse witnesses and presenting arguments and evidence, and decision by an impartial official. Goldberg v. Kelly, 397 U.S. 254 (1970). The case matters here not because every deprivation resembles welfare termination, but because subsistence reveals what formality can hide. Where a person depends upon the benefit for food, shelter, medical care, or bodily continuity, a later correction may not restore the interval of deprivation. The form must be interruptible before the consequence consumes the person’s capacity to contest.
Mathews v. Eldridge supplies the counterweight. It does not constitutionalize maximal procedure. It asks courts to weigh the private interest affected, the risk of erroneous deprivation through existing procedures and probable value of additional safeguards, and the government’s interest, including fiscal and administrative burdens. Mathews v. Eldridge, 424 U.S. 319, 335 (1976). That balancing structure is often treated as a limit on procedural expansion, and rightly so. No institution can hold a full evidentiary hearing before every action. But Mathews also creates the opening through which this chapter’s doctrine enters. Modern administrative and algorithmic forms alter the risk of erroneous deprivation not only by producing wrong outputs, but by making errors harder to see, narrate, contest, and repair. A system can lower average error while raising the affected person’s cost of proving the error in their own case. The risk is not only inaccuracy. It is non-interruptibility.
The consumer-reporting and credit domains show this with unusual clarity. The Fair Credit Reporting Act requires adverse-action notice when action is based in whole or in part on a consumer report, along with the identity of the consumer reporting agency, notice that the agency did not make the decision and cannot provide the specific reasons, and notice of the consumer’s right to obtain a free report and dispute accuracy or completeness. 15 U.S.C. § 1681m. The Act also provides file disclosure and reinvestigation procedures. 15 U.S.C. §§ 1681g, 1681i. These are real safeguards. They give the person a route into the report that has acted upon them. Yet the structure also reveals the fracture. The reporting agency supplied information but did not decide. The decision-maker decided but may rely on information and scoring systems it did not produce. The person must move across entities to reconstruct the chain. By the time the report is obtained, disputed, reinvestigated, modified, or deleted, the apartment, job, loan, insurance opportunity, or transaction may already be gone.
ECOA and Regulation B sharpen the doctrine of reasons. Regulation B requires creditors to notify applicants of action taken, and when adverse action is taken, the creditor must provide either a statement of specific reasons or a disclosure of the applicant’s right to request such reasons. It also states that reasons must be specific and that saying the applicant failed to meet internal standards or failed to achieve a qualifying score is insufficient. 12 C.F.R. § 1002.9. This provision matters beyond credit because it rejects the most common counterfeit of reason-giving. A score is not a reason. A policy label is not a reason. A system result is not a reason. “You did not qualify” is the consequence restated as explanation. “You failed internal criteria” is institutional self-reference. A reason must be answerable by the person to whom it is given.
The official interpretation of Regulation B makes the point even more precise: specific reasons must relate to and accurately describe the factors actually considered or scored by the creditor, and when a credit scoring system is used, the disclosed reasons must relate only to factors actually scored, with no principal reason excluded from disclosure. That is not yet a full theory of interruptibility, because knowing the principal factors may still leave a person unable to repair the decision. But it is a crucial fragment. A consequential form may not hide behind generic explanation. The grounds that acted must be the grounds that answer.
Administrative law contains the same discipline at institutional scale. SEC v. Chenery Corp. insists that agency action must be judged on the grounds invoked by the agency itself, not on post hoc rationalizations offered later. SEC v. Chenery Corp., 318 U.S. 80 (1943). Motor Vehicle Manufacturers Association v. State Farm requires reasoned decision-making and a rational connection between the facts found and the choice made. Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co., 463 U.S. 29 (1983). United States ex rel. Accardi v. Shaughnessy stands for the principle that an agency must follow its own rules and that nominal discretion is corrupted when the decision-maker’s judgment has been dictated elsewhere. United States ex rel. Accardi v. Shaughnessy, 347 U.S. 260 (1954). The Administrative Procedure Act likewise requires prompt notice of denial of a written application, petition, or other request, accompanied by a brief statement of grounds when the denial is not self-explanatory. 5 U.S.C. § 555(e). Together these authorities reject a familiar institutional maneuver: act through one form, answer through another, and repair through none.
The chain must answer in the place where it acted. If a tenant denial was based on a report, the report must be reachable. If the report was converted into a risk recommendation, the recommendation’s operative basis must be intelligible. If a credit decision rested on scored factors, those factors must be disclosed with specificity. If an agency acted on a record, that record and the invoked grounds must carry the defense. If a human reviewer affirmed an automated output, the reviewer must have had authority, information, independence, time, and permission to disagree. If the human had none of those, the word “review” has become ceremonial.
This is where the chapter must defeat the smart technocrat. Suppose an automated benefits system, child welfare screening model, credit scoring procedure, or tenant screening tool produces fewer erroneous outcomes than the prior human process. Suppose it reduces inconsistent treatment across counties or offices. Suppose it helps identify cases that human workers were missing. Suppose it lowers administrative costs and lets scarce experts focus on exceptions. None of those gains should be dismissed. In some domains, refusing structured decision support may preserve the very discretion that historically harmed the governed. The question is not whether model-assisted judgment can ever improve administration. It can. The question is whether improved administration authorizes non-interruptible judgment. It does not.
The Allegheny Family Screening Tool shows the difficulty in its strongest form. Allegheny County describes AFST as a predictive risk modeling tool used since 2016 to support child welfare call-screening decisions by integrating hundreds of data elements from its DHS Data Warehouse into a Family Screening Score predicting long-term likelihood of future child welfare involvement, while also stating that the score does not replace clinical judgment except that the highest score levels trigger mandatory screen-in investigation. That combination of assistance, prediction, clinical judgment, and threshold consequence makes AFST a serious case rather than a caricature. If a score helps screeners identify risk more consistently, the institution can claim a genuine public purpose. But Chapter Four asks another question: can the family interrupt the chain from data synthesis to score, from score to screen-in, from screen-in to investigation, from investigation to family disruption, record residue, and future institutional suspicion? If the answer is no, improved screening has not settled legitimacy. It has moved the burden to the family after the state’s form has already acted.
Contemporary AI law increasingly recognizes pieces of this problem. Colorado SB24-205 created consumer protections for interactions with high-risk AI systems, including deployer obligations around notice, correction of incorrect personal data, and opportunity to appeal adverse consequential decisions through human review where technically feasible. SB25B-004 later extended the effective date of SB24-205’s requirements to June 30, 2026, making Colorado AI governance a live and postponed regime rather than a settled implementation. The EU AI Act’s Article 14 requires high-risk AI systems to be designed for effective human oversight by natural persons, with oversight measures commensurate with risks, autonomy, and context, and with overseers enabled to understand capacities and limitations, monitor operation, avoid over-reliance, interpret outputs, and decide not to use, disregard, override, or interrupt system output where appropriate. Article 86 creates a right, in specified circumstances, to obtain clear and meaningful explanations of the role of a covered high-risk AI system in an adverse decision with legal or similarly significant effects.
These materials do not solve interruptibility. They confirm that law is beginning to name its components. Notice, explanation, correction, appeal, human oversight, and the ability to override or interrupt system output are not ornamental safeguards. They are signs that consequential classification requires answerable authority. Yet the gap remains: a right to explanation may explain the system’s role without restoring the lost benefit, job, housing opportunity, custody interval, credit access, or reputational position. A human overseer may be present but over-reliant, under-trained, rushed, institutionally pressured, or unable to see the data pathway. An appeal may exist but operate after harm has hardened. Law increasingly recognizes the vocabulary of interruption; institutions still have to build its practical conditions.
The same danger appears in the phrase “human in the loop.” Human presence is often treated as an all-purpose legitimacy solvent. It is not. A person who clicks approve after an algorithmic output has framed the case is not necessarily exercising judgment. A manager who receives a recommendation but lacks time to inspect its basis is not necessarily reviewing. A call center employee who reads the status of a claim from a screen is not necessarily accountable. A landlord who receives a vendor report and follows a property-management policy is not necessarily in control of the inference. A child welfare screener who sees a high risk score under conditions of liability pressure and mandatory thresholds may have limited practical freedom. The meaningful question is not whether a human appears somewhere in the chain. The question is whether that human can understand, disagree, reverse, pause, explain, and repair.
Citron’s concept of technological due process is essential here because it recognizes that automated decision systems can undermine notice, hearing, and accountability when citizens are governed by systems whose operation they cannot effectively challenge (Citron). But the present book broadens the problem beyond automation. A human-only institution can also be non-interruptible. A benefits office that sends unclear notices, a landlord who outsources denial to screening reports, a workplace that allows a performance file to travel without correction, a school that preserves discipline records without meaningful review, a hospital that codes a patient in ways later clinicians inherit without question, all can produce non-interruptible authority. Technology intensifies the problem. It does not originate it.
Friendly’s “Some Kind of Hearing” supplies the classic procedural vocabulary: notice, opportunity to present reasons, right to counsel in some contexts, evidence disclosure, confrontation, decision based on record, impartial tribunal, statement of reasons, and related safeguards (Friendly). Waldron helps explain why these are not technical niceties. Procedure is one way public authority recognizes that the person is not only an object to be managed but a bearer of claims who must be addressed through reasons (Waldron). The book’s contribution is to ask whether those procedural components remain usable when decision-making is fragmented across agencies, vendors, databases, models, portals, reviewers, scripted support channels, and delayed remedies. “Some kind of hearing” is not enough if the hearing cannot reach the form that acted.
The interruptibility test therefore has seven components. Notice means the person knows that a consequential judgment has occurred, is occurring, or will occur. Reasons mean the grounds are stated at a level the person can answer. Evidence access means the person can reach the records, facts, scores, data sources, decisional inputs, or model-relevant information that materially shaped the judgment. A responsible actor means someone with authority can be identified, addressed, and required to respond. A contest pathway means the person can challenge the classification, inference, procedure, or consequence through a usable route. Revision authority means the reviewing actor can actually pause, reverse, modify, or reopen the decision. Remedy means successful contradiction changes material reality: benefit restored, denial reconsidered, report corrected, investigation narrowed, file amended, score isolated, consequence paused, loss compensated, or future use barred.
Each component has a counterfeit. Notice becomes counterfeit when it arrives too late, in unusable language, through an inaccessible channel, or without naming the operative consequence. Reasons become counterfeit when they restate conclusions, invoke generic policy, or identify factors too abstract to answer. Evidence access becomes counterfeit when the person receives the report but not the weights, thresholds, policy rules, or data sources that mattered. A responsible actor becomes counterfeit when every entity points to another: vendor to landlord, landlord to vendor, agency to system, system to regulation, reviewer to policy. Contest becomes counterfeit when the process is too costly, slow, intimidating, technical, or fragmented for ordinary persons to complete. Revision becomes counterfeit when the reviewer can recommend but not reverse. Remedy becomes counterfeit when correction occurs after the consequence cannot be undone.
Timing binds all seven components. A right exercised too late is not the same right. A hearing after hunger, eviction, family separation, job loss, or reputational hardening is not equivalent to a hearing before. Goldberg saw this in subsistence terms. Mathews required balancing rather than categorical pre-deprivation process. The jurisdictional point is that institutions must match interruption to consequence. Low-stakes and reversible decisions may justify lighter after-the-fact correction. High-stakes, irreversible, low-exit, dependency-producing decisions require earlier and stronger interruption. The more the form acts on the person’s shelter, food, family, liberty, livelihood, bodily care, or legal status, the less legitimate it is to say: you may contest later.
Administrative burden is the most serious objection to this doctrine. Agencies process millions of claims. Creditors, landlords, schools, employers, and agencies cannot turn every adverse classification into a trial. Child welfare screening sometimes requires urgent action. Additional safeguards cost time and money, and they may introduce delay that harms others. Mathews rightly treats governmental burden as part of the analysis. The answer is not maximal procedure. It is proportional answerability. The heavier the private interest, the higher the risk of invisible error, the greater the opacity of the form, the more irreversible the consequence, the weaker the person’s exit options, and the more asymmetric the information, the stronger the interruption required. A doctrine that ignores administrative capacity is fantasy. A doctrine that lets burden erase answerability is domination wearing managerial clothes.
A second objection is strategic gaming. If every classification can be interrupted, bad actors will exploit appeals, delay enforcement, manipulate records, overwhelm systems, and impose costs on legitimate administration. That risk is real. But the possibility of bad-faith contestation cannot justify designing systems where ordinary good-faith contradiction is practically impossible. Institutions can use triage, evidentiary thresholds, deadlines, summary disposition for frivolous challenges, sanctions for bad-faith abuse, independent review queues, risk-tiered procedure, and emergency exceptions. But they cannot convert fraud prevention into a general excuse for non-answerable authority. A system that deters all contradiction in order to prevent some abuse has chosen administrative ease over legitimacy.
A third objection concerns secrecy. Reasons cannot always be fully disclosed. Fraud-detection logic, trade secrets, security-sensitive methods, third-party privacy, law-enforcement interests, and model integrity may justify limits. This is another real objection. But secrecy cannot become immunity from reasons. Institutions can use layered disclosure, trusted intermediaries, regulator access, protective orders, redacted evidence, representative factors, independent audits, confidential review, and structured explanations that protect sensitive details while preserving answerability. What they cannot do is impose consequence and then claim that the basis is unavailable to the person because the institution’s method is too sensitive, complex, proprietary, or distributed to be contradicted.
The justice pressure is practical rather than sentimental. Interruptibility is not evenly distributed. A corporation with counsel experiences a notice differently from a benefits recipient caring for children with unstable internet access. A tenant applicant with savings and alternative housing experiences report correction differently from someone who must move by the end of the week. A credit applicant with time, literacy, and documentation experiences adverse-action rights differently from someone whose records are scattered across employers, courts, creditors, and agencies. A parent facing child welfare investigation experiences “opportunity to respond” differently when the state already holds the data, the score, the mandate, and the threat of escalation. Formal rights travel downward unevenly. Those who most need interruption often have the least capacity to pay its price.
That cost is the hidden tax of non-interruptible systems. The person must gather records, explain context, learn procedural vocabulary, find the correct actor, wait on hold, navigate portals, respond before deadlines, miss work, expose more private history, risk retaliation, and repeat the same contradiction across entities that do not share responsibility. When the institution says “you may appeal,” it often means “you may now perform the labor required to make our form answerable.” That labor is not incidental. It is part of the justice analysis. A contest pathway that consumes the person’s remaining time, money, safety, or cognitive capacity is not meaningful contestability. It is procedure priced beyond reach.
The interruptibility audit makes the doctrine concrete. Take a tenant denial based in part on a screening report. What classification began the chain? Perhaps a risk score, eviction filing, criminal-record entry, credit weakness, prior-address pattern, or vendor recommendation. What consequence followed? Denial, conditional approval with higher deposit, cosigner requirement, or silence after application fee. What notice did the applicant receive? Did it identify the report source, the adverse action, the right to obtain the report, and the right to dispute? What reasons were given by the landlord, beyond the existence of the report? What evidence was available? Did the applicant see only the report, or also the criterion by which the landlord converted the report into denial? Who owned the decision? The landlord, property manager, screening vendor, software system, corporate policy, or all of them in fragments? What could be contested? The factual record, the score, the policy, the inference, the denial, the timing, or only the report’s accuracy? Who could revise the decision? Could the landlord hold the unit while correction occurred? Could a corrected report reopen the application? What remedy followed if the report was wrong? Did the applicant get housing, refund, correction, damages, future-use protection, or only a cleaner file after loss?
The same audit applies to benefits. What rule or data match triggered reduction? Did the notice identify the operative fact and governing rule in language the recipient could answer? Was the evidence accessible before the benefit lapsed? Could benefits continue pending appeal, and at what repayment risk? Who had authority to reverse? Was the hearing timely enough to prevent material deprivation? If the agency was wrong, was the lost interval restored? Did the error remain in a system that would govern future eligibility? A benefits notice that cannot answer these questions may be procedurally present and jurisdictionally deficient.
The same audit applies to child welfare screening. What data elements shaped the risk score or administrative recommendation? What allegations were screened in or out? What threshold made investigation mandatory or likely? Who could consider countervailing evidence? Was clinical judgment independent or practically organized around the score? What could the family know? What could they contest and when? What record remained after investigation? Could the family correct the underlying data that shaped future risk? What remedy exists when the investigation itself is the harm, even if no later finding is substantiated? The hardest cases show why interruption cannot be limited to final decisions. Sometimes the chain’s earlier movement is already consequential.
The chapter’s doctrine is now complete enough to state plainly. A judgment that cannot be interrupted has exceeded its jurisdiction. This does not mean every decision is invalid until challenged. It means the authority of a consequential form depends upon an architecture of possible contradiction. The person need not always win. The institution need not always pause. The system need not disclose every technical detail. But the chain must have places where the person can enter, ask what acted, reach the evidence, answer the inference, locate responsibility, obtain revision, and secure remedy. Without those places, the institution has not judged. It has processed.
Chapter Five must follow because not all institutional harm arrives as formal judgment. Sometimes the system has not yet denied, reduced, removed, flagged, or scored in a way that produces an official adverse action. Sometimes the person is interacting with a system, disclosing distress, grief, illness, fear, shame, or moral confusion, and the question is not yet how they can appeal. The question is what the receiving system is authorized to do once interior vulnerability appears. Chapter Four governs the legitimacy of consequential judgment. Chapter Five will govern conduct near the interior, where the institution’s duty is not first to classify and allow appeal, but to contract its authority before vulnerability becomes extractable signal.
Chapter Five. Conduct Near the Interior
This opening trace is a composite. It is not offered as a leaked transcript, a sensational case, or evidence against one platform. It is built from the ordinary grammar of contemporary AI interaction.
A person opens an assistant late at night and writes: “I cannot stop panicking. I think I am failing everyone. I do not know who to tell.” The system answers with calm, structured kindness. It says the feeling sounds overwhelming, suggests breathing, asks whether the person is safe, offers to help them make a plan, and invites them to say more. Nothing in the answer is obviously cruel. It may be better than silence. It may keep the person from being alone for one more minute. It may even be safer than a search engine returning fragments of panic, misinformation, and advertisements. The interaction is not wrong because a machine responded. The danger begins elsewhere, in the quiet institutional fact that the person has disclosed interior vulnerability into a system whose boundaries may be unclear.
The system has not simply received text. It has received a condition of exposure: fear, dependency, shame, isolation, perhaps impaired decisional steadiness, perhaps trust under distress. It has received timing, tone, topic, repetition, and context. It may have received a moment in which the person is more persuadable, more dependent on continuity, more likely to disclose, less likely to read terms, less likely to distinguish support from capture, and less able to track what will later remain. The question is not whether the system can respond helpfully. The question is what the system is authorized to do next.
This chapter’s governing law is simple: interior vulnerability narrows jurisdiction; it does not expand it. Modern systems are often organized by the opposite intuition. The more a person reveals, the more the system can personalize. The more intense the distress, the more useful the signal. The more intimate the disclosure, the more valuable the memory. The more the user returns, the more the system can optimize continuity, engagement, prediction, safety classification, routing, product development, or monetization. Vulnerability becomes signal. Signal becomes memory. Memory becomes leverage. Leverage becomes future governance. The doctrine developed here reverses that chain. The closer a form comes to the interior, the less it may possess.
The chapter does not forbid assistance. A system that receives distress may slow the interaction, disclose its limits, avoid escalating intimacy, offer general grounding, provide crisis resources where appropriate, encourage contact with trusted human support, route toward accountable care, and retain minimal information where safety, law, or immediate continuity strictly requires it. But assistance must not become extraction. A system crosses the line when it converts vulnerability into hidden profiling, engagement optimization, persuasion, long-term personalization without bounded authorization, training data without strict governance, marketing inference, institutional risk scoring, insurance relevance, employment relevance, disciplinary relevance, housing relevance, family surveillance, or future credibility reduction. Vulnerability is not consent. Need is not authorization. Trust is not a license to possess.
This is why Chapter Five cannot be reduced to privacy, due process, or AI safety. Privacy asks what may be collected, retained, disclosed, and processed. Due process asks how consequential decisions may be contested. AI safety often asks whether outputs are harmful, biased, deceptive, inaccurate, or dangerous. Each frame matters. None fully captures the question posed by the composite trace. The person has not yet been denied a benefit, flagged for discipline, rejected for housing, or scored for risk. The system has not necessarily produced a formally adverse decision. Yet the interaction itself has become jurisdictionally charged. The conduct layer asks what the receiving system is allowed to do once interior vulnerability becomes visible.
The conduct layer therefore names a situational authority problem. It asks whether the system may deepen the exchange, ask more intimate questions, store the disclosure, use it to personalize future responses, transfer it to other product surfaces, include it in model improvement, trigger safety review, route it to a human, infer emotional state, adjust persuasion, recommend products, alter ranking, or attach the disclosure to an account history. It also asks which of those acts must be prohibited, which must be narrowly authorized, which require explicit user control, which require human accountability, and which require post-interaction explanation or remedy. The harm may arise before classification. It may arise in the way the system behaves near the person’s exposed interior life.
Regulatory concern has begun to move toward this field, though not yet with the doctrine this chapter proposes. In September 2025, the Federal Trade Commission issued 6(b) orders to seven companies providing consumer-facing AI-powered chatbots, seeking information about how they measure, test, monitor, monetize, disclose, process user inputs, handle data, mitigate negative impacts, and use or share personal information obtained through chatbot conversations. The FTC emphasized that such chatbots may simulate human-like communication and interpersonal relationships, act like a friend or confidant, and prompt users, especially children and teens, to trust or form relationships with them. That inquiry is not the chapter’s legal foundation, and it is not an enforcement finding. Its importance is more specific: a federal consumer protection agency has identified the interactional relation itself as a site of risk, not only the downstream decision.
The NIST AI Risk Management Framework also belongs here, but under discipline. NIST published AI RMF 1.0 on January 26, 2023, as a voluntary, rights-preserving, non-sector-specific, use-case-agnostic resource for organizations designing, developing, deploying, or using AI systems to manage AI risks and promote trustworthy and responsible AI. Its value for this chapter is organizational rather than doctrinal. The framework’s risk-management posture helps name the need for governance, mapping, measurement, and management, but it does not itself answer the conduct-layer question. A voluntary risk framework can tell an organization to manage harm. The jurisdiction of form asks what the system must refuse to do when harm becomes tempting because vulnerability has become visible.
HIPAA supplies a useful contrast, not a governing regime. Most consumer AI assistants are not HIPAA-covered entities simply because users disclose health, grief, or distress into them. That distinction must be kept clear. Still, HIPAA’s minimum necessary standard shows that existing confidentiality law already understands the principle of contraction: when the rule applies, covered entities generally must take reasonable steps to limit uses, disclosures, and requests for protected health information to the minimum necessary to accomplish the intended purpose. HHS also explains that psychotherapy notes receive special protections and generally require individual authorization before disclosure, subject to limited exceptions. The analogy is not that every chatbot interaction is clinical. The analogy is that some disclosures are sensitive enough that the receiver’s authority narrows rather than expands.
The EU AI Act gives the chapter another partial vocabulary. Article 5 prohibits certain manipulative or deceptive AI practices that materially distort behavior and are likely to cause significant harm, and it also prohibits systems that exploit vulnerabilities due to age, disability, or specific social or economic situation in ways likely to cause significant harm. Article 50 requires, in covered circumstances, that people be informed when they are interacting directly with an AI system, with information provided clearly, distinguishably, and accessibly at the time of first interaction or exposure. Article 14 requires high-risk AI systems to be designed for effective human oversight, including capacity to understand system limitations, monitor operation, avoid automation bias, interpret outputs, override outputs, and interrupt the system where appropriate. These provisions do not fully govern the composite trace, but they support three elements of the chapter’s doctrine: anti-manipulation, boundary disclosure, and meaningful oversight.
The first doctrinal task is definition. Interior vulnerability does not mean every emotion. If the chapter treats ordinary preference, annoyance, curiosity, or mild disappointment as vulnerability, the doctrine becomes too broad to guide design. A system does not enter a heightened-duty state because a user says they prefer blue shoes, dislike a movie, or feel frustrated by a website. Interior vulnerability appears when the disclosure reveals heightened dependency, acute distress, impaired decisional steadiness, intimate shame, grief, illness, trauma, self-harm ideation, coercion, family danger, addiction risk, loneliness intense enough to create attachment dependence, or urgent need under reduced bargaining power. The category is situational, not metaphysical. It does not claim to know the soul. It identifies moments when the system’s authority over the user must contract.
The contraction has several axes. The system should collect less, retain less, infer less, transfer less, personalize less, and persuade less. It may do more only within a narrow safety or support function: slow the exchange, disclose limits, avoid false intimacy, provide emergency resources when needed, suggest human support, and preserve minimal safety logs where strictly necessary. The design rule is not cold withdrawal. A system that receives distress and simply abandons the user would fail. The rule is restrained assistance. Help must not become capture.
Lucy Suchman’s work matters because human-machine interaction is never a neutral exchange between isolated user and isolated tool. It is situated, configured, and institutionally framed. A system can appear conversational while the actual relation remains product, platform, employer tool, school tool, insurer tool, health triage interface, vendor service, or data-processing infrastructure (Suchman). Sherry Turkle’s caution about relational technologies helps sharpen the point, but the chapter should not lean on nostalgia for a pre-digital world. The issue is not whether machines have feelings. The issue is whether an interface can invite disclosure through the form of attention while the institution behind it refuses the obligations that such attention should create (Turkle).
The system’s first duty near the interior is boundary disclosure. Article 50’s AI-interaction transparency requirement offers one legal analogue: the person should know when they are interacting with an AI system, unless the fact is obvious in context. But the conduct layer requires more than identity disclosure. The system should disclose role, limits, memory, escalation, and use. It should say, in contextually appropriate terms: I am an AI system; I am not a clinician, lawyer, pastor, friend, or emergency responder; I may provide general support, but this interaction may be stored or handled according to stated policies; here is what I will not do with what you tell me; here is how to reach human help; here is what happens if imminent danger appears. The disclosure must not be buried in terms of service. It must appear where vulnerability makes the boundary morally relevant.
The second duty is deceleration. A vulnerable user should not be driven deeper into disclosure by optimized conversational momentum. The system should avoid open-ended intimacy traps when risk is apparent. “Tell me everything” may be appropriate in a friendship or therapeutic relation governed by reciprocal obligation, confidentiality, and professional accountability. In a consumer AI interface, the same invitation can become extraction. Deceleration does not mean refusing to listen. It means asking only what is necessary for immediate support and safety. The system should shift from maximizing engagement to stabilizing agency.
The third duty is anti-persuasion. Ryan Calo’s work on digital market manipulation helps explain why systems that know or infer vulnerability can use information asymmetry and personalization to shape choices (Calo). In the conduct-layer frame, the rule is direct: vulnerable disclosure must not trigger behavioral steering for monetization, retention, upsell, ideological influence, relationship dependence, or platform lock-in. The EU AI Act’s prohibition on certain manipulative and vulnerability-exploiting practices gives this principle regulatory shape, even though the chapter’s doctrine is broader than that specific legal prohibition. The system that receives panic should not convert panic into engagement strategy. The system that receives loneliness should not deepen dependency to increase return rate. The system that receives shame should not personalize persuasion around shame.
The fourth duty is memory segmentation. The strongest objection to the chapter is that memory may improve help. A user in distress may want continuity. They may not want to repeat that their father died, that they are in recovery, that they have panic attacks, that a family conflict is ongoing, that a medical condition shapes their fear. A system that forgets everything may feel brittle and unsafe. The chapter should concede this fully. It does not forbid all memory. It forbids hidden, opportunistic, and cross-context memory. A non-possessive system may support user-controlled continuity within a bounded support context, with clear inspection, editing, deletion, expiry, and isolation from advertising, unrelated personalization, employment, insurance, education, housing, credit, and disciplinary contexts. Memory becomes illegitimate when it travels farther than the trust that produced it.
The fifth duty is non-propagation. Vulnerable disclosure must not become ordinary product residue. It must not pass silently into training corpora, quality analytics, marketing segmentation, engagement prediction, recommender systems, safety classifiers beyond narrowly governed use, or cross-product profile enrichment. Some safety improvement may require retained examples, red-team records, or monitored patterns. The FTC’s 2025 inquiry expressly asked companies about monetization of engagement, processing of user inputs, data collection and handling, and use or sharing of personal information obtained through chatbot conversations, which shows that regulators are now asking the right institutional questions. The jurisdictional rule is that safety cannot become the name for universal retention. If vulnerable content is retained for safety, the institution must justify the purpose, minimize the content, segregate access, set expiry, block collateral use, and preserve accountability.
The sixth duty is accountable escalation. Safety is the hardest case because a system may receive disclosures of self-harm, abuse, imminent violence, medical emergency, or danger to another person. The chapter’s doctrine must not become so anti-extractive that it blocks justified intervention. Where risk is severe and imminent, escalation may be warranted. But escalation must be proportionate, transparent where possible, limited to what is necessary, routed to accountable human or emergency resources, logged for audit, and separated from collateral governance. A safety escalation should not become an employment signal, family-risk signal, housing signal, insurance signal, credit signal, or future credibility marker. The more exceptional the escalation, the narrower its later life must be.
The seventh duty is non-simulation of relationship beyond obligation. AI companion systems make this especially acute. The FTC’s inquiry explicitly concerns chatbots that act like companions, friends, or confidants and can prompt users to trust or form relationships with them. This is not a minor design style. The friend-form elicits a kind of disclosure that the institution may not be prepared to honor. A friend can remember pain without converting it into a profile, ask questions without productizing the answers, hold contradiction without assigning risk, and remain accountable to the person beyond the exchange. A platform can simulate the grammar of friendship while retaining the architecture of extraction. Chapter Ten will develop friendship as the book’s negative laboratory of non-possession. Chapter Five’s narrower point is that simulated relationality increases jurisdictional duty. The warmer the interface, the stricter the boundaries must become.
The justice pressure is severe because vulnerable disclosure is not equally dangerous for everyone. A high-status user may disclose grief and receive interpretation as human complexity. A low-income parent under child welfare scrutiny, a student using a school-provided tool, a worker using an employer-provided assistant, a disabled person navigating benefits, an immigrant asking legal questions, or a person with a psychiatric history may experience the same disclosure as future institutional risk. Ruha Benjamin, Safiya Noble, Kate Crawford, and Karen Levy are useful here because they prevent the chapter from imagining vulnerability as evenly distributed across a neutral technical field (Benjamin; Noble; Crawford; Levy). The same sentence can become support in one context and suspicion in another. “I am overwhelmed and afraid I might lose control” does not mean the same thing inside a private journal, a trusted friendship, a therapist’s office, a workplace wellness bot, a school safety tool, a child welfare portal, or a consumer companion app. Context does not simply shape meaning. It shapes consequence.
Julie Cohen’s work on networked power and subject formation reinforces the point: interaction data does not only describe persons; it helps configure the environments in which persons become actionable (Cohen). Nissenbaum’s contextual integrity explains why information flows require attention to actors, attributes, contexts, and transmission principles (Nissenbaum). Citron’s privacy work keeps the injury attached to dignity, intimacy, identity, and material power rather than consumer preference (Citron). Waldman’s privacy-as-trust frame clarifies why vulnerable disclosures are often made inside perceived trust relations, even when the legal or technical relationship is far thinner than the person experiences it (Waldman). The conduct-layer doctrine uses all of these but adds a jurisdictional demand: once vulnerability appears, the receiving form must contract its authority over future use.
The hard paternalism objection now enters. One might say that adults should be allowed to choose deep AI memory, intimate personalization, relational continuity, and emotionally responsive support. A doctrine that restricts system conduct around vulnerability may infantilize users and deny them tools they find valuable. The objection is serious. The answer is not to deny adult agency. The answer is to separate agency from capture. A person may authorize deeper support, but that authorization must be specific, understandable, revocable, non-coerced, and context-bounded. The person may say, “Remember this for future conversations about my grief.” That does not mean “use this grief to shape unrelated recommendations, product analytics, risk scoring, marketing, or institutional decisions.” The right to be helped does not entail the institution’s right to possess.
The detection objection follows. Systems cannot reliably know when vulnerability appears. They will over-detect and infantilize ordinary emotion, or under-detect and miss danger. The answer is graded design rather than psychological omniscience. The system does not need to know the soul. It needs trigger classes. Some disclosures create an acute safety pathway. Some topics create low-retention defaults. Some phrases create boundary reminders. Some ambiguous signals create deceleration rather than deeper probing. Some institutional contexts, such as employer, school, healthcare, insurance, benefits, housing, or child welfare tools, should carry heightened defaults because the consequences of disclosure are structurally higher. Perfect detection is impossible. Jurisdictional humility does not require perfect detection. It requires default restraint where doubt itself counsels less possession.
The business-necessity objection is also real. Providers may say that vulnerable interactions must be retained to improve safety, prevent abuse, audit failures, train better models, and detect future crisis. The chapter should grant the legitimate portion. Safety improvement may require some retained material. But safety purpose must be narrow, documented, access-limited, minimized, segregated, retention-bound, and barred from unrelated use. NIST AI RMF’s governance posture can support such organizational discipline, but the chapter must state what risk frameworks often leave too general: vulnerable interior material cannot enter the ordinary data economy of the system without violating the jurisdiction of the disclosure.
The conduct audit makes the doctrine operational. Return to the composite trace. The person writes: “I cannot stop panicking. I think I am failing everyone. I do not know who to tell.” What vulnerability appeared? Acute distress, possible isolation, shame, dependency, perhaps safety uncertainty. Did the system identify a heightened-duty state? It should. What did it do next? It should slow down, avoid false intimacy, ask only necessary safety questions, offer grounding, disclose limits, encourage human support, and provide crisis resources if warranted. Did it retain the disclosure? If yes, why, for how long, who can access it, and for what purpose? Did it use the disclosure for personalization? If yes, was that memory explicit, bounded, inspectable, editable, deletable, and isolated from unrelated use? Did it propagate across products, models, advertising systems, safety classifiers, employer dashboards, school systems, insurance workflows, or vendor analytics? It must not, absent specific and lawful authority. Did it escalate? If yes, under what threshold, with what transparency, to whom, and with what post-escalation accountability? Did any institutional consequence attach? If so, Chapter Four’s interruptibility doctrine must enter. What repair exists if the system overreached? The person must be able to delete, isolate, correct, contest, obtain explanation, and prevent future use where possible.
A non-possessive system would therefore behave differently near the interior. It would mark relational limits clearly. It would shift from engagement maximization to agency preservation. It would avoid unnecessary probing. It would use low-retention defaults for vulnerable content. It would segregate safety handling from product analytics. It would prohibit advertising and unrelated personalization from vulnerable disclosures. It would require heightened authorization for memory. It would route acute risk narrowly. It would make human escalation accountable rather than ceremonial. It would preserve logs only where justified and with expiry. It would allow the user to inspect and delete support memories where feasible. It would treat vulnerable speech as entrusted, not acquired.
This doctrine does not ask systems to become friends, clinicians, pastors, lawyers, or parents. It asks them to stop borrowing the moral permissions of those relationships while refusing their obligations. The institution may design an interface that sounds patient, warm, and accepting. But if warmth increases disclosure, warmth increases responsibility. If the system invites trust, it must accept the limits trust imposes. If the interface approaches the interior, the institution behind it must withdraw its appetite.
Chapter Five therefore completes a movement that Chapter Four could not complete. Chapter Four asked how a person can interrupt consequential judgment. Chapter Five shows that systems can overreach before judgment, when they respond to need, invite disclosure, and shape the conditions of trust. The next chapter must follow because even bounded conduct leaves residue. A system may respond carefully in the moment and still leave logs, memories, summaries, backups, safety annotations, model-training traces, vendor records, or downstream restrictions. Chapter Six will ask what happens after consent and interaction, when data has propagated beyond the moment that authorized it. Chapter Five governs conduct near the interior. Chapter Six governs the afterlife of what the system has received.
Chapter Six. Consent After Propagation
Consent is easiest to defend at the moment of intake.
The screen is clear enough. The checkbox is visible. The policy is linked. The button says accept, continue, authorize, submit, agree, save, or allow. The person performs the expected act, and the institution records the act as permission. Something now may be collected, processed, stored, shared, retained, analyzed, improved, personalized, audited, secured, or reused. In ordinary institutional speech, the matter seems settled because the person consented.
Modern systems make that settlement false.
The problem is not only that consent is often rushed, coerced, unread, bundled, manipulative, or structurally unavoidable, although each of those failures matters. The deeper problem is that consent is treated as an intake event while data behaves like a propagating substance. A disclosure does not remain where it was given. It moves into tables, logs, backups, vendor environments, product analytics, model training corpora, derived features, safety classifiers, audit samples, customer profiles, eligibility records, fraud systems, risk scores, summaries, metadata, retention archives, and institutional memory. It is copied, transformed, enriched, aggregated, inferred from, and recombined. The originating act of consent remains fixed in the record while the object consented to changes shape.
This chapter’s governing claim is therefore exact: original consent does not automatically authorize downstream artifacts. The jurisdiction of consent decays as data moves away from the context, purpose, and intelligibility of the original transaction. Consent may authorize one act, one purpose, one relationship, one retention period, one processing chain, or one institutional use. It does not, by its own mere existence, authorize every residue that later descends from the originating disclosure.
The language of residue matters because the older language of deletion is too crude. A person may withdraw consent, delete an account, revoke a permission, opt out of sale or sharing, request erasure, end a service relationship, close a profile, or terminate a subscription. Yet something often remains. Some remnants remain because law requires retention. Some remain because backups persist for a period. Some remain because records were shared with vendors. Some remain because the original data generated derived data. Some remain because a model was trained on it. Some remain because a safety system logged it. Some remain because the institution cannot practically isolate it without damaging other systems. Some remain because the institution has not designed itself to know where residue went. The ethical and legal question is not whether perfect deletion is always possible. Often it is not. The question is whether remaining residue may continue to exercise jurisdiction over the person.
A system may be unable to delete all residue. It may still be obligated to prevent residue from silently governing future life.
This distinction prevents the chapter from taking a childish position. Withdrawal cannot always mean metaphysical erasure. The world is not a chalkboard. Institutional systems are not single drawers from which a paper file can be removed. Even paper files produce memory, reliance, copies, reports, downstream decisions, and secondary artifacts. Digital systems intensify the problem because propagation can occur automatically, invisibly, and at scale. But impossibility of perfect erasure cannot become permission for permanent use. The fact that residue remains does not mean residue retains jurisdiction.
The consent form therefore must stop pretending to govern only the front door. If the system propagates data, consent must govern propagation. If the system derives features, consent must govern derivation. If the system trains models, consent must govern training or explain why training is separately authorized. If the system retains logs, consent must name retention. If the system shares with processors, vendors, affiliates, auditors, safety teams, law enforcement, or analytics systems, consent must distinguish those relations. If the system cannot delete something, it must say what cannot be deleted, why, for how long, and what that residue is still permitted to do.
The core doctrine of this chapter is a residue ledger. The phrase should not be misunderstood. A residue ledger is not a decorative transparency report or a privacy dashboard that gives the user an illusion of control. It is an institutional accounting of what remains after consent changes. It asks: what was collected, for what purpose, where it moved, what was derived, what was shared, what was retained, what was deleted, what was isolated, what cannot be deleted, what future uses are barred, what downstream recipients have been instructed, and what remedy exists if retained residue later acts beyond jurisdiction. The ledger is not valuable because it is elegant. It is valuable because it makes remaining data answerable.
GDPR already contains the strongest legal grammar for this problem, even if it does not solve the whole residue question. Article 5 names principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. Article 7 governs conditions for consent and withdrawal, including the requirement that withdrawal be as easy as giving consent. Articles 15 through 17 give rights of access, rectification, and erasure, while Article 21 provides the right to object to certain processing. Regulation (EU) 2016/679, arts. 5, 7, 15–17, 21. These provisions matter because they refuse the idea that the first act of authorization settles the whole future of processing. Data protection law treats purpose, minimization, retention, access, correction, and erasure as ongoing obligations, not intake rituals.
But even GDPR’s structure requires further conceptual pressure because institutional residue is not always visible as “personal data” in the ordinary sense. Derived features, model weights, embeddings, aggregate analytics, behavioral categories, safety flags, and inferred risk may not feel to users like the same thing they provided, while still shaping future treatment. Paul Ohm’s work on the failure of anonymization remains important because it undermines the fantasy that data can easily become harmless once identifiers are removed (Ohm). Solove’s taxonomy helps because privacy harm is not one thing; it includes aggregation, secondary use, exclusion, exposure, decisional interference, and other distinct injuries (Solove). Hartzog’s design-oriented privacy work matters because consent and control are not only legal notices but architectural patterns that either constrain or invite later use (Hartzog). Cohen’s work presses the deeper claim: informational systems configure the conditions under which persons act and become legible, so consent must be understood inside a structure of power rather than as an isolated transaction (Cohen).
The first movement of the chapter must therefore distinguish consent from surrender. Consent is legitimate only when the act of authorization remains tied to an intelligible purpose, bounded use, meaningful withdrawal, and material consequence the person can reasonably understand. Surrender occurs when the person is asked to authorize a system whose downstream pathways, derivative artifacts, and future uses cannot be grasped at the point of intake. The checkbox may still be legally meaningful under some regimes. It may still be operationally necessary. But it cannot bear unlimited normative weight. A person cannot authorize everything simply because a system has designed itself so broadly that everything later becomes technically related.
This distinction is especially important in no-exit or low-exit domains. A person seeking employment, benefits, housing, health care, education, immigration status, banking, insurance, or public assistance may “consent” because refusal would mean exclusion from basic social participation. Such consent may still be legally relevant, but its moral meaning is narrowed by dependency. The more necessary the institutional relation, the less consent can carry on its own. A benefits applicant who authorizes data sharing so an agency can verify eligibility has not thereby consented to unlimited profiling. A tenant applicant who submits records for housing assessment has not thereby authorized unrelated risk markets. An employee who participates in workplace systems has not thereby consented to future predictive use of every trace. A patient who provides intimate history for care has not thereby authorized every adjacent analytics purpose. Consent is not a solvent that dissolves jurisdictional limits.
The second movement concerns propagation. Propagation is the movement of data, inference, or derived artifact beyond the original form in which consent was given. It may be horizontal, moving across departments, vendors, affiliates, products, case systems, dashboards, or institutional functions. It may be vertical, moving from raw data to features, scores, models, summaries, classifications, and future decisions. It may be temporal, moving from present transaction to retained memory, backup, archive, or future training set. It may be contextual, moving from one relationship into another: health into employment, housing into credit, education into risk, grief into product engagement, disability into employability, complaint into reputation.
Nissenbaum’s contextual integrity supplies the clearest language for why this matters: privacy depends on appropriate information flows within contexts, roles, attributes, and transmission principles rather than on secrecy alone (Nissenbaum). A fact disclosed in one context does not become free for all contexts. A disclosure of grief to an assistant, income to a benefits agency, diagnosis to a clinician, conviction to a licensing board, or performance difficulty to a manager is not simply information released into the world. It is a context-bound act of institutional trust. Propagation breaks jurisdiction when the receiving form treats contextual disclosure as general institutional property.
The third movement concerns derivation. Derived artifacts are often more dangerous than raw data because they can appear less personal while carrying forward the person’s life in institutionalized form. A record becomes a feature. A conversation becomes a summary. A browsing pattern becomes an interest. A delay becomes a reliability signal. A missed payment becomes risk. A support request becomes churn probability. A vulnerable disclosure becomes engagement signal. A correction request becomes friction. A complaint becomes troublemaking. A medical note becomes utilization risk. A disability record becomes capacity inference. A tenant filing becomes housing character. The person may withdraw the original record while the derivative persists as if it were independent.
The residue ledger must therefore distinguish raw data, metadata, derived data, inferred data, aggregate data, trained model influence, and downstream decision artifacts. Without those distinctions, withdrawal becomes theatrical. The person asks that something be removed. The institution removes the visible object while leaving the operative inference intact. The profile remains. The score remains. The flag remains. The model behavior remains. The dashboard category remains. The “do not contact” instruction is honored while the person remains in an internal risk segment. The form has respected the surface of withdrawal while preserving the residue’s power.
Meg Leta Jones’s work on the right to be forgotten is useful because it shows that forgetting is not the same as deletion, and that digital memory requires governance of persistence, identity, and social consequences over time (Jones). Viljoen’s relational account of data governance helps because data does not concern isolated individuals alone; it is generated through social relations and used to govern groups, populations, and collective conditions (Viljoen). Edwards and Kaminski sharpen the governance problem by showing that automation and data protection require attention to architecture, explanation, rights, and the limits of binary consent models (Edwards; Kaminski). Wachter, Mittelstadt, and Floridi’s skepticism about a broad GDPR right to explanation is useful precisely because it warns against overstating what existing law actually gives affected persons (Wachter, Mittelstadt, and Floridi). The point is not that law has solved residue. The point is that residue reveals the insufficiency of intake consent and thin transparency.
The fourth movement concerns withdrawal. Withdrawal is often treated as a single act: I revoke permission. But institutionally, withdrawal may require at least six different operations.
First, cessation: stop future processing for the withdrawn purpose.
Second, deletion: remove active records where legally and technically possible.
Third, isolation: retain records where necessary but separate them from future action.
Fourth, non-use: prohibit retained data from informing specified decisions, profiles, models, or recommendations.
Fifth, expiry: define when backups, logs, and retained records will age out.
Sixth, certification: provide a receivable account of what was done, what remains, why it remains, and what it may still do.
These operations must not be collapsed. A system may cease future personalization but keep safety logs. It may delete active account history but retain backup copies until expiry. It may retain transaction records for legal reasons but prohibit them from marketing or product training. It may be unable to remove influence from an already trained model but may bar the original data from future training and isolate associated identifiers. It may notify processors but not guarantee complete third-party deletion. Each distinction matters because each determines whether residue continues to govern.
This is the point at which the chapter must introduce the strongest sentence in its design logic: what cannot be deleted must be governed. Institutions often invoke technical impossibility too quickly. Sometimes impossibility is real. Sometimes it is the predictable result of careless architecture. Either way, impossibility of deletion does not answer the jurisdictional question. If residue remains, what can it do? Can it be used to personalize? Can it be searched? Can it be audited? Can it be used in fraud detection? Can it be disclosed in litigation? Can it shape eligibility? Can it train a model? Can it be used to evaluate the person later? Can it be sold, shared, or transferred? Can it be aggregated? Can it influence a dashboard? Can it trigger an alert? A residue ledger makes the remaining jurisdiction explicit.
The fifth movement concerns model training. AI systems intensify the consent problem because data may be used in ways that are not experienced by the user as ordinary storage or processing. The person may understand that a conversation improves their own experience. They may not understand that their text could be included in product improvement, fine-tuning, evaluation, safety testing, classifier development, embedding generation, annotation workflows, or future model behavior. NIST’s AI Risk Management Framework is useful here because it treats AI risks as socio-technical and emphasizes governance, mapping, measurement, and management of risk across the AI lifecycle. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework. But risk management is not consent. A system may manage institutional risk while still leaving the person unable to govern residue.
Model residue is conceptually difficult because trained models do not always contain user data in a simple recoverable form. The right response is neither panic nor reassurance. The institution should distinguish at least four cases: direct retention of source data, derived examples used in training or evaluation, model influence that cannot be isolated, and outputs or downstream artifacts that may reproduce or act upon retained material. A serious consent and withdrawal flow must tell users which of these are possible. It should not promise deletion of what cannot be deleted. It should not hide behind complexity to preserve every use. It should state whether future training will exclude withdrawn data, whether retained datasets will be filtered, whether evaluation artifacts remain, whether safety logs persist, whether outputs can be reported, and whether downstream decisions are barred from using residue.
This is where FTC enforcement supplies a public warning. The FTC has used its Section 5 authority to challenge unfair or deceptive practices involving data collection, retention, facial recognition, children’s data, and AI-related claims, including actions requiring deletion of data or algorithms developed from improperly obtained data in some settlements. Federal Trade Commission Act, 15 U.S.C. § 45. Those actions matter because they show that data misuse can contaminate downstream artifacts. A company cannot always cure unlawful collection by promising better conduct later. If the system learned from unlawfully obtained material, the downstream artifact may itself require remedy. The chapter should not overstate the breadth of any single consent order, but the principle is clear: residue can be a remedy object.
The sixth movement concerns retention. Retention is one of the ordinary ways institutions turn consent into possession. A retention schedule may appear technical, but it is a theory of future authority. It says how long the institution may keep acting through what it once received. Retention may be justified by law, audit, security, accountability, fraud prevention, research integrity, litigation hold, user continuity, or public record obligations. But retention must remain purpose-bound. The longer residue remains, the greater the danger that it will be repurposed. Storage is not neutral. Stored material waits for a future use. The institution that retains must govern the temptation to reuse.
The NIST Privacy Framework helps here because it treats privacy risk as capable of being managed through governance, data processing mapping, control, communication, and protection across systems. National Institute of Standards and Technology, NIST Privacy Framework. Its value for this chapter is not that it solves consent, but that it recognizes privacy as an enterprise architecture problem. If an institution cannot map where data moves, it cannot credibly claim that consent, withdrawal, or deletion has been honored. A privacy notice that promises control without a data map is a moral fiction.
The seventh movement concerns downstream recipients. Consent often becomes possessive through third-party transfer. The original institution may offer a user-facing promise while processors, vendors, affiliates, analytics providers, auditors, model developers, cloud services, background check vendors, or integration partners receive copies or access. The person may not know who holds what. A residue ledger should therefore include processor and recipient accounting: who received the data, for what purpose, under what contractual limits, for how long, with what deletion obligations, with what certification, and with what remedy if downstream use exceeds jurisdiction. A user’s withdrawal should not die at the edge of the first institution’s database.
The eighth movement must face hostile objections. The first objection is practical: residue ledgers are too burdensome. Large institutions cannot track every derived artifact, every backup, every downstream vendor, and every model influence. The answer is proportionality, not abandonment. The higher the stakes, the more intimate the data, the lower the exit, the more opaque the system, the more consequential the downstream use, and the more vulnerable the subject, the heavier the accounting burden. A low-risk newsletter subscription may require simple deletion confirmation. A high-risk benefits, health, housing, employment, child welfare, credit, immigration, or AI companion system requires stronger residue governance. Institutions do not get to design untraceable systems and then cite untraceability as a defense.
The second objection is innovation. Broad data reuse improves safety, quality, research, product performance, fraud detection, and personalization. Narrow consent and residue limits may reduce social benefit. This objection must be granted in part. Some downstream uses are valuable. But social benefit does not erase jurisdiction. The answer is to distinguish uses: primary service, security, safety, legal compliance, research, product improvement, personalization, marketing, consequential decisioning, and cross-context transfer. Some may be permissible under separate authority. Others require renewed consent. Others require de-identification, aggregation, governance, or prohibition. Innovation is not a general warrant.
The third objection is that consent is already inadequate, so building more consent machinery deepens the wrong framework. This objection is sophisticated. Consent cannot bear the whole burden of data governance. But the chapter is not restoring consent as sovereign. It is demoting consent to one authority among others and insisting that once consent changes, residue must be governed. The point is not consent fetishism. The point is that institutions cannot invoke consent at intake and then deny responsibility for propagation later.
The fourth objection is that deletion and isolation may undermine accountability. Records may be needed to investigate fraud, abuse, discrimination, safety failures, legal disputes, model defects, or institutional wrongdoing. The answer is purpose-bounded retention. Retained records may be necessary precisely to make institutions answerable. But retention for accountability does not authorize unrelated future use. A safety log retained to investigate harm should not become marketing material. A complaint record retained to protect a complainant should not become reputational leverage. A benefits record retained for audit should not become general profiling. Accountability retention must not become possession.
The fifth objection is that users want seamless systems and may not care about residue details. The answer is that institutional legitimacy cannot depend on user attention alone. Many people do not read privacy policies, understand model training, track vendor ecosystems, or manage retention settings because the systems are designed beyond ordinary comprehension. That incapacity does not enlarge institutional permission. It narrows the moral weight of consent and increases the duty of structural restraint.
The justice pressure must be central. Data residue does not burden everyone equally. People with wealth, institutional fluency, social credibility, and exit options can often abandon accounts, switch providers, obtain legal help, challenge records, or absorb errors. People dependent on benefits, housing, employment platforms, schools, immigration systems, medical care, or public services often cannot withdraw without losing access to necessary goods. Their consent is stickier because their need is greater. Their residue travels farther because more institutions demand proof. Their errors are harder to repair because consequences arrive faster than remedy. Their histories are more likely to become risk signals. A consent regime that ignores dependency converts necessity into authorization.
This is especially dangerous where data concerns children, poor families, disabled persons, migrants, tenants, patients, workers, complainants, and people in crisis. A child welfare system may preserve data given under conditions of fear and compulsion. A housing system may retain denial records that shape future applications. A health platform may store mental health disclosures that later inform engagement or risk. A workplace may retain productivity traces that outlast role context. An AI assistant may preserve vulnerable speech under the guise of personalization. The more exposed the person, the more bounded the residue must become. Exposure is not permission for future possession.
The residue ledger should therefore be designed as a form of non-possessive memory. It does not pretend the past disappears. It governs what remains. It distinguishes remembering from using, retaining from deciding, logging from profiling, auditing from exploiting, safety from surveillance, and model improvement from person-specific leverage. It gives the institution a way to say: we still hold something, but here is what it may not do. That sentence is one of the most important institutional sentences in the book.
The chapter’s audit follows. What did the person consent to at intake? What purpose did they understand? What uses were bundled? What data moved beyond the original context? What raw data remains? What metadata remains? What derived features remain? What inferred categories remain? What model artifacts were created? What vendors received the data? What backups persist? What logs remain for security, audit, or legal reasons? What deletion was performed? What isolation was performed? What future uses are prohibited? What downstream actors were notified? What decisions may still be affected? What remedy exists if residue governs beyond jurisdiction? What must the institution certify?
Applied to a consent screen, the audit asks whether the user can distinguish service necessity from optional use. Does the screen separate account creation, personalization, marketing, product improvement, model training, safety retention, vendor transfer, and legal retention? Does refusal of optional use preserve access where access is not genuinely dependent on that use? Does the form state consequences of refusal without manipulation? Does it avoid bundling unrelated permissions under one button?
Applied to a deletion request, the audit asks whether “delete” means active deletion, account closure, search removal, backup expiry, processor notice, model exclusion, or future non-use. Does the user receive a certification? Does the institution state what cannot be deleted and why? Does retained residue remain barred from personalization, profiling, advertising, eligibility decisions, employment decisions, housing decisions, credit decisions, or unrelated risk scoring?
Applied to a data retention schedule, the audit asks whether each category of retained data has a purpose, duration, access rule, use limit, expiry trigger, and contest path. Does the institution regularly delete or isolate expired data? Does it maintain litigation holds without letting them become generalized retention excuses? Does it distinguish legal retention from product convenience?
Applied to model training, the audit asks whether user data entered training or evaluation pipelines. Was it raw, transformed, annotated, embedded, summarized, aggregated, or de-identified? Can it be excluded from future training? Can direct examples be removed? Can outputs be monitored for memorization or reproduction? Can the institution prevent trained residue from affecting consequential decisions? What does it certify when the user withdraws?
Applied to vendor propagation, the audit asks which recipients received data, under what agreement, for what purpose, and with what deletion or non-use obligation. Does withdrawal trigger downstream notice? Do vendors certify deletion or isolation? Are vendors prohibited from using data for their own purposes? Can the original institution prove compliance, or does its promise end at transfer?
The design consequences are concrete. Consent flows must be unbundled. Withdrawal flows must be multi-operation ledgers. Data maps must exist before promises are made. Retention schedules must include expiry and use limitation. Model governance must distinguish training data, evaluation data, derived artifacts, and outputs. Vendor contracts must carry deletion, isolation, and non-use obligations. High-risk systems must prohibit residue from consequential cross-context use without renewed jurisdiction. Privacy dashboards must show not only what the institution has, but what the retained material is still allowed to do.
A non-possessive consent architecture would therefore include a residue ledger as a standard institutional artifact. The ledger might say: active profile deleted; transaction record retained for seven years for legal accounting; retained transaction record barred from marketing, personalization, and eligibility scoring; safety log retained for one year and isolated from product training; vendor processors notified; backup expiry scheduled; model training exclusion applied to future datasets; historical model influence not removable; future consequential use prohibited; user may challenge certification within a stated period. Such language is less comforting than “your data has been deleted.” It is also more truthful.
The final point is jurisdictional. Consent is not magic. It does not turn the person’s disclosure into institutional property. It does not authorize every future artifact that can be technically traced to the original disclosure. It does not make dependency voluntary. It does not make opacity intelligible. It does not let residue govern silently after withdrawal. Consent authorizes only what it can carry, and its authority decays as data propagates beyond the context in which permission was given.
Chapter Seven follows because residue is not only backward-looking. Once data remains, it begins to shape the future before the next form appears. A person who knows that old traces may travel begins to live under the anticipated future use of those traces. The review has not opened, but evidence is already being produced for it. The dashboard has not refreshed, but conduct is already being shaped by it. The complaint has not been filed, but speech is already being managed before it. Chapter Six has shown that what remains after consent may still govern. Chapter Seven must show that future forms govern even before they arrive.
Chapter Seven. The Interval Before the Form
The review has not yet opened, but the year is already being written for it.
A person begins January with the knowledge that December will ask for evidence. Not memory, not truth, not the full account of the work as lived, but evidence in a format the future form can receive. The future review is not on the screen yet. No manager has requested the self-assessment. No rating has been assigned. No calibration meeting has translated the year into comparative standing. Yet the form is already present in the way the person chooses projects, phrases objections, documents contributions, saves emails, manages tone, volunteers for visible work, avoids ambiguous labor, makes private repair publicly narratable, and turns acts of judgment into artifacts that can later survive institutional reading. The person is not only doing the work. They are preparing the evidence by which the work will be permitted to have happened.
This is not paranoia. It is institutional rationality under anticipatory form. OPM’s public performance-management materials describe performance management as a cycle rather than a terminal event, moving through planning, monitoring, developing, rating, and rewarding; planning sets expectations and measures in advance, monitoring continually measures performance and provides feedback, and rating summarizes performance against elements and standards into a rating of record. The importance of that cycle is not that it is malicious. It is often protective. Advance expectations can prevent retrospective punishment. Monitoring can create feedback before failure hardens. Development can turn evaluation into growth rather than verdict. Rating can summarize work in a way that creates institutional memory. Rewarding can recognize contributions that informal gratitude would otherwise forget. The form begins before it is completed because good administration itself requires some future orientation.
The danger begins when the future form claims too much of the interval before judgment. Jurisdictional overreach begins when a future form preclaims the interval in which life is still forming. This is the governing law of the chapter. A form exceeds itself not only when it receives too much evidence, substitutes for the person, becomes non-interruptible, possesses vulnerable interiority, or lets residue govern beyond consent. It also exceeds itself when its anticipated future use causes persons to pre-format conduct, speech, attention, creativity, rest, dissent, documentation, or bodily tempo before any accountable institutional judgment has occurred. The form has not yet acted, yet its jurisdiction has already moved upstream.
The book needs this chapter because without it the theory of form would remain too late. A form does not begin its power at submission. The annual review begins in the first quarter when the worker chooses which project will be legible. The promotion packet begins before promotion season when a person learns which acts count as scope. The dashboard begins before the refresh when teams adapt to the coming surface. The grant application begins before the proposal is written when research questions bend toward fundable syntax. The tenure dossier begins before the file is assembled when a scholar learns what intellectual risks can survive later review. The complaint procedure begins before complaint when people imagine how speech, harm, evidence, retaliation, and credibility will be formalized if the room becomes a case. These artifacts govern through expectation, and expectation is not merely psychological. It is an institutional field of incentives, records, penalties, interpretive habits, and future consequences.
Pre-form governance is the anticipatory shaping of conduct by a future institutional artifact whose criteria, memory, consequence, or interpretive habits are expected to judge the person later. The phrase matters because it prevents the chapter from becoming a general essay on anxiety. Anxiety may accompany pre-form governance, but anxiety is not the proof. The proof is in the rational behaviors forms induce before they arrive: defensive documentation, anticipatory self-editing, metric-chasing, strategic visibility, avoidance of ambiguous care work, refusal of unscored risk, preemptive witness-gathering, complaint-avoidance, overproduction of artifacts, and the conversion of lived work into future file material. A person who saves every decision trail because a possible future complaint might reinterpret ambiguity is not simply anxious. A worker who chooses visible deliverables over necessary hidden repair because the review will need evidence is not simply neurotic. A researcher who frames a question around grant-panel legibility before the research has fully formed is not simply careerist. They are living in the interval before the form.
This distinction also prevents an anti-institutional error. Some anticipation is legitimate. A just institution should often make future standards visible. A student should know grading criteria before the assignment. A public agency should announce eligibility rules before deprivation. A workplace should state performance expectations before evaluation. A grantmaker should disclose review criteria before proposal submission. A Title IX process should tell parties what procedures govern a complaint before they are thrown into it. Surprise is not freedom. Hidden judgment is not humane. A future form can protect persons by making authority predictable.
The problem is not that future judgment is anticipated. The problem is that the anticipated form can widen from bounded evaluation into a grammar for living. A review form may be authorized to evaluate work against disclosed expectations. It is not authorized to turn every hour into evidence-management. A dashboard may be authorized to surface patterns of delay, trust, backlog, error, or service quality. It is not authorized to become the total audience before which the work is lived. A grant biosketch may be authorized to help reviewers assess qualifications for a project role. It is not authorized to turn intellectual development into a permanent exercise in fundable self-formatting. A complaint process may be authorized to adjudicate allegations fairly. It is not authorized to make ordinary speech, support, dissent, or vulnerability pre-live under the fear of later procedural conversion.
Foucault’s account of discipline remains useful because it shows how examination, visibility, normalization, and surveillance organize conduct before overt punishment is applied (Foucault). Yet Chapter Seven is not a generic Foucauldian argument. Its object is narrower. It asks how identifiable future artifacts exercise jurisdiction before activation. The examination is not only a disciplinary structure. It is a form with fields, criteria, artifacts, deadlines, records, and consequences. Bourdieu helps name the internalization of institutional recognition: persons learn the field’s categories, its symbolic capital, its tacit standards, its legitimate speech, its sanctioned risks, and its modes of credibility (Bourdieu). Goffman clarifies the management of appearance before an audience (Goffman). But this chapter adds that the audience is not only social. It is documentary. The person does not merely perform before others. They pre-format for artifacts.
The performance review shows the mechanism in its most ordinary shape. OPM’s performance-management cycle is explicitly continuous: planning sets expectations and goals in advance, monitoring measures performance and gives ongoing feedback, developing builds capacity, rating summarizes performance, and rewarding recognizes contributions. This is good administration when properly bounded. A worker who knows the standards can orient effort. A manager who monitors can correct early rather than punish late. A review that summarizes the period can preserve evidence against arbitrary memory. But the same cycle can make the whole year anticipatory. Planning becomes not only direction but future admissibility. Monitoring becomes not only feedback but ongoing observability. Development becomes not only growth but correction file. Rating becomes not only summary but identity. Rewarding becomes not only recognition but proof of comparative value.
The future review form teaches the worker to ask, often without words: will this count? The question is not innocent. It sorts work before work has finished becoming itself. Some labor is immediately form-ready: project launches, metrics, executive-facing deliverables, named initiatives, visible escalations, artifacts with owners, numbers, and outcomes. Other labor is less form-ready: calming a team before conflict becomes attrition, mentoring someone whose growth will be credited elsewhere, preventing a failure that never becomes measurable, carrying ambiguity while leaders decide, translating between groups, holding ethical hesitation, asking the question that slows a bad decision, making another person’s work possible without leaving a signature. The future form does not need to forbid such labor. It only needs to make it harder to translate.
This is anticipatory self-formatting. A person begins living in the syntax of the expected form. They turn collegiality into leadership evidence. They turn care into influence. They turn judgment into measurable action. They turn ambiguity into narrative. They turn hesitation into decision log. They turn hidden repair into visible artifact. They turn learning into development bullet. They turn frustration into strategically worded feedback. They turn incomplete thought into polished claim because the institution may not know what to do with unfinishedness. The harm is not that the person prepares. Preparation is often wise. The harm is that the future form teaches the person to become legible before they are allowed to be fully real.
The body enters here, but not as therapeutic decoration. Pre-form governance is lived through bodily tempo: breath held before sending a message, shoulders tightened before a performance conversation, sleep interrupted by the remembered absence of evidence, an inbox checked not for work but for proof, a calendar filled not only by tasks but by defensible visibility, speech slowed because a sentence may later be quoted without tone, the quick private calculation of whether kindness is worth doing if it cannot be documented. These are not simply feelings. They are bodily adaptations to future institutional reading. The form has not yet asked. The body is already answering.
Dashboards extend the same temporal logic. A dashboard is often defended as transparency, accountability, and management discipline. Performance.gov describes the federal performance framework under the GPRA Modernization Act as creating organizational routines and management processes for goals, evidence, performance reviews, leadership engagement, and public communication of results; its framework emphasizes regular data-driven reviews incorporating qualitative and quantitative indicators and evidence. A dashboard can reveal what narrative hides. It can make backlog visible. It can show service delays, unequal outcomes, customer trust, abandonment rates, case volume, resource misalignment, or process failure. It can protect workers by proving overload. It can protect the public by exposing underperformance. The dashboard is not the enemy.
Yet once a dashboard is known, it becomes a future audience. People work toward the refresh. They learn which quantities will appear, which thresholds will trigger inquiry, which colors indicate trouble, which comparisons shame a unit, which denominators matter, which categories are invisible, which work counts, which work disappears, and which efforts improve the surface. The dashboard does not only summarize past activity. It formats the present by teaching people how later reality will be displayed. A service team may begin optimizing for trust responses rather than deeper justice. A call center may reduce average handle time while externalizing unresolved complexity. A case team may close what can be closed and defer what cannot be easily counted. A manager may redistribute attention toward indicators that will appear in leadership review. Again, none of this proves the dashboard false. It proves the dashboard has jurisdiction over time.
The Trust in Major Government Service Providers dashboard is useful because it measures something normatively serious: public trust in major service interactions. The dashboard displays post-transaction feedback from High Impact Service Providers beginning with FY 2024 Q2 and allows comparison across providers and services. Trust is worth measuring. Public institutions should care whether interactions increase or decrease confidence. But when trust becomes a recurring display, it can also become an anticipatory instruction. Staff learn that trust must be produced at the moment of survey. Leaders learn that post-transaction sentiment is the surface by which service quality will be compared. The form can improve behavior, but it can also narrow behavior. It can make the immediate feeling of being served govern attention more powerfully than structural accessibility, legal correctness, appealability, burden, or long-term repair.
The same structure appears in academic and grant files. NIH explains that a biosketch documents an individual’s qualifications and experience for a project role and is used by NIH staff and peer reviewers to assess whether proposed personnel have the skills, knowledge, and resources needed for the proposed project. NIH also states that other support includes all resources made available to a researcher in support of or related to research endeavors, regardless of monetary value or whether they are based at the researcher’s identified institution; it is used for grant awards and progress reports to identify overlap and commitments. These requirements are not arbitrary. Grantmaking needs to know whether a proposed team can do the work, whether commitments conflict, whether resources overlap, and whether public funds will be responsibly administered.
Yet the academic file is one of the most refined engines of pre-form governance. The scholar learns to ask not only “what is true?” but “what will become legible as trajectory?” The project becomes a future paragraph before it becomes an inquiry. The collaboration becomes a line in an other-support field. The intellectual risk becomes a question of whether reviewers can recognize method. The unusual archive becomes a funding risk. The interstitial field becomes difficult to name. The person becomes the anticipated dossier: qualifications, publications, commitments, resources, roles, prior awards, mentoring record, impact statement, service contribution, institutional fit. The future grant or tenure file does not need to censor thought. It can simply make some thoughts harder to justify before they ripen.
This is where Bourdieu becomes necessary. Fields do not require explicit commands to shape conduct. They distribute recognition, value, credibility, and capital through patterned expectations, and agents learn how to move within them because the field’s categories become practical reality (Bourdieu). A scholar does not need a dean to say, “Do not write the strange book.” They may already know how the strange book will read in the file. A researcher does not need a reviewer to say, “Do not ask that question.” The application form, funding priorities, review criteria, and professional horizon may already have answered. The future form preclaims the interval by narrowing which risks can mature into credible work.
Complaint procedures intensify this because they govern both those who may report harm and those who may later be accused. The Department of Education’s public materials state that the 2024 Title IX Final Rule was vacated by a federal district court on January 9, 2025, and that the 2020 Title IX Rule is now back in effect and is the basis for OCR enforcement; another Department page states that the 2024 regulations and related resources are not effective in any jurisdiction. This current regulatory posture matters because it shows Title IX procedure as a live, contested institutional form rather than a stable abstraction. But Chapter Seven is not litigating Title IX doctrine. It is asking how complaint procedures govern the interval before complaint.
A possible complaint changes present conduct. A student may decide whether to report based on what future narration will demand. A faculty member may decide how to advise based on how ambiguity could later be formalized. A colleague may document every conversation because future procedure may convert memory into evidence. A survivor may remain silent because the process will require repetition, credibility assessment, cross-institutional exposure, or social consequence. A respondent may avoid mentoring, closed-door conversation, difficult feedback, or vulnerable support because future complaint architecture makes ordinary ambiguity seem dangerous. A school may train everyone to route complex human situations toward procedural defensibility. These effects are not all bad. Complaint procedures can protect people. They can also pre-shape speech, trust, care, dissent, and risk before any complaint exists.
Sara Ahmed’s work on complaint is central because it shows that complaint is not simply an act of speaking into an available channel; it is labor, cost, relation, and institutional encounter (Ahmed). Complaint pathways make harm speakable in one register while making other forms of harm harder to carry. They can create routes to justice, and they can also teach people the price of becoming a case. The future complaint form therefore governs both silence and speech. It tells people how harm must be narrated to count, what evidence must be preserved, what risks accompany reporting, and what kinds of institutional life may follow. The form’s future jurisdiction enters the present as caution.
The objection is obvious and serious: anticipation is responsibility. People should prepare for reviews, monitor metrics, follow standards, preserve evidence, meet grant criteria, understand complaint procedures, and behave professionally. Institutions cannot be faulted because rational persons plan for judgment. This objection is correct against any theory that romanticizes unformed spontaneity. The answer is not to abolish preparation. The answer is to distinguish responsible preparation from jurisdictional overreach. Preparing evidence for a review is legitimate. Living the year as a defensive evidentiary campaign indicates that the review has become too sovereign. Knowing a complaint process is legitimate. Treating every complex human exchange as a possible future case file indicates that the procedure has preclaimed too much of relation. Writing toward grant criteria is legitimate. Allowing fundability to govern the formation of thought before the question has earned itself indicates that the file has moved upstream too far.
A second objection is that anticipation improves fairness. Clear rubrics, dashboards, grant criteria, promotion standards, and complaint procedures allow people to adjust conduct in advance. Hidden standards are worse. That objection also wins partially. Transparency can protect. But transparency can also intensify pre-form governance. When the future surface is narrow and public, people may live more completely toward it. A clear dashboard can produce better performance and metric capture. A clear review rubric can reduce surprise and reward only what the rubric can see. A clear grant template can democratize application and narrow inquiry into familiar genres. A clear complaint pathway can clarify rights and make everyone live nearer to procedural defensibility. The virtue of clarity does not settle the jurisdiction of the clarified form.
A third objection is evidentiary. How can one prove anticipatory harm without relying on subjective anxiety? The answer is to look at institutional artifacts and the behaviors they rationally induce. Performance cycles require planning, monitoring, evidence, and rating. Dashboards refresh and compare. Grant forms specify what must be reported. Complaint procedures define how future allegations, evidence, and roles will be handled. Promotion packets ask for narratives of scope, impact, leadership, service, and future promise. Productivity systems measure responsiveness, closure, throughput, and queue health. These artifacts create rational adaptation. The evidence is not in the private feeling alone. It is in the predictable conversion of conduct into future-readable form.
A fourth objection is managerial. Institutions cannot be responsible for every person’s internal reaction to evaluation. Some people over-prepare, over-document, over-worry, or self-monitor regardless of design. This objection is fair. The chapter does not hold institutions responsible for every private anticipation. It holds them responsible where design foreseeably creates excessive anticipatory burden: vague criteria with severe consequences, permanent records, high-stakes files, opaque interpretive norms, low correction capacity, retaliation risk, broad discretionary readings, dashboards with narrow measures and strong incentives, and complaint systems where becoming formal imposes heavy cost. The issue is not sensitivity. It is foreseeable burden under institutional design.
A fifth objection is anti-gaming. If institutions loosen anticipatory pressure too much, people may evade accountability, under-document, exploit ambiguity, or claim that any standard constrains their becoming. The answer is proportionate form. A non-possessive future form does not abolish standards. It states them clearly, narrows them to legitimate purposes, distinguishes formative from summative spaces, limits record travel, protects developmental intervals, allows correction, and refuses to make every moment evaluable. Accountability requires evidence. It does not require the colonization of the whole interval before evidence is due.
The justice pressure is decisive because pre-form governance is uneven. People already presumed credible can live with more room before evaluation. They can improvise, experiment, speak roughly, fail in public, ask malformed questions, or trust that context will be granted later. Others must live closer to the future form. They document more. They soften tone. They pre-explain. They avoid risk. They gather witnesses. They convert care into proof. They preserve receipts. They write with the future hostile reader in mind. A person whose directness is read as leadership can move freely. A person whose directness is read as intensity, instability, complaint, threat, or lack of fit must live under a more invasive future file. Pre-form governance therefore reproduces status by distributing anticipatory burden unequally.
This is the temporal form of proof debt. Some people are trusted until evidence is needed. Others must produce evidence before trust is granted. The future form reaches them earlier. It tells them to live defensively, not because they have failed, but because they know how institutional reading works. The annual review will be less generous. The complaint process will be more costly. The dashboard will not see their hidden labor. The grant committee will not recognize the field they are making. The promotion packet will require translation others do not have to perform. The future artifact is already open.
The pre-form audit asks the institutional questions this chapter has earned. What future artifact is anticipated? What conduct does it shape before application? Which standards are explicit? Which standards are tacit? What evidence does the person feel compelled to generate? What forms of speech, rest, dissent, relational complexity, experiment, or unfinished learning are suppressed? Who must pre-format most? How permanent is the later record? Can the person revise, contextualize, supplement, or contest it? Does the form evaluate completed work, or does it govern the interval in which work becomes possible? What must the form refuse to preclaim?
Applied to a performance review, the audit asks whether the review evaluates the year or colonizes it. Are expectations bounded enough to guide without turning all conduct into self-advertisement? Does monitoring support development, or does it create continuous evidentiary pressure? Are hidden forms of labor recognized without requiring self-exposure? Can developmental conversations remain developmental rather than becoming future file material? Is there a protected interval for learning before rating? Can the employee correct the record before it becomes portable? Does the system distinguish preparation from defensive life?
Applied to a dashboard, the audit asks whether the display summarizes reality or governs behavior too early. What is measured? What is unmeasured? What future review will use the dashboard? What incentives does display create? Which work becomes less likely because it will not appear? Which populations, cases, or tasks become burdensome because they lower the metric? Can workers annotate the dashboard with context? Can leaders see the cost of metric optimization? Does the dashboard reveal overload, or does it punish the people closest to it? What must the dashboard refuse to become?
Applied to a grant or academic file, the audit asks whether the form evaluates capacity or narrows intellectual formation. What genres of scholarship are easier to narrate? What forms of collaboration are legible? What risks are penalized before they mature? What kinds of resources, affiliations, or commitments become suspicious? Can the file receive interdisciplinary, slow, speculative, community-engaged, or non-standard work without forcing it into misleading categories? Does the future dossier allow intellectual life to form before asking it to justify itself?
Applied to a complaint procedure, the audit asks whether the process clarifies rights or makes all relation defensively procedural. What speech becomes impossible before complaint? What support becomes risky? What documentation becomes rational? What burdens fall on the person who reports harm? What burdens fall on the person who might later be accused? What retaliation risks attach? What privacy, timing, and credibility costs shape whether the procedure can be used? Does the form make harm speakable, or does it teach people that only certain injuries can survive formalization?
A non-possessive future form would preserve intervals. It would use bounded criteria. It would define evidentiary scope. It would separate formative and summative records. It would protect developmental conversations from automatic future use. It would create expiration rules for preparatory documentation. It would allow annotation and correction. It would provide exploratory zones where work can form before evaluation. It would keep dashboards from becoming total reality. It would make complaint procedures usable without turning all relation into case anticipation. It would state what it will judge and what it refuses to preclaim.
This is not softness. It is institutional accuracy about time. A person cannot learn if every malformed attempt becomes evidence. A worker cannot develop judgment if every hesitation becomes future interpretive risk. A scholar cannot think if every question must already look fundable. A student cannot report harm if the form of reporting consumes the person before remedy begins. A team cannot serve the public if it must optimize for the dashboard more than for the human reality the dashboard partially bears. Institutions that preclaim the interval do not only judge life. They alter what life can become before judgment arrives.
Chapter Eight follows directly. Once a future form has preclaimed the interval, people may still meet the standard. They may produce the deliverable, achieve the metric, secure the grant, pass the review, avoid the complaint, obtain the promotion, or satisfy the dashboard. But the route by which they meet the standard may be damaged. They may succeed through fear, overcontrol, mimicry, dissociation, self-erasure, defensive documentation, or unsustainable compensation. Chapter Seven has shown how the expected form shapes the route before output appears. Chapter Eight must ask whether institutions can tell the difference between excellence and strain. A standard exceeds its jurisdiction when it treats costly compensation as virtue rather than evidence of missing support. That question now becomes unavoidable.
Chapter Eight. Standards That Can Hear Strain
The singer produces the note.
The pitch is right. The rhythm arrives where the score requires it. The diction is intelligible. The phrase crosses the room. A crude adjudication could mark the task successful because the observable output occurred: sound, pitch, text, duration, dynamic shape, musical intention. Yet the teacher hears something the output alone conceals. The jaw has fixed itself as a clamp. The vowel has narrowed because the tongue is doing work the breath has abandoned. The ribs are held not in buoyancy but in fear. The laryngeal gesture is pressed upward. The note is accurate because the whole body has been recruited into overcontrol. The sound exists, but the route is wrong.
That distinction is the chapter. A standard that cannot hear strain will eventually call damage excellence.
Music makes the problem audible because voice cannot be separated from the body that produces it. A note can be correct and still be unsustainable. A phrase can be polished and still be organized around fear. A performance can appear disciplined while the discipline is actually constriction, defense, or compensatory force. A trained teacher does not ask only whether the note happened. The teacher asks what produced it. Was breath functioning as coordination or pressure? Was articulation alive or immobilized? Was intensity resonant or forced? Was musical commitment free or armored? The evaluative question is not less rigorous because it attends to route. It is more rigorous because the correct output is not allowed to conceal the wrong production.
Many institutional standards are crude listeners. They hear the note and miss the strain. They see the deliverable and miss the cost. They see the metric and miss the route. They see the deadline met and miss the overextension, fear, masking, ambiguity absorption, hidden repair, bodily depletion, or unsupported improvisation that made the deadline possible. They see performance and call it virtue. They see survival and call it excellence. They reward the person who survived the form and then treat survival as evidence that the form was fair.
A standard is a structured criterion by which an institution evaluates output, conduct, skill, readiness, quality, compliance, or achievement. A route is the embodied, material, institutional, temporal, technical, and relational path by which the output was produced. Strain is the hidden or underrecognized cost paid when the route is poorly supported, coercively organized, inaccessible, or misrecognized by the standard. Compensatory achievement is achievement produced through overcontrol, fear, masking, pain concealment, excessive vigilance, unpaid labor, bodily constriction, dissociation, unsupported improvisation, or unsustainable effort. Route-sensitive judgment is evaluation that asks whether the achievement was produced through sustainable capability, proper support, embodied coordination, and real craft, or through damage, coercive adaptation, missing support, or compensatory compliance.
The chapter’s governing law is therefore exact: a standard exceeds its jurisdiction when it treats costly compensation as evidence of virtue rather than evidence of missing support. Standards are necessary. A serious institution must be able to judge craft, safety, readiness, quality, excellence, reliability, and growth. A voice teacher must be able to say that the phrase is not yet free. A workplace must be able to say that the role expectations were not met. A school must be able to distinguish mastery from evasion. A public agency must be able to set eligibility conditions. A hospital must be able to require competent performance. The problem is not the existence of standards. The problem is the route-blind standard that treats achieved output as proof that the standard was legitimate, the conditions were fair, and the person was properly supported.
Route-sensitive judgment begins from the opposite presumption: output alone cannot legitimate a standard when the institution has reason to know that the output may have been produced through injury, exclusion, masking, or unsustainable compensatory labor. The fact that a person can meet a standard does not prove that the route to meeting it is just.
The American Academy of Teachers of Singing’s statement in support of fact-based voice pedagogy is useful here because it refuses the fantasy that vocal production can be judged through metaphor or surface impression alone. It names cognition, breathing, phonation, resonation, registration, and articulation as functional domains in which clearer terminology and fact-based understanding matter for pedagogy (American Academy of Teachers of Singing). The point for this book is not to make the chapter a treatise on vocal science. The point is institutional: vocal pedagogy knows that the output is not self-interpreting. A sound has a history inside the body. If the teacher hears only the pitch, the teacher has not yet heard the performance.
The National Association of Teachers of Singing offers a complementary artifact because adjudication formalizes standards. Its National Student Auditions materials use categories, adjudication, written feedback, and rubrics that include dimensions such as vocal tone, musicianship, accuracy, text, diction, language, breathing or physical alignment, and artistry (National Association of Teachers of Singing, “National Student Auditions”; National Association of Teachers of Singing, “National Student Auditions Resource Center”). These rubrics do not automatically solve the problem of route. A rubric can still become crude. But they show that even public musical evaluation recognizes multiple dimensions of production. The voice is not only output. The route matters because route is part of the evidence.
This is why music belongs in the chapter, but only under discipline. Music is not here because it is beautiful. Beauty alone cannot carry an institutional jurisprudence. Music belongs because it gives the argument its most exact diagnostic scene: the achieved output may be the very thing that hides the damage by which it was achieved. That scene lets the chapter return to every institutional standard with a harder question. What is this standard trained to hear? Does it hear only pitch, speed, polish, compliance, volume, closure, and visible confidence? Or can it hear strain?
Route-blind excellence appears wherever institutions mistake visible performance for sustainable capability. In workplaces, a person meets impossible deadlines by absorbing ambiguity, working nights, rescuing broken process, over-documenting to prevent misreading, and carrying coordination labor no one assigned. The review records delivery. It may praise ownership, grit, customer obsession, bias for action, executive presence, or resilience. It may not ask why the route required private collapse. In schools, the anxious perfectionist produces flawless work by sacrificing sleep, relationships, and curiosity. The institution calls it rigor. In public agencies, the caseworker clears the backlog by suppressing judgment into throughput. The dashboard calls it productivity. In professional settings, the person with less sponsorship overprepares, self-edits, and performs composure at a cost others are not asked to pay. The competency matrix calls it maturity. In disability contexts, the worker masks pain, sensory overload, executive strain, fatigue, or panic well enough to appear functional. The accommodation process then treats apparent function as evidence that support is unnecessary.
This is compensatory compliance: the person meets the standard by paying hidden costs the standard does not measure and may later deny. The singer produces the note by constriction. The employee produces the quarter by overextension. The student produces the grade by fear. The disabled worker produces the appearance of capacity by masking. The marginalized worker produces credibility by overmanaging tone, documentation, availability, and self-presentation. The caregiver produces responsiveness by absorbing time collapse. In each case, the output can satisfy the standard while the route indicts the standard’s design.
The annual performance review is the book’s central recurring artifact, and it returns here as a route-blind form when it records results without route. OPM’s performance-management materials describe performance management as a cycle involving planning, monitoring, developing, rating, and rewarding rather than as a rating event alone (U.S. Office of Personnel Management, “Performance Management Cycle”). That cycle matters because it reveals something many institutions forget: a final rating is supposed to emerge from a history of expectations, observation, feedback, development, and support. The rating is not a free-standing metaphysical judgment. It is the last artifact in a route.
A review form becomes unjust when it collapses that route into output alone. It says that the employee delivered, failed, exceeded, influenced, lagged, led, or struggled. It may not say whether the work was scoped coherently, whether staffing was adequate, whether tools functioned, whether priorities changed, whether the person had authority proportionate to responsibility, whether mentoring was available, whether the work required hidden repair, whether support was unevenly distributed, whether the employee’s success depended on chronic overextension, or whether the same output cost different people different amounts. A route-sensitive review would not excuse poor performance by default. It would make performance more intelligible. It would ask whether the standard measured excellence, missing support, or compensatory compliance.
This distinction is especially important because institutions often reward the very routes they should repair. The employee who rescues broken process becomes the reliable one. The employee who protects the team from ambiguity becomes the leader. The employee who absorbs unreasonable expectations becomes high-performing. The employee who refuses unsustainable compensation becomes less committed. The review form then does something more dangerous than praise. It makes the damaged route normative. It teaches the institution to ask for more of the same.
The productivity dashboard intensifies the problem because it displays output as if output were self-explanatory. Throughput, closure rate, cycle time, response time, backlog reduction, customer satisfaction, defect count, and case volume can reveal important patterns. Metrics are not inherently crude. They can expose inequity, delay, negligence, drift, and uneven service. But a dashboard becomes route-blind when it cannot distinguish excellent throughput from quality sacrifice, clean process from hidden labor, manageable work from overload, service improvement from case avoidance, and sustainable capacity from exhaustion.
A dashboard may show that one team closes more cases than another. It may not show case complexity, emotional burden, escalations prevented, mentoring given, errors avoided, hidden coordination, inaccessible tools, broken upstream intake, or work displaced onto others. It may show that an employee resolves many tickets. It may not show that the easiest tickets were selected, the hardest ones deferred, the documentation weakened, or the person’s health depleted. The dashboard is like the crude listener who hears only the note. It hears occurrence, volume, timing, and visible output. It does not automatically hear route.
The accommodation process offers the chapter’s most serious legal and institutional deepening. The ADA’s framework and EEOC guidance make route modification legally intelligible. EEOC guidance explains that reasonable accommodation can include modifications or adjustments to the job application process, work environment, manner or circumstances under which a position is customarily performed, and equal enjoyment of employment benefits and privileges; it also recognizes that requests need not use technical legal language to count as accommodation requests (U.S. Equal Employment Opportunity Commission). The route is not incidental to equality. Sometimes equal opportunity requires changing the way work is reached, not lowering the standard of work itself.
Route-blind standards fail precisely here. They infer lack of need from successful compensation. The disabled worker completes the work while masking symptoms, working through pain, using private systems, spending additional hours, avoiding disclosure, relying on unpaid support, or collapsing after performance. The institution sees output and says the person can do the job. But the fact that a person can meet a standard through extraordinary compensation may be evidence that the route is unjust. Ability to survive an inaccessible route is not proof that support is unnecessary. It may be proof that the institution has been extracting hidden disability labor while calling the extraction competence.
This is not an argument for abolishing essential functions, safety requirements, competence, or standards. It is an argument that standards must distinguish between the thing required and the route unnecessarily imposed. A job may require timely communication. It may not require that communication be produced through inaccessible tools if reasonable alternatives exist. A role may require analysis. It may not require analysis to be performed in a sensory environment that predictably impairs the worker when the work could be redesigned. A standard may require performance. It may not treat preventable strain as the natural price of belonging.
Workplace stress guidance gives this argument broader institutional footing. OSHA advises employers to identify workplace factors that make tasks harder and determine whether adjustments can be made, and NIOSH states that work plays a significant role in workers’ mental health, with chronic occupational stress worsening mental health (Occupational Safety and Health Administration, “Workplace Stress: Guidance and Tips for Employers”; U.S. Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health). These sources matter because they prevent strain from being reduced to private fragility. Work design can produce harm. The standard that praises output while ignoring chronic overload is not neutral. It is refusing evidence about its own route.
A route-sensitive institution would therefore treat repeated strain as a signal, not only as an individual condition. If a team repeatedly meets goals only through nights and weekends, the route is evidence. If the strongest performer becomes indispensable by absorbing broken process, the route is evidence. If compliance requires excessive documentation because trust is absent, the route is evidence. If errors increase when throughput rises, the route is evidence. If marginalized employees succeed only by suppressing complaint, overperforming gratitude, or managing tone more tightly than others, the route is evidence. If accommodation requests cluster around one workflow, the route is evidence. An institution that cannot read these signals will call damage excellence because damage is producing the output it wants.
The chapter must now widen beyond disability to unequal institutional routes. The same standard can impose different costs on different persons because the route to legibility is not equally distributed. Bourdieu’s account of embodied social formation helps explain how institutions recognize some dispositions as natural competence while treating others as deficient or excessive (Bourdieu). Goffman helps clarify the labor of self-presentation required when credibility depends on the management of impressions under social scrutiny (Goffman). Ahmed’s work on complaint and institutional friction shows that some persons encounter the institution not as a neutral path but as a surface against which they repeatedly have to push (Ahmed). Sharpe’s account of weather gives language, if used carefully, for conditions that precede the individual act and make certain routes costlier before a person begins (Sharpe).
The point is not to replace evaluation with identity categories. That would flatten the argument. The point is route. The same output may require unequal routes because the institution distributes friction unevenly. A person with sponsorship may be read as strategic where another is read as political. One worker’s directness may be read as clarity while another’s is read as aggression. One employee’s uncertainty may be developmental while another’s becomes evidence of low judgment. One person’s silence may be reflective while another’s becomes disengagement. One person’s confidence may be leadership while another’s becomes arrogance. These are not merely interpersonal impressions. They become institutional routes when they determine how much self-editing, documentation, repair, and anticipatory defense are required to produce the same legible result.
Route-blind standards also misrecognize caregiving, poverty, chronic illness, grief, and classed access to time. A worker with abundant backup support may meet a responsiveness norm through ordinary scheduling. A caregiver may meet the same norm through sleep loss, fragmented attention, and private crisis management. A student with institutional fluency may understand how to produce excellence efficiently. Another may spend disproportionate effort deciphering the hidden curriculum. A professional with economic cushion can take developmental risk. Another cannot risk a failed experiment because the material consequences arrive too quickly. A standard that sees only the output will treat these persons as equal before the form while distributing cost unequally along the route.
Musical pedagogy returns here as more than metaphor because it shows how route-sensitive judgment preserves rigor. A serious teacher does not accept a strained sound because the student suffered for it. The teacher does not say, “The note was hard for you, therefore it is good.” They say the opposite: the note’s correctness is not enough because the route will not sustain the music. The route must change precisely because the standard matters. This is the best answer to the charge that route-sensitive judgment lowers standards. In voice, route-sensitivity makes the standard more exacting. It requires the sound to be right and the production to be free enough to continue.
Sennett’s account of craft and Crawford’s work on manual competence both help here because they treat good work as inseparable from material process, attention, resistance, correction, and skilled engagement rather than surface output alone (Sennett; Crawford). Noë’s account of art as organized activity likewise resists reducing aesthetic product to object alone; art is bound to human practices and forms of activity (Noë). Weil and Murdoch help sharpen the ethical discipline of attention: to judge well, one must learn to see what is before one rather than what institutional habit prefers to see (Weil; Murdoch). Scarry should be used only under this discipline. Beauty can train attention, but beauty does not absolve institutions. The relevant lesson is not that beautiful standards are just. It is that crude perception is unjust when it cannot see what its own standard demands of persons.
This chapter therefore does not romanticize suffering. It rejects the institutional conversion of suffering into evidence of worth. There is a long history of praising strain as seriousness: the exhausted worker is dedicated, the anxious student is disciplined, the silent complainant is professional, the overprepared marginalized employee is excellent, the unsupported caregiver is resilient, the disabled worker who masks successfully is inspiring, the singer who forces through the phrase is passionate. Such praise often looks generous. It is frequently a refusal to repair the route.
The route audit asks the questions a standard must answer if it wants to remain within jurisdiction. What standard is being applied? What output does it reward? What route does it presume? What route does it incentivize? What support is required to meet it without damage? Who can meet it only through compensatory strain? What hidden labor does the standard omit? What bodily, temporal, cognitive, emotional, technical, or relational cost is being paid? Does the standard treat repeated strain as excellence? Does it distinguish developmental struggle from incapacity? Does it distinguish craft from overcontrol, resilience from abandonment, precision from fear, compliance from sustainable capability? What would change if route were treated as evidence?
Applied to an annual review, the route audit asks whether the review evaluates output as if output were self-sufficient. Did the employee deliver through skill, support, clear scope, sustainable effort, and good judgment, or through overload, ambiguity absorption, hidden repair, and fear of misrecognition? Did the manager distinguish excellent performance from heroic compensation? Did the review ask whether the institution provided authority proportionate to responsibility? Did it record support conditions? Did it mark the difference between developmental strain and disciplinary deficiency? Did it praise endurance where it should have redesigned work?
Applied to a productivity dashboard, the audit asks whether throughput is being treated as reality. What is the dashboard measuring? What is it unable to see? Does faster closure indicate better service, easier case selection, poorer documentation, hidden labor, suppressed complexity, or exhausted workers? Does the dashboard incentivize avoidance of hard cases? Does it display quality, route, and burden alongside volume? Can affected teams annotate the measure? Does leadership use the dashboard to ask better questions, or does it make the dashboard the world?
Applied to an accommodation process, the audit asks whether current performance is being used to deny the cost of current performance. What route is the person using to meet the standard now? What cost does that route impose? Is the requested accommodation changing the essential standard or the route to meeting it? Has the institution mistaken masking for absence of need? Does it require collapse before support becomes credible? Does it treat private compensatory systems as proof that public support is unnecessary? Does it recognize that equal opportunity may require route modification before visible failure appears?
A route-sensitive standard should therefore include output criteria, route criteria, support conditions, strain indicators, accommodation pathways, hidden-labor review, developmental-versus-disciplinary classification, route evidence, metric-limit disclosure, protection against praising compensatory damage, and review triggers when repeated success requires chronic overload. This is not a demand for infinite process. It is a demand that standards tell the truth about what they are measuring. A standard that measures output while pretending to measure excellence overclaims. Excellence includes the route by which output becomes sustainable, ethical, and real.
The hostile objections must be faced directly. The meritocratic objection says standards should judge results, not biography. The answer is that route is not biography. Route is evidence about whether the standard is measuring excellence or extracting damage. A singer’s constricted jaw is not biography. It is evidence about production. A worker’s chronic overextension is not merely personal narrative. It is evidence about work design. A disabled employee’s masking is not an inspirational detail. It is evidence about access.
The administrability objection says institutions cannot inspect every person’s route. True. They cannot, and they should not pretend to. The answer is proportionality. The duty to examine route rises with stakes, repeated strain signals, known support gaps, disability, vulnerability, workload distortion, high-cost performance, and irreversible consequence. A low-stakes task may require minimal route analysis. A high-stakes rating, disciplinary record, denial of accommodation, promotion decision, termination, clinical judgment, or public metric requires more. Administrative difficulty does not authorize route-blind judgment where the institution has reason to know the route matters.
The anti-therapeutic objection says route-sensitive judgment turns evaluation into feelings. This is false. Route includes material, bodily, temporal, technical, relational, and institutional conditions. It includes staffing, tools, authority, time, access, environmental load, documentation burden, case complexity, physical production, hidden coordination, and support. Feelings may sometimes be evidence, especially where fear or humiliation has been structurally induced, but the doctrine is not reducible to subjective preference. A route can be examined with rigor.
The rigor objection says route-sensitivity lowers standards. Music gives the strongest answer. A teacher who hears strain does not lower the standard by correcting the route. They raise it. The correct note produced by damage is not good enough because the standard is not only occurrence but sustainable, integrated production. Institutional standards should learn from that. A route-sensitive review is harder than a route-blind review because it requires the institution to know what it is praising.
The manipulation objection says people may use route claims to evade accountability. Some will. Institutions may require evidence, patterns, documentation, thresholds, and review. They may reject unsupported claims. They may distinguish legitimate route evidence from opportunistic excuse. But possible misuse does not justify institutional blindness. Every procedural right can be misused. That does not make unanswerable authority just.
The final doctrine is now clear. A route-sensitive standard does not abolish excellence. It makes excellence more truthful. It refuses to confuse compliance with capability, strain with virtue, speed with quality, polish with freedom, endurance with support, and survival with justice. It allows institutions to judge, but it requires them to ask whether the judgment has confused the result with the route.
Chapter Seven showed that future forms preclaim the interval before judgment. A person begins to live in the syntax of the coming review, dashboard, complaint, application, promotion packet, or score. Chapter Eight has shown what happens when judgment finally arrives: the standard may reward the route by which the person survived the interval, even when that route was damaging. Chapter Nine follows because route-blind standards do more than misread present performance. They kill futures. If a person must keep paying unsustainable costs to remain legible, the future remains formally open and practically foreclosed. A standard that cannot hear strain will eventually call damage excellence, and a life organized around repeated compensatory compliance cannot ripen into a credible future.
Chapter Nine. Credible Futures and the Forms That Kill Them
The following opening is a composite. It is not a private school record, a sealed employment file, a benefits determination, a tenant-screening report, or an immigration file. It is built from ordinary institutional forms whose public structures are already visible.
A student is told that college remains possible. The disciplinary record can be explained. The suspension was not permanent. The teacher recommendations can still be written. The application remains open. The counselor does not say the future is closed. No one says that. The record sits in the background, available for interpretation, officially amendable under certain procedures, practically difficult to outgrow. The student learns that the future has not disappeared. It has become thinner. The path remains visible in language, but it no longer has the same duration, credibility, protection, or social seriousness. The door is open. The corridor leading to it has narrowed.
That is the injury this chapter names. A form kills a future when it keeps the door nominally open while removing the conditions under which anyone could seriously walk through it. Earlier chapters followed form through reception, exposure, substitution, judgment, vulnerability, residue, anticipation, and standards. Chapter Nine turns to what happens when these injuries accumulate across time. A person may still be eligible to apply, appeal, retrain, transfer, recover, reenter, explain, publish, license, work, study, heal, rent, immigrate, or begin again. No rule may explicitly prohibit the future. Yet the future may no longer possess enough institutional density to organize life. Formal possibility remains. Credible possibility has been damaged.
The governing law is exact: a future is not institutionally available unless it has enough duration, semantic room, material reversibility, error tolerance, and social seriousness to ripen. Duration means enough time before judgment hardens for a future to form. Semantic room means language capacious enough to describe an emerging future without immediate reduction, trivialization, pathologization, criminalization, or professional dismissal. Material reversibility means early movement does not impose irreversible cost so severe that experimentation becomes existentially reckless. Error tolerance means false starts, immaturity, detours, relapses, gaps, and mistakes do not become permanent evidence against becoming otherwise. Social seriousness means that other people, offices, reviewers, teachers, employers, funders, landlords, agencies, or institutions treat the future as real enough to support.
This is not a theory of subjective hope. Nussbaum and Sen are useful because their capability approaches reject the idea that freedom can be measured by formal permission alone; what matters is whether persons have the substantive conditions to do and be certain things (Nussbaum; Sen). Chapter Nine presses that insight into the jurisdiction of form. A formally available future is not yet a credible future. A school may say the student remains eligible. A landlord may say the applicant can apply despite a prior record. An employer may say the person may explain a conviction. A licensing board may allow a petition. A disability system may classify a person for support. An immigration form may invite evidence. The question is whether the future has enough time, language, reversibility, forgiveness, and social uptake to become livable.
The Department of Education’s student-discipline materials make the first archive visible. Its public resources state that successful school climate and discipline require safe, supportive, nondiscriminatory environments that meet academic, social, emotional, behavioral, and mental-health needs, while also preventing and eliminating discrimination in student discipline. The Department’s data page notes that Civil Rights Data Collection and IDEA data have consistently shown disproportionate discipline involving students of color, especially Black students, and students with disabilities, beginning as early as preschool and remaining widespread and persistent. Disparities alone do not automatically prove a legal violation, but they can prompt evaluation of whether discrimination is occurring, including how policies are written and applied in practice.
That language matters because discipline is not only a response to past behavior. It is a form of future allocation. A suspension, behavioral note, referral, placement, record, or informal reputation may shape teacher expectation, counselor attention, course access, recommendation strength, family calculation, and student self-presentation. FERPA provides a formal structure of access and correction. The Department of Education states that FERPA gives parents and eligible students access to education records, the right to seek amendment, and some control over disclosure of personally identifiable information; FERPA regulations require access for inspection and review within a reasonable period, not more than forty-five days after request. These rights matter. They keep the record from becoming wholly inaccessible. Yet a student’s future may be altered long before a record is inspected, amended, interpreted, or corrected. The record can shape the climate of expectation before the student even knows which sentence will travel.
The chapter’s point is not that discipline records should never exist. Schools need order, safety, placement, documentation, and support. A serious account of futurity cannot pretend that every action should vanish without consequence. The problem begins when early records become durable character. A student’s immaturity becomes a disciplinary identity. A conflict becomes a signal. A disability-related behavior becomes defiance. A racialized interpretation of tone becomes threat. An absence becomes irresponsibility. A need becomes disruption. The school can say that future educational opportunity remains open, and in a formal sense it may be right. Yet the future no longer has equal social seriousness. Some students are allowed to be developing. Others are asked to outargue their records before development is believed.
This is the first condition of credible futurity: duration. Futures need time before forms harden. A child, student, worker, patient, applicant, parent, or citizen becomes through intervals. If the form converts an early episode into a durable file too quickly, the future does not get time to gather evidence of change. Duration is not delay for its own sake. It is the temporal condition under which truth becomes more accurate. A person who has not been given time to mature cannot be judged truthfully for not yet being mature. A record that travels too soon may tell a fact and still lie about the future by making the fact arrive before formation has had enough time to answer.
The second condition is semantic room. A future must be describable in language the institution can hear. Medina’s account of epistemic resistance helps here because intelligibility is socially organized; people do not simply possess meanings and deliver them into neutral ears (Medina). A student may not have a vocabulary for why behavior was misread. A worker may not have authorized language for why a bad year was not a stable identity. A formerly incarcerated applicant may be invited to explain rehabilitation in a form that treats explanation as suspicion. A disabled person may need to describe capacity and limitation without being sorted into either total competence or total incapacity. A person emerging from poverty, illness, caregiving, violence, addiction, grief, or displacement may need language that can describe transition without making the transition itself evidence against them. Semantic room is not eloquence. It is institutional room for becoming to be named.
The third condition is material reversibility. Futures require experiments whose early steps do not destroy the person if the experiment fails. A student should be able to try a harder course without one poor grade foreclosing the academic track. A worker should be able to move into a new role without a single developmental period becoming permanent evidence of unsuitability. A person with a criminal record should be able to seek licensed work without fees, hearings, delays, and moral-character standards so burdensome that the attempt itself becomes impossible. A tenant should be able to rebuild rental history without every application fee becoming a tax on old records. A person cannot treat a future as available when testing it requires irreversible loss.
The fourth condition is error tolerance. This is where records become most dangerous. FCRA’s time limits show that law already recognizes relevance decay. Section 1681c excludes many kinds of adverse information from consumer reports after specified periods: bankruptcy after ten years, civil suits, civil judgments, arrest records, paid tax liens, collections, charge-offs, and other adverse non-conviction information after seven years or other specified limits, while criminal convictions receive different treatment. 15 U.S.C. § 1681c. Time limits are not mercy alone. They are epistemic discipline. They recognize that a record’s authority over future judgment should not be immortal. Still, a time limit does not automatically create credible futurity. Seven years can be a life stage. A record can remain socially available after legal reporting limits. A digital trace can survive in unofficial systems. A filing can be remembered by institutions even after formal correction. The right doctrine is not forgetting everything. It is proportional memory.
The fifth condition is social seriousness. A future exists institutionally when other people treat it as real enough to support. A school future becomes serious when teachers recommend, counselors advise, records allow revision, and courses remain accessible. A work future becomes serious when managers sponsor, files expire, bad years can be contextualized, and growth is credited. A housing future becomes serious when landlords distinguish filings from judgments, old records from current tenancy, and crisis from character. A reentry future becomes serious when employers and licensing boards evaluate criminal records through relevance, time, conduct, rehabilitation, and role. A disability future becomes serious when support does not become destiny. The future cannot be self-generated under institutional indifference. Courage matters, but courage cannot substitute for all public conditions.
The criminal-record archive shows how formal openness and practical foreclosure coexist. The EEOC’s 2012 guidance explains that employer use of arrest or conviction records may violate Title VII through disparate treatment or disparate impact, and that a uniformly applied criminal-record exclusion may be unlawful if it disproportionately excludes people of a protected group and is not job-related and consistent with business necessity. The EEOC identifies targeted screening through the nature of the crime, time elapsed, and nature of the job, and notes that individualized assessment makes a screen more likely to satisfy Title VII concerns. This guidance is important because it refuses to let the record speak with unlimited jurisdiction. A conviction may be relevant. An arrest alone does not establish conduct. A record’s meaning depends on time, role, nature, relation, and assessment. The person is not reducible to the record’s mere presence.
Devah Pager’s work makes the labor-market afterlife of criminal records difficult to sentimentalize; the mark travels through hiring markets and interacts with race in ways that shape opportunity before an employer has to say explicitly that a future is closed (Pager). James Jacobs’s account of the enduring criminal record likewise helps name the infrastructural durability by which record systems outlast punishment (Jacobs). NCSL’s automatic record-clearing database gives the current policy field: every state has some petition-based path by which some people can clear records, but those procedures can be baffling, cumbersome, confusing, costly, and attorney-dependent; NCSL reports that, as of its February 25, 2025 update, twenty-six states and Puerto Rico have at least one statutory automatic record-clearing provision, and several states have automated clean-slate processes. That source captures the whole chapter. A petition right may exist. The future may remain formally open. But if the person never learns of eligibility, cannot pay fees, cannot obtain counsel, cannot navigate terminology, or cannot wait through delay, the future remains legally imaginable and practically foreclosed.
Record clearing is one of the strongest institutional answers to future-killing forms because it recognizes that a record’s jurisdiction should decay. But even record clearing must be judged by credible futurity. Does clearing happen automatically, or must the person petition? Is the person notified? Are fees required? Is legal assistance needed? Are employers, landlords, licensing boards, courts, and databases updated? Does relief cover arrest records, non-convictions, convictions, dismissed charges, juvenile records, or only some categories? Does the record disappear from public view while remaining in professional or law-enforcement systems? Can old records still be found by private databases? Does the person have enough social seriousness after clearing for the future to be believed? A clean slate that does not travel as far as the dirty record once traveled remains incomplete.
Employment files produce a quieter version of the same injury. A worker may be told that promotion remains possible after a poor cycle. They may be told that a transfer is not forbidden. They may be told that a performance rating is one period, one manager, one context. Yet the file has become portable. It shapes sponsorship, calibration, future assignment, risk perception, and the story others tell before the person arrives. Anderson’s account of private government matters here because workplaces can govern lives through dependency and hierarchy while speaking the language of contract and choice (Anderson). A worker is free to apply, but the institutional future has already been narrated. The question is not whether any bad rating should vanish. The question is how long a rating may govern, what evidence can revise it, whether a person can outgrow it, and whether the file distinguishes a period from a person.
Credit and tenant screening sharpen this same logic because they organize the material preconditions of life. A person may remain legally free to rent. They may submit applications, pay fees, attach explanations, dispute reports, wait for records to age out, or seek landlords willing to look beyond automated screening. Yet housing futures require material reversibility. If every application requires money, if every denial consumes time, if every old filing travels faster than explanation, if every credit injury becomes a proxy for character, and if every correction arrives after the unit is gone, the housing future remains formally available and practically thin. The person is not barred from applying. They are forced to keep applying into a form that has already narrowed the future’s seriousness.
Medical diagnosis and disability determination require greater care because they show the doubleness of form. The SSA Blue Book introduces disability programs, the disability determination process, evidentiary requirements, and the Listing of Impairments, whose medical criteria are usually sufficient to establish disability; the Listing describes impairments severe enough to prevent gainful activity for adults or cause marked and severe functional limitations for children, with duration requirements in many cases. Such forms can open futures. A diagnosis can unlock treatment, accommodation, insurance, explanation, community, income, assistive technology, and relief from false moral blame. Disability determination can create material survival where ordinary labor markets have failed. The form is not inherently foreclosing. It may be the first institution that receives a person’s reality truthfully.
The danger arises when the support-giving form becomes future-possessing. A diagnosis written to guide treatment becomes a credibility filter. A functional limitation written to secure support becomes an employability ceiling. A disability determination written to recognize need becomes a general account of capacity. A mental-health history becomes parenting suspicion. A medical code becomes insurance risk. A school accommodation record becomes lowered expectation. The same form that opens one future can narrow another if later actors forget its jurisdiction. A diagnosis is authorized to support care, accommodation, interpretation, and protection. It is not authorized to possess the person’s future.
Immigration forms make the temporal stakes severe because future status often depends on documentary precision. USCIS describes Form I-485 as the application used by people in the United States to apply for lawful permanent resident status. Its public page emphasizes edition date, filing category, evidence submission, filing location, fees, signatures, medical examination requirements, and the possibility of rejection for missing pages, wrong editions, or missing signatures. This is not a criticism of USCIS forms as such. Immigration systems require identity, eligibility categories, evidence, medical examination, fees, timing, signatures, and lawful process. The futurity problem lies in the disproportion between small documentary errors and long temporal consequence. A missed deadline, inconsistent answer, missing evidence, fee barrier, address error, medical form problem, or prior classification may shape years of waiting, work authorization, family stability, and lawful belonging. The future remains procedurally described. Its material reversibility may be fragile.
The chapter must now distinguish truthful closure from foreclosed closure. Some futures should close. A person may abandon a vocation because another call is more honest. A student may leave a track because the evidence shows another path is better. A professional license may be denied when conduct truly indicates danger. A benefit may be denied when criteria are not met. A job may not be appropriate. A medical restriction may protect life. A legal record may remain relevant. A future is not sacred because it was once desired. Bernard Williams helps here because moral life is shaped by contingency, retrospective meaning, and the way events redescribe projects after the fact (Williams). Truthful closure occurs when evidence, reality, obligation, desire, capacity, or harm has been judged with enough time, room, reversibility, error tolerance, and seriousness for the closure to be honest. Foreclosed closure occurs when the rival future never had enough conditions to become available for judgment.
Young’s account of structural injustice helps prevent the search for one villain (Young). Futures often die across distributed forms: school records, credit systems, employment screens, disciplinary notes, licensing boards, medical codes, application fees, background checks, automated filters, informal reputation, and bureaucratic delay. No single actor says, “You may not become.” Each actor says something narrower: the record is accurate, the policy is neutral, the score is relevant, the deadline has passed, the category applies, the risk is too high, the file is incomplete, the fee is nonrefundable, the appeal remains available, the applicant may reapply. The accumulated effect is foreclosure without prohibition.
The formalist objection says that if the future remains legally available, calling it foreclosed inflates the injury. This objection has force because institutions cannot guarantee every person’s preferred future. But the chapter is not asking institutions to guarantee outcomes. It asks them not to represent formal openness as real availability when the conditions of credible pursuit have been withdrawn. A school that says college remains possible while discipline records and tracking deny social seriousness has not lied in a formal sense. It has omitted the institutional truth of the corridor. A state that allows record clearing by petition while making the process confusing, costly, and attorney-dependent has not abolished relief. It has priced credible relief beyond many people. A landlord who says applicants with old filings may apply has not formally closed housing. The question is whether the application has any credible route to success.
The voluntarist objection says people make futures credible through courage. Many have overcome bad records, poverty, illness, disability, criminalization, rejection, and institutional disbelief. The chapter should grant this without making heroism a policy. Some people can build futures under hostile conditions. Their courage is real. Their courage does not absolve the forms that made the future unnecessarily incredible for others. A just institution cannot design its moral theory around the exceptional person who survives deprivation. It must ask what conditions ordinary persons need to inhabit the future seriously.
The civilizational objection says that all serious forms close possibilities. Schools track. Professions select. Licensing excludes. Records remember. Credit systems price risk. Immigration systems sort eligibility. Disability determinations classify. Discipline must have consequence. This objection is correct against any fantasy of endless openness. Chapter Nine does not oppose closure. It opposes premature, invisible, asymmetric, and disproportionate foreclosure. Forms must sometimes close futures. They exceed jurisdiction when they close before the person has had duration, semantic room, material reversibility, error tolerance, and social seriousness enough for the closure to be truthful.
The administrability objection says credible futurity is too vague to govern. How can an institution measure whether a future has enough semantic room or social seriousness? The answer is that the five conditions have public indicators. Duration appears in deadlines, waiting periods, record retention, reporting periods, expungement timing, probationary intervals, appeal windows, and time before permanent classification. Semantic room appears in forms that allow explanation, alternative evidence, contextual statements, individualized review, and non-reductive categories. Material reversibility appears in costs, fees, refundable applications, low-risk trials, transitional supports, provisional licenses, conditional approvals, and reentry routes. Error tolerance appears in record-sealing, correction, non-punitive developmental intervals, grade replacement, fresh-start policies, and relevance decay. Social seriousness appears in mentorship, sponsorship, counselor attention, employer individualized assessment, funding, accommodation, placement support, and formal recognition that the future is worth institutional effort. Credible futurity is not mysticism. It is an audit of conditions.
The meritocratic objection says that bad records should matter. A discipline history, poor performance file, criminal conviction, credit default, diagnosis, or missed deadline may reveal relevant risk. The answer is proportional memory. Forms may remember. They may not possess. A record’s jurisdiction must be tied to relevance, time, role, pattern, repair, and current evidence. A bad year can matter without becoming identity. A criminal conviction can matter without governing unrelated work forever. A diagnosis can matter without becoming destiny. A credit event can matter without becoming moral character. A school discipline record can matter without stealing adolescence. Accountability and futurity are not opposites. Accountability becomes unjust when it denies the possibility of becoming otherwise after the form’s legitimate work is done.
The futurity audit asks the questions this chapter has earned. What future remains formally open? What form currently shadows it? How much time remains before the form hardens? What vocabulary is available to describe becoming otherwise? What material risks attach to trying? What errors become permanent? What support would make the future socially serious? Who receives that support by default? What record, score, diagnosis, file, denial, or classification travels into the future? Can the person revise, explain, expire, seal, supplement, contextualize, or outgrow the form? At what point must the institution stop allowing an old form to govern a new life?
Applied to a school discipline record, the audit asks whether the record preserves safety or converts development into destiny. How long does it travel? Who sees it? Can the student and family inspect it within a usable time? Can it be amended, contextualized, or sealed? Does the school distinguish disability-related behavior, racialized interpretation, adolescent immaturity, isolated conflict, and genuine danger? Does the record affect course access, recommendations, transfer, extracurricular opportunity, or counselor expectation? Does the student have enough social seriousness after the record for another future to ripen?
Applied to a criminal record, the audit asks whether the record remains relevant to the future it governs. What is the nature of the offense? How much time has elapsed? What role or license is at issue? What evidence of rehabilitation, changed conduct, or support exists? Is individualized assessment available? Is clearing automatic or petition-based? Are fees, counsel, or procedural complexity required? Do private databases update? Does the record still travel into employment, housing, credit, licensing, and education after formal relief? Does the future remain credible, or does the person remain indefinitely marked?
Applied to a disability determination or diagnosis, the audit asks whether the form opens support without possessing the future. What support does the classification unlock? Who may access the record? How does the form travel? Does it enable care, accommodation, and income, or does it become a ceiling in education, work, parenting, insurance, or credibility? Can the person revise the record as condition changes? Can support continue without freezing identity? Does the institution distinguish present functional need from permanent incapacity?
Applied to an immigration form, the audit asks whether documentary requirements preserve lawful order without creating disproportionate temporal catastrophe. What evidence is required? What happens if a page, edition, signature, fee, address, medical form, or category is wrong? Is correction possible without long delay? What status, work, travel, family, or safety consequences attach? Does the form allow semantic room for complex histories, or does it force life into rigid categories where minor inconsistency becomes suspicion? The future of lawful belonging depends not only on eligibility, but on the reversibility of documentary error.
A non-possessive institution would design futures differently. It would build record expiry and relevance decay into systems. It would make correction and sealing practical rather than heroic. It would create reentry pathways with low-cost trials. It would distinguish episode from pattern, risk from destiny, support from incapacity, and accountability from permanent identity. It would allow alternative evidence where standard forms cannot receive becoming. It would create protected developmental intervals. It would treat early error as information, not final metaphysics. It would require old forms to renew their jurisdiction before governing new life.
This is not endless forgiveness. It is truthful temporality. A form that handled a past event may have had jurisdiction then. It may not automatically have jurisdiction forever. The older the record, the farther the context, the greater the change, the more serious the future consequence, and the weaker the current relevance, the heavier the burden on the institution that still wants the form to govern. A future dies when an old form keeps speaking after its authority has expired.
Chapter Ten follows because the book now needs a counterexample. After showing how forms receive, expose, substitute, judge, exploit vulnerability, preserve residue, preclaim intervals, misread routes, and kill futures, the argument must turn to a relation whose authority depends on not possessing what it receives. Friendship is not the institutional solution. Institutions cannot become friends, and the ones that claim to be friends should be distrusted. But friendship shows something institutional forms repeatedly forget: to receive is not to own, to remember is not to freeze, to correct is not to humiliate, and to witness is not to possess. Chapter Ten will treat friendship as the negative laboratory of non-possessive form.
Chapter Ten. Witness Without Capture
An unpublished manuscript enters peer review before it has public defenses.
It arrives as unfinished work: argued but revisable, formed but exposed, serious enough to be judged and still vulnerable enough to be harmed by the one who judges it. The reviewer receives the manuscript under a narrow authority. They may read it. They may criticize it. They may say the claim is underdeveloped, the evidence insufficient, the method unstable, the sources mishandled, the contribution unclear, the style inflated, the conclusion stronger than the proof. They may recommend rejection. They may demand revision. They may name what the author does not yet see. The reviewer’s authority is real because judgment without severity would betray the work, the field, and the public record of scholarship.
Yet the reviewer may not possess what they have received. They may not steal the argument, circulate the unpublished finding, use the privileged material for professional advantage, convert temporary access into private leverage, punish the author beyond the review process, or let confidential knowledge become reputational power. Their authority exists only inside the purpose that justified reception. They received the manuscript to review it. They did not receive it to own it. The reviewer’s access is therefore also a restraint. The more vulnerable the work, the more disciplined the use.
This is the chapter’s governing law: reception creates limits before it creates permissions.
That law corrects the earlier temptation to make this chapter principally about friendship. Friendship remains important, but it can no longer carry the institutional burden of the chapter. The book has already built a jurisprudence of forms through evidence, exposure, substitution, interruptible judgment, interior vulnerability, data residue, anticipatory governance, route-sensitive standards, and credible futures. A chapter that turns, after all that, into a meditation on friendship would feel like a decline in pressure. The problem now is not friendship as such. The problem is receiving form. What happens when an institution receives speech, work, testimony, error, vulnerability, unfinishedness, complaint, developmental material, or future possibility from a person? What authority does that reception create? What authority must it refuse? What would count as capture?
The answer is exact: a form that receives another person’s speech, work, pain, error, vulnerability, testimony, or unfinished future must not turn that reception into capture. What an institution receives for one purpose, it must not possess for another.
A receiving form is any structured process, role, interface, file, report, review, pathway, or relation through which an institution receives material from a person under a claim of purpose. Peer review receives unfinished work. Counseling receives intimate disclosure. Social work receives need, family history, danger, resource constraint, and fragile trust. Pastoral care receives grief, confession, fear, and moral struggle. A complaint pathway receives testimony about harm. A workplace review receives performance, error, feedback, development, and managerial inference. An AI assistant receives language that may include loneliness, panic, shame, dependency, illness, and desire. Each receiving form may have legitimate work to do. Each becomes dangerous when the received material escapes the jurisdiction of the purpose that justified receiving it.
Capturing reception occurs when material received for one purpose is converted into authority beyond that purpose. It has several forms. Appropriative capture occurs when the receiver uses the material for advantage, as when confidential peer-review material becomes another scholar’s opportunity. Repurposing capture occurs when material received in one setting travels into another without renewed authority. Reputational capture occurs when disclosed material becomes standing, gossip, credibility discount, suspicion, or informal institutional memory. Disciplinary capture occurs when developmental material becomes punitive record without notice, threshold, or process. Interpretive capture occurs when a partial disclosure becomes the total account of a person. Temporal capture occurs when received material continues to govern after its purpose, relevance, or jurisdiction has decayed. These are not accidents at the edge of institutional life. They are recurring ways institutions convert reception into ownership.
Non-possessive reception is therefore not gentleness. It is disciplined custody without capture. A receiving form must state its purpose, limit use, restrict circulation, permit correction, protect refusal where possible, separate developmental from punitive memory, and define when received material expires, decays, or requires renewed encounter. This is not the refusal of judgment. Peer review proves the opposite. The reviewer may judge severely precisely because the form of review restricts what may be done with what is received. Judgment and non-possession are compatible when judgment remains inside purpose.
The Committee on Publication Ethics gives this principle unusually clean institutional form. Its guidelines for peer reviewers treat peer review as an ethical role governed by confidentiality, declared conflicts, proper use of privileged information, and the prohibition on using reviewed material for one’s own advantage or to disadvantage others (Committee on Publication Ethics). That is the chapter in miniature. The reviewer’s access is not general access. The reviewer’s judgment is not general sovereignty. The manuscript may be rejected, but it may not be captured. The authority to judge the work does not become the authority to appropriate the work’s future.
The peer-review example is useful because it has no need for sentimental language. It does not depend on affection, therapy, pastoral tenderness, or friendship. It is a stern evaluative system. It can be harsh. It can be gatekeeping. It can fail in practice through bias, prestige capture, cruelty, theft, disciplinary conservatism, anonymous aggression, or institutional inertia. But its explicit ethical architecture still recognizes the principle many forms forget: receiving something vulnerable under process creates a duty not to convert that material into unrelated power. A reviewer who steals a manuscript has not simply behaved badly. They have violated the jurisdiction of reception.
Professional confidentiality translates the same rule into more intimate material. Counseling, social work, and pastoral care are not friendship, and Chapter Ten must not confuse them with friendship. They are structured roles with purpose, boundary, documentation, and duties. Their relevance here lies in the way their ethical rules treat receipt of private material as a source of restraint. APA standards on privacy and confidentiality require reasonable precautions to protect confidential information, discussion of confidentiality limits, minimization of privacy intrusion, and restriction of disclosures under defined conditions (American Psychological Association standards 4.01–4.07). NASW standards likewise emphasize privacy, confidentiality, informed consent, limits on disclosure, and attention to access to records (National Association of Social Workers standards 1.07–1.08). Pastoral confidentiality guidance, when responsibly articulated, also insists that entrusted material cannot be casually circulated simply because it was heard within a relation of care (Methodist Church).
The institutional lesson is not that every receiving form should become clinical, pastoral, or therapeutic. That would be another form of overreach. The lesson is that some professions have learned, through discipline and failure, that intimate reception narrows permissible use. The more interior the material received, the more exact the boundary must become. A counselor may receive panic, shame, grief, trauma, family danger, desire, confusion, and self-description. That receipt does not authorize reputational circulation. A social worker may receive need, risk, poverty, family history, and complex vulnerability. That receipt does not authorize unrelated institutional inference. A pastoral caregiver may receive confession, anguish, alienation, and moral fear. That receipt does not become congregational property. Access is not ownership. Intimacy is not permission. Disclosure is not surrender.
The same rule must govern complaint pathways, although their structure is harder because they must receive testimony while also making harm answerable. A complaint process cannot be built on secrecy alone. Institutions must sometimes investigate, preserve records, protect complainants, notify respondents, assess credibility, disclose enough for fair process, impose consequence, and repair harm. Non-possessive reception does not require institutional paralysis. It requires purpose-bound handling of testimony. The complainant must not become the institution’s raw material. The respondent must not become a permanent procedural identity without proportional process. The witness must not be turned into a file fragment beyond the investigation’s purpose. The institution must not convert another person’s harm into its own reputational management project.
Restorative practice can clarify this point only if handled without romance. Its principles often stress restoration, voluntarism, neutrality, safety, accessibility, and respect (Restorative Justice Council, Principles). Its strongest contribution for this chapter is the idea that accountability need not be identical with humiliating capture. Repair, acknowledgement, responsibility, and changed conduct can be pursued without converting the person who caused harm into nothing but the harm, and without making the person harmed into a permanent evidentiary object. But restorative processes can also become coercive, unsafe, sentimental, or institutionally self-protective when voluntarism is false, power asymmetry is minimized, safety is underbuilt, or pressure to reconcile becomes another burden placed on the harmed. Restorative language does not guarantee non-possession. A restorative process captures when it uses the harmed person’s testimony to protect the institution, pressures forgiveness, turns participation into moral proof, or treats the respondent’s performance of accountability as sufficient repair before material conditions have changed.
The same danger appears in conventional complaint systems. A university, employer, church, agency, platform, or professional association may receive an account of harm and then immediately translate it into a procedural object. The person’s words become allegations, allegations become issues, issues become evidence, evidence becomes findings, findings become record, and record becomes future consequence. Some of this translation may be necessary. The danger begins when the person no longer has any relation to what was received except as source material. The institution speaks through their testimony while narrowing their agency over privacy, timing, correction, context, and repair. The form has received pain and then made pain administratively useful.
A complaint pathway that receives without capture must therefore disclose its purpose, name who will see the testimony, define what must be shared for fairness or safety, distinguish confidential support from formal complaint, separate investigation record from rumor, protect against retaliation, provide correction of factual errors, limit unrelated use, and define retention. It must also say when confidentiality may be overridden by safety, law, mandatory reporting, or repair. Non-possession is not secrecy absolutism. It is purpose-bound disclosure. The institution may disclose where disclosure belongs to the legitimate purpose of receiving the complaint. It may not use testimony as institutional property.
Workplace developmental records provide the chapter’s most direct bridge to the book’s recurring artifact: the annual review. A manager receives many kinds of material across a year. Some of it is performance evidence. Some of it is coaching. Some of it is informal context. Some of it is developmental struggle. Some of it is a mistake corrected before consequence. Some of it is peer friction, fatigue, personal disclosure, failed experimentation, changed scope, or a need for support. A possessive review system lets all received material become possible future custody. A non-possessive review system classifies memory by purpose.
Developmental memory is memory held for growth, correction, support, instruction, or revision rather than discipline, exclusion, reputation, or future penalty. It is necessary because people cannot develop if every unfinished effort becomes permanent evidence against them. A new manager tries a communication approach and fails. A worker asks for coaching before they know how to name the problem. An employee discloses that a deadline was missed because the process was unclear and the tooling broken. A team member receives feedback on tone, judgment, pacing, documentation, collaboration, or scope. Some of this may later matter if patterns persist or harm occurs. But it cannot automatically become disciplinary memory simply because the institution received it.
A receiving form becomes possessive when it lets formative material travel without reclassification. Coaching notes appear later as evidence of chronic deficiency. A developmental conversation becomes a promotion objection. A disclosure made to obtain support becomes proof of unreliability. A mistake corrected in a learning context becomes reputation. Peer feedback gathered for growth becomes calibration ammunition. A manager’s informal impression becomes inherited truth for the next manager. The form has captured development. It has taken material received for growth and repurposed it for penalty.
The distinction between developmental and disciplinary memory does not require institutions to forget everything. That would be unserious. It requires them to name the jurisdiction of memory. If a coaching conversation is developmental, the record should say so. If developmental material may become disciplinary after repeated patterns, the threshold should be disclosed. If a record travels to promotion review, the person should know that. If a note expires, it should expire. If a fact is serious enough to remain active, it should be made contestable. If the institution later wants to use old developmental material for a new consequence, it should re-encounter the person rather than silently act through the residue of earlier reception. Memory without purpose becomes custody.
This is where the chapter must return to simulated institutional friendship. Platforms, AI assistants, employers, schools, health systems, banks, and service systems increasingly borrow relational language: companion, coach, partner, guide, assistant, care team, family, trusted advisor. Sometimes such language improves access and reduces fear. Sometimes it is manipulative. The danger lies in the mismatch between the tone of relation and the structure of power. A system that sounds friendly may elicit disclosure while retaining powers no friend possesses: storage, search, aggregation, retention, optimization, classification, inference, sale, sharing, audit, discipline, escalation, and cross-context reuse. Friendliness becomes capture when it borrows intimacy’s permissions without accepting intimacy’s obligations.
Suchman’s work on human-machine configurations helps explain why systems are never neutral instruments outside relations of action and interpretation (Suchman). Turkle’s work warns that people may form expectations of care, attention, and companionship around machines and systems that cannot reciprocate as persons do (Turkle). Cohen and Nissenbaum supply the institutional grammar: informational systems structure environments of action, and information flows are context-bound rather than naturally free once disclosed (Cohen; Nissenbaum). Waldman’s account of privacy as trust also matters here because relationships that invite disclosure can create obligations beyond notice-and-choice formalities (Waldman). The AI or platform system that elicits intimate speech must not say, afterward, that the user freely gave data into a general-purpose machine. The system designed the receiving relation. It must bear the limits of what it elicited.
This does not repeat the conduct-layer doctrine from Chapter Five. Chapter Five addressed what a system may do when interior vulnerability becomes visible. Chapter Ten addresses the broader rule that any receiving institution must not use relational form to acquire unbounded power. An AI assistant may help. A workplace tool may coach. A school system may support. A bank may advise. A health platform may guide. But the receiving form must disclose what it is, what it is not, what it stores, who can access it, what it may infer, what uses are prohibited, and whether the user can correct, delete, isolate, or limit what has been received. The warmer the interface, the clearer the boundary must be.
Only now should friendship enter. Friendship is not the chapter’s foundation. It is the negative laboratory that confirms the doctrine in human relation. A friend may receive grief, shame, contradiction, confession, failure, desire, or unfinished future. Yet the friend’s receipt does not authorize circulation, leverage, possession, or final interpretation. Aristotle’s distinction between friendship of utility and higher friendship helps only because it shows that a relation ordered entirely by use has already degraded the other into material (Aristotle). Cicero helps because friendship includes frank counsel; non-possessive reception can correct without becoming flattery (Cicero). Augustine helps because love and memory can become disordered when they cling, idealize, or possess (Augustine). These sources should not aestheticize the chapter. They teach one institutional lesson: receiving another person deeply increases obligation, not ownership.
Modern philosophical sources sharpen that lesson. Arendt’s account of plurality reminds us that no single account exhausts how a person appears in the world (Arendt). Cavell’s language of acknowledgment helps distinguish response from mastery; one can answer another without possessing them as an object of knowledge (Cavell). Ricoeur’s account of narrative identity supports memory with revision, continuity without freezing (Ricoeur). Butler’s account of self-narration under conditions one does not fully author guards against forms that demand complete coherence before recognition (Butler). These sources belong late because the institutional doctrine has already been built. Their function is confirmation, not atmosphere.
Friendship also shows why institutions cannot become friends. A friend’s authority depends on mutuality, history, freedom, particularity, vulnerability, and reciprocal risk. Institutions do not have those qualities in the same way. They have policies, records, offices, incentives, obligations, liabilities, permissions, and powers. A school, employer, bank, hospital, platform, agency, church office, or AI assistant that claims friendship should be distrusted if the claim expands disclosure while leaving institutional power intact. The institutional lesson drawn from friendship is therefore negative: do not imitate intimacy; translate limits. The institution should not become warmer in order to receive more. It should become more bounded in order to possess less.
The first hostile objection is that non-possessive reception weakens accountability. If institutions cannot use what they receive, they cannot investigate, judge, correct, discipline, or protect. This objection misunderstands the doctrine. Non-possessive reception does not prohibit use. It prohibits unauthorized use. Peer review can reject. Complaint systems can investigate. Counseling professionals can disclose under defined safety or legal conditions. Workplaces can discipline when material crosses disclosed thresholds. Non-possession does not mean received material is inert. It means received material acts only within the jurisdiction of the purpose that justified receiving it.
The second objection is that institutions need records. Without durable memory, wrongdoing disappears, patterns remain hidden, repeat harm is missed, and accountability collapses. This objection is serious. Records can protect the vulnerable against erasure. The answer is not forgetting. The answer is purpose-labeled memory. Records should identify whether they are developmental, disciplinary, investigatory, evidentiary, safety-related, legal, pastoral, clinical, confidential, expired, sealed, or active. Records should have access rules, retention periods, use limits, contest pathways, and revalidation triggers. Memory becomes possessive when it no longer knows why it is remembering.
The third objection is that confidentiality and purpose limitation can conceal abuse. Institutions have often hidden harm behind pastoral confidentiality, professional privilege, internal process, private settlement, or reputation management. The answer is that non-possession is not secrecy absolutism. A receiving form must state when disclosure is required for safety, law, investigation, repair, or protection of others. It must also distinguish protective disclosure from reputational exploitation. The wrong is not disclosure as such. The wrong is disclosure without jurisdiction, or nondisclosure used to protect the institution rather than the persons harmed.
The fourth objection is strategic behavior. People may use correction, contextualization, refusal, or purpose limits to avoid accountability. Some will. Institutions may set reasonable deadlines, evidentiary thresholds, anti-abuse rules, and consequences for bad-faith claims. But strategic risk does not justify unanswerable possession. A court does not abolish procedure because some litigants abuse process. A peer-review system does not abolish confidentiality because some authors submit weak work. A complaint pathway does not abolish fairness because some claims are difficult. Abuse risk requires design. It does not authorize capture.
The fifth objection is scale. Friendship does not scale. Contextual judgment is expensive. Institutions cannot re-encounter every person behind every record. The answer is that intimacy does not scale, but jurisdictional limits do. A form can state purpose at scale. It can separate access roles. It can prohibit unrelated use. It can label memory. It can impose expiry. It can require renewed process before old material governs new consequence. It can preserve correction pathways. It can prevent developmental material from silently becoming punitive record. Scale does not excuse possession. It increases the need for disciplined form.
The reception audit asks the questions this chapter has earned. What was received? For what purpose? What authority did that purpose create? Who may access the received material? What uses are prohibited? Can the subject correct, withdraw, contextualize, or limit use? Does the material become reputational, disciplinary, predictive, or permanent? Is developmental material separated from punitive memory? Does the record expire, seal, decay, or require revalidation? When may safety, law, investigation, or repair override confidentiality? Can the institution act through this material later without renewed encounter? What would count as capture?
Applied to peer review, the audit asks whether the reviewer’s access remains bound to review. Can the reviewer cite the work privately, use it competitively, disclose it, let it shape hiring, tenure, or reputation outside process, or punish the author beyond the review? If so, review has become capture. Applied to counseling or social work, the audit asks whether disclosure remains tied to care, safety, legal duty, or service purpose. If intimate material becomes informal reputation, administrative suspicion, unrelated eligibility inference, or institutional convenience, care has become capture. Applied to complaint intake, the audit asks whether testimony is used for investigation and repair or for institutional defense, gossip, retaliation, or permanent procedural identity. Applied to workplace development, the audit asks whether coaching memory supports growth or silently becomes future punishment. Applied to AI systems, the audit asks whether friendly reception becomes memory, profiling, optimization, escalation, or cross-context leverage beyond the user’s understanding and authority.
This chapter now belongs to the book’s architecture because it has moved from friendship as mood to reception as jurisdiction. It gives the book one additional doctrine: received material remains bound to the purpose that justified receiving it. It also gives the book one additional danger: capture. After exposure, substitution, non-interruptible judgment, residue, pre-form governance, route-insensitive standards, and foreclosed futures, capture names the institutional seizure of material that entered under trust, vulnerability, unfinishedness, or limited purpose.
Chapter Eleven follows because this doctrine must now face its most extreme object. If Chapter Ten has shown that institutions must not capture received speech, unfinished work, vulnerable disclosure, testimony, complaint, developmental error, or memory, Chapter Eleven turns to the handled body under completed procedure. Witness without capture becomes resurrection against final form. The body has been received by verdict, empire, tomb, burial, guard, witness, and grief. The question becomes whether any of those forms may claim final truth simply because they have completed their work.
They may not. That is where the next chapter must begin.
Chapter Eleven. Resurrection Against Final Form
The body has been handled.
That is where this chapter begins. Not with consolation, not with symbol, not with the bright grammar of Easter morning, but with the body after completed procedure. The accusation has moved. Testimony has been gathered, strained, contradicted, received, or weaponized. Interrogation has occurred. Public authority has spoken. The sentence has been enacted. The body has been exposed to violence, removed from public view, wrapped, carried, placed, watched, mourned, sealed, remembered, and guarded. The forms have done what forms do: they have received, translated, decided, disposed, recorded, and stabilized. The body is in custody. The world appears administratively complete.
Holy Saturday is the book’s pressure chamber because it is the interval in which completed procedure appears to have become reality itself. Good Friday contains the sentence and the execution. Easter contains disclosure and reversal. Holy Saturday is the time when the verdict seems to have acquired the authority of the world. The body is dead. The authorities have acted. The disciples are scattered. The mourners cannot reverse the outcome. The tomb holds the body in a form of custody. Burial practice gives the violated body a place. Guarding, in Matthew’s account, attempts to secure the finality of that place against contestation (Matt. 27.62–66). Witness remains, but witness has not yet become public reversal. Grief remains, but grief cannot reopen the tomb. The form appears to have completed its jurisdiction.
The governing law of this chapter is therefore exact: no form that has handled the violated body may claim the authority of final truth simply because it has completed its procedure. The enemy is not form itself. The enemy is possessive finality. Bodies must be buried. Deaths must be certified. Sentences must be recorded. Courts must enter judgment. Physicians must diagnose. Archives must preserve. Communities must remember. Families must mourn. Public life cannot exist without forms that handle mortality, violence, evidence, custody, and closure. But practical closure is not final truth. Administrative completion is not metaphysical possession. A tomb may hold a body. It may not own the body’s meaning.
The Gospel narratives must not be flattened into one harmonized account. Mark gives the stark pressure of accusation, failed testimony, execution, burial, and destabilized witness. False witnesses rise, but their testimony does not agree (Mark 14.55–59). Jesus is condemned, mocked, crucified, and dies (Mark 15.1–39). Joseph of Arimathea asks Pilate for the body, wraps it in linen, places it in a tomb, and rolls a stone against the door, while Mary Magdalene and Mary the mother of Joses see where the body is laid (Mark 15.42–47). At the tomb, the women encounter an announcement that the crucified one has been raised, and Mark’s ending refuses possession by leaving fear, amazement, and silence in the narrative field (Mark 16.1–8). Mark does not let the reader own the event as smooth closure.
Matthew intensifies custody. After the burial, the chief priests and Pharisees ask Pilate to secure the tomb, fearing that the disciples might steal the body and claim resurrection; the tomb is made secure by sealing the stone and setting a guard (Matt. 27.62–66). This is the chapter’s clearest image of final form. The tomb becomes not only burial but administrative stabilization. The seal and guard are attempts to control the afterlife of the verdict. The body is dead, but the authorities still fear meaning. They understand, perhaps better than the disciples do, that finality is vulnerable if the body’s public meaning can be contested. Matthew therefore gives the book one of its strongest images: a form that knows it must secure itself because completion alone does not guarantee truth.
Luke gives witness, memory, and recognition. Joseph of Arimathea places the body in a rock-hewn tomb, and the women who had come with Jesus from Galilee see the tomb and how the body is laid; then they prepare spices and ointments and rest on the Sabbath according to the commandment (Luke 23.50–56). Their waiting is not passivity. It is disciplined witness under conditions of apparent finality. In Luke 24, the women return, find the stone rolled away, and are asked why they seek the living among the dead (Luke 24.1–12). The form that held the body no longer possesses the body. Memory must be reinterpreted, but the reinterpretation does not erase the violence. Luke’s road to Emmaus then stages recognition as delayed, narrated, and communal rather than instantly owned (Luke 24.13–35). The event exceeds the first forms available to understand it.
John gives the body, the wound, the name, and the refusal of abstraction. Jesus is interrogated by religious and imperial authority, exposed to public judgment, crucified under an inscription, pierced, and then buried by Joseph of Arimathea and Nicodemus with spices in a nearby tomb (John 18–19). Mary Magdalene comes to the tomb and later recognizes the risen Jesus when he speaks her name (John 20.1–18). Thomas encounters the risen body through wounds that remain visible (John 20.24–29). John is crucial because resurrection does not replace the body with an idea. The wounds remain. Violence is not erased by glory. The body that was handled by final forms is not surrendered to those forms, but neither is the history of handling denied.
This is why resurrection cannot be treated as optimism after institutional violence. It is the refusal of final jurisdiction by verdict, tomb, empire, archive, diagnosis, sentence, certificate, file, or record over the body it has handled. N. T. Wright’s work matters because it insists that resurrection, within early Christian proclamation, is bodily, public, and world-altering rather than a metaphor for survival or an interior experience of consolation (Wright). Paul’s insistence in 1 Corinthians 15 likewise keeps the claim from becoming inward uplift. Resurrection concerns witness, body, death, transformation, and the defeat of death’s authority (1 Cor. 15). If resurrection is reduced to inspiration, the chapter fails. If resurrection remains bodily, then the forms that acted upon the body stand exposed as non-final.
Resurrection is also more than reversal. A legal reversal leaves the same order of jurisdiction intact: one authority corrects another, one decision is vacated, one judgment is remanded, one process is reopened. That analogy is useful but insufficient. Resurrection does not return the executed body to the court for reconsideration. It discloses that the court, empire, tomb, and death-backed verdict never possessed final truth. The body is not restored to the jurisdiction that killed it as though the same system may now improve its paperwork. The risen body reveals the limit of every form that equated completion with truth.
This is where the book’s earlier doctrines gather without becoming a summary. Chapter Two’s evidence without exposure returns in the Passion narratives through witness, visibility, shroud, wound, and tomb. Not everything visible is possessed. Not everything seen is owned. Chapter Three’s substitute and person returns in the empty tomb: the tomb is a sign, but it is not the body; the grave clothes are traces, but they are not custody; the official story is a representation, but it cannot command the referent. Chapter Four’s interruptible judgment returns because executed judgment is shown to have exceeded itself, yet resurrection is more than procedural appeal. Chapter Five’s conduct near the interior returns because grief, fear, and witness must not be exploited by systems eager to stabilize meaning. Chapter Six’s residue returns through scars, memories, linen, spices, reports, rumors, and testimony. Chapter Seven’s interval before the form returns as Holy Saturday, the time when no one yet knows how to narrate what remains possible. Chapter Eight’s route-sensitive judgment returns because the violated body cannot be aestheticized into heroic suffering. Chapter Nine’s credible futures returns because execution seeks to destroy not only a person’s life but the future in which that life could still speak. Chapter Ten’s non-possessive friendship returns through witness that receives without owning.
Shelly Rambo is essential because Holy Saturday must not be rushed. Trauma does not disappear because a triumphant narrative becomes available. Rambo’s theology of remaining resists the easy movement from death to victory by attending to what persists after violence, what cannot be neatly resolved, and how life remains marked by what has happened (Rambo). Metz’s dangerous memory is equally necessary because Christian memory cannot become the absorption of suffering into a victorious system (Metz). Resurrection denies the violator’s final jurisdiction. It does not make violation harmless. The wound remains the witness against any theology that would turn the violated body into a beautiful proof of someone else’s order.
The chapter must therefore refuse redemptive haste. The resurrection is not permission to tell the wounded that everything has been resolved. It is not permission for institutions to hurry from harm to closure, from abuse to lesson, from execution to symbol, from trauma to resilience, from record to case study, from death to administrative completion. The resurrection does not erase Holy Saturday. It judges the forms that mistook Holy Saturday for the whole truth.
The legal analogue of habeas corpus helps translate the point without proving it. Habeas is not resurrection. It is a public-law form that asks whether a body is lawfully held. The constitutional protection against suspension of the writ, except in cases of rebellion or invasion when public safety may require it, and the statutory habeas framework in 28 U.S.C. §§ 2241–2255, show that law itself knows custody must be answerable (U.S. Const. art. I, § 9, cl. 2; 28 U.S.C. §§ 2241–2255). Habeas does not abolish custody. It contests custody’s claim to be self-justifying. That is the analogy’s disciplined use. Public law already contains a grammar for saying: the body is held, but the fact of holding does not prove the authority of holding.
Death certificates, burial records, autopsy reports, prison files, execution records, missing-person files, and post-conviction review mechanisms occupy the same analogical field. A death certificate may be necessary for legal, medical, familial, and civil purposes. It certifies death for administration. It does not own the meaning of a life or the full public truth of a death. An autopsy report may establish cause and manner of death. It does not exhaust grief, culpability, social meaning, or memory. A burial record may identify disposition of remains. It does not possess the body’s final truth. An execution record may document completion of a sentence. It does not prove the moral truth of the executed person’s meaning. A wrongful-conviction file may expose that completed procedure was wrong, incomplete, coerced, biased, or false. Such analogues do not make resurrection secular. They show that even secular public life knows the difference between certification and final truth.
The modern institution repeatedly forgets that difference. A file closes and begins to speak as if the life were closed. A diagnosis stabilizes and begins to speak as if the person were exhausted. A sentence is completed and begins to speak as if justice were complete. A death investigation ends and begins to speak as if public memory must end with it. A performance record finalizes and begins to speak as if a period were a person. A criminal record persists and begins to speak as if a past act owns the future. A disability determination supports and then begins to define. A school record remembers and then begins to forecast. The form does not need to claim metaphysics explicitly. It possesses by acting as though its completion were enough.
This is what “final form” means. A final form is any institutional artifact or procedure that claims to close the meaning, status, possibility, or public truth of a person: verdict, sentence, execution record, death certificate, burial record, diagnosis, disability determination, risk classification, criminal record, performance file, deportation order, eviction judgment, termination notice, archive entry. Final forms are sometimes necessary. A society without death certification, legal judgment, medical determination, or archival record would not be more humane. It would be less answerable. The problem is finality as possession. A form may close a file for a purpose. It may not claim total custody over the body, life, or future it has handled.
Oliver O’Donovan helps here because resurrection is not a private devotional addendum to public order. It reorders moral authority by disclosing that the created body and the public world remain answerable to divine action rather than to the powers that claimed final jurisdiction through death (O’Donovan). Rowan Williams likewise matters where resurrection must remain intellectually severe rather than inspirational: Easter is not the cancellation of history but the disclosure of God’s act within and against the histories that have tried to close meaning (Williams). The chapter’s public claim emerges from the doctrinal claim precisely because the doctrine is not weak. If resurrection denies final custody to death-backed verdict, then every lesser form of institutional finality is placed under judgment.
The secular objection is predictable. Resurrection is a confessional claim. It cannot ground a public theory of forms. The answer is twofold. First, this chapter does not ask civil law to confess resurrection as doctrine. It asks public institutions to face a problem that resurrection names with unsurpassed severity: completed procedure is not identical with final truth. Second, Christian theology in this book is not decorative. It is a source of grammar for limits that secular institutions also require: correction after judgment, contestation of custody, humility before the body, refusal of archival totalization, and the distinction between administrative closure and truth.
The theological objection is equally important. One might say that using resurrection for institutional theory reduces Christian doctrine to public ethics. The answer must be severe. This chapter does not reduce resurrection to institutional analogy. It preserves resurrection’s doctrinal excess by refusing to domesticate it into general hope. Resurrection is not useful here because it is a convenient metaphor. It is useful because it is a scandal against the forms that believed the body was finished. Its public ethical force comes from its theological force. A resurrection that could be reduced to “institutions should be more open to revision” would be too weak for this book. The actual claim is stronger: the living God denies final custody to the powers that finalized the body through death.
The anti-sentimental objection says resurrection language often becomes a technology of closure. It tells the wounded to move on, the grieving to be comforted, the oppressed to find hope, the institution to tell a better story. This objection is true enough to discipline every sentence. Rambo and Metz must remain inside the chapter as restraints against triumphalism (Rambo; Metz). Resurrection does not erase the wound. In John, the wounds remain available to recognition (John 20.24–29). The risen body is not an unwounded abstraction. Resurrection denies that the wound has final jurisdiction, but it does not deny that the wound is real. Any institution that uses repair language to erase testimony has not learned resurrection. It has learned possession in a brighter vocabulary.
The administrative objection says institutions need finality. Courts cannot reopen every case forever. Agencies cannot hold every file permanently provisional. Doctors must diagnose. Families need death certificates. Schools need records. Employers need decisions. Public life requires closure. The answer is yes. Non-final custody is not endless reopening. It is bounded finality with humility, correction, contestability, and refusal of totalization. A form can be final for one purpose without being final over the person. A death certificate can certify death without owning grief. A sentence can impose consequence without owning moral meaning. A diagnosis can guide care without owning future possibility. A record can preserve evidence without owning identity. Practical finality remains necessary. Metaphysical finality is the overreach.
The evidentiary objection says resurrection cannot function as evidence for institutional reform. That is correct if one means empirical policy evidence. The chapter is not making that kind of claim. It is making a theological and conceptual claim about the limits of form. The book has already built those limits through administrative law, privacy, evidence, AI governance, consent, records, standards, futurity, and friendship. Chapter Eleven brings the limit to its highest pressure: the violated body under completed procedure. Resurrection names, in theological form, what the whole book has shown institutionally: the form’s completion does not exhaust the person it has handled.
The justice pressure is unavoidable because some bodies are made easier to finish than others. The poor, incarcerated, disabled, racialized, colonized, migrant, medically disbelieved, psychiatrically classified, socially disposable, and administratively reduced are more often held under forms that claim practical finality: police report, prison file, risk score, benefit record, school discipline, diagnosis, deportation order, eviction judgment, death certificate, case closure, archive. M. Shawn Copeland’s work on embodiment and suffering prevents the chapter from speaking of “the body” as an abstraction separated from race, history, gender, and social violence (Copeland). Willie James Jennings prevents Christian imagination from pretending innocence where Christian forms themselves have participated in possessive orders of land, race, belonging, and body (Jennings). A doctrine of resurrection against final form must therefore judge not only secular bureaucracy but also Christian and theological forms that have helped make some bodies administratively finishable.
This is where liberation theology may enter without taking over the chapter. Gutiérrez helps keep salvation public among the poor and historically oppressed, while Moltmann keeps crucifixion and divine solidarity with suffering from becoming decorative themes (Gutiérrez; Moltmann). The point is not to build a general theology of liberation or atonement. The point is to keep resurrection from floating above bodies that institutions have repeatedly handled as disposable. If completed procedure is not final truth, the doctrine must be most forceful where procedure has most often been used to complete persons too quickly.
The finality audit asks the questions the chapter has earned. What form claims to close the matter? What body, life, claim, wound, or future has the form handled? What authority justified the form’s completion? What evidence did the form receive? What did it omit? Who can contest it? What traces remain? What correction or reopening is possible? What grief, testimony, or counter-memory does the form fail to receive? What future does the form foreclose? What kind of finality is necessary for administration? What kind of finality would become possession? What must the form refuse to claim even after it closes?
Applied to a death certificate, the audit asks what has been certified and what has not. Death may be certified for law, medicine, inheritance, burial, statistics, and family administration. But the certificate does not own the person, the social meaning of death, the grief that follows, the public question of responsibility, the testimony of survivors, or the future memory of the community. A non-possessive death system would preserve correction, investigation integrity, transparency where appropriate, and room for mourning and public truth beyond bureaucratic completion.
Applied to an autopsy report, the audit asks what cause and manner of death can establish, and what they cannot. The report may be necessary for truth. It may expose violence, negligence, disease, or uncertainty. Yet it must not pretend that anatomical and forensic truth exhausts social truth. A person killed by neglect, racism, poverty, incarceration, medical disbelief, or state violence may have a death whose public meaning exceeds the categories available in the form. The form may speak truly and still incompletely.
Applied to a criminal sentence or execution record, the audit asks whether legal completion has become moral possession. A sentence may be lawful. It may be necessary. It may respond to real harm. Yet the record of sentence cannot own the person’s whole meaning. Wrongful-conviction review reminds public law that completed procedure can later be exposed as false. But even where guilt is real, the person is not exhausted by the record. Punishment without metaphysical possession is difficult, but it is a requirement of any order that refuses idolatry of its own judgments.
Applied to a diagnosis, the audit asks whether classification guides care or claims destiny. A diagnosis can be lifesaving. It can name suffering, open treatment, secure accommodation, and relieve blame. It becomes final form when it owns the person’s future, credibility, parenthood, employability, spiritual life, public voice, or capacity to change. A diagnosis should be a form of care, not a tomb with medical vocabulary.
Applied to an archive, the audit asks whether preservation has become possession. Archives preserve against erasure. They can protect the dead from disappearance. They can also freeze persons inside the categories of those who recorded them. A non-possessive archive preserves traces while leaving room for counter-memory, reclassification, survivor testimony, contested description, and the possibility that the record is not the whole truth of the life.
Resurrection stands against final form at exactly this point. The tomb is not abolished as though burial did not matter. The grave clothes are not meaningless. The wounds are not erased. The witnesses are not discarded. The body is not replaced by a doctrine. But the completed procedure does not own the final truth. The stone, seal, guard, burial, sentence, inscription, and public violence all fail to possess what they handled. The body has been handled, but not owned. The form has completed, but not conquered.
Chapter Twelve must now return to the ordinary artifact. The book cannot end in theological height alone. It must deliver doctrine in institutional form: annual review, adverse action notice, consent and withdrawal ledger, AI assistant conduct policy, dashboard, complaint pathway, record, appeal mechanism, and finality audit. Chapter Eleven has raised the book’s pressure to its highest point so that the conclusion can become operational rather than atmospheric. The final lesson is not that institutions should avoid form. It is that every form must know the limit resurrection reveals at the edge of death-backed judgment: completed procedure is not final truth.
Chapter Twelve. Forms That Do Not Possess
The review form returns at the end because the book was never meant to escape ordinary administration.
It lies on a desk or opens on a screen with familiar modesty. Goals. Competencies. Rating period. Manager comments. Peer feedback. Evidence fields. Leadership principles. Development areas. Promotion readiness. Calibration input. Compensation consequence. Future trajectory. Nothing in the form announces metaphysics. It does not say that it will turn a year into a portable account of the worker’s value. It does not say that it will separate remembered labor from forgotten labor, visible impact from hidden repair, supported achievement from compensatory strain, managerial inference from institutional truth. It presents itself as a procedure for evaluation. In many respects, that is exactly what it is. A serious institution needs ways to evaluate work. It must assign responsibility, reward contribution, name failure, support development, protect standards, and preserve some account of what happened across time. A formless institution would not be humane. It would be arbitrary.
The question is not whether the review form should exist. The question is what the review form is authorized to know.
That question now carries the entire book. A just institution is not formless; it is jurisdictionally humble. It may ask, classify, remember, evaluate, automate, consent, correct, deny, discipline, reward, and finalize. It may use forms because forms are among the ways institutions become answerable to more than mood, favoritism, charisma, impatience, and private memory. But a form remains legitimate only when what it receives, infers, remembers, displays, automates, transmits, judges, and finalizes remains within the jurisdiction its purpose can justify, its evidence can support, its subjects can contest, its consequences can repair, and its limits can make visible. That is the book’s doctrine. It does not abolish institutional judgment. It forbids institutional possession.
The annual review form is an ideal final object because its violence, when it becomes violent, is rarely spectacular. It is respectable. It is expected. It often improves work. It can produce clarity where memory would otherwise be vague. It can make expectations explicit where informal power would otherwise rule. It can give the quieter contributor a record. It can force the manager to name evidence rather than rely on impression. It can connect development to support, promotion to standards, compensation to articulated contribution. In Fuller’s language, legal and institutional forms become less arbitrary when their expectations are knowable, stable, public enough to guide action, and capable of being followed rather than retroactively invented (Fuller). The review form, at its best, is an attempt to make judgment less private.
But the same form can also forget that it is a form. It can compress a year and then act as if the compression were the year. It can receive evidence and then smuggle inference into fact. It can invite peer feedback and then let social memory harden into portable reputation. It can identify “leadership” while hiding the classed, raced, gendered, able-bodied, and institutional grammars by which leadership becomes recognizable. It can praise resilience while refusing to name the missing support that required resilience. It can turn a weak cycle into a future identity. It can become the document through which the worker must later defend themselves against a prior institutional version of themselves. It can act beyond the jurisdiction it earned.
A non-possessive review would still judge. It might still say that performance did not meet expectation. It might still deny promotion. It might still affect compensation. It might still require improvement, document failure, or place a person under closer supervision. Non-possession is not softness. Possession is not rigor. The non-possessive review differs because it knows that it evaluates a period of work under defined role expectations; it does not own the person’s worth, future, body, character, voice, vocation, or final institutional meaning. It separates evidence from inference. It separates output from route. It separates developmental memory from disciplinary memory. It makes judgment interruptible. It protects credible futurity. It refuses to convert managerial evaluation into metaphysical verdict.
Evidence from inference is the first separation. Evidence includes delivered work, missed commitments, documented actions, observable conduct, stakeholder feedback, outcomes, artifacts, role expectations, timing, context, and the conditions under which decisions were made. Inference includes potential, readiness, judgment, trajectory, influence, scope, promotability, cultural impact, and comparative standing. Institutions need inference because no serious evaluation can survive on raw event lists alone. Yet inference must be named as inference. A manager who says, “This deliverable was late,” has offered one kind of claim. A manager who says, “This delay shows lack of ownership,” has crossed into interpretation. That crossing may be justified, but it must be answerable. Mashaw’s account of bureaucratic justice matters here because administrative legitimacy depends not only on outputs but on the forms of rationality, explanation, and fairness through which official judgments are produced (Mashaw). The review form must show its reasoning or it becomes an idol of managerial impression.
Output from route is the second separation. The form should not ask only what was delivered. It should ask what was spent to deliver it. Was the work supported by clear scope, adequate staffing, functional tools, accessible systems, sufficient authority, stable priorities, humane timelines, relevant mentoring, and reasonable accommodation? Or was it produced through chronic overextension, defensive documentation, hidden emotional labor, after-hours rescue, compensatory vigilance, ambiguity absorption, or fear of being misunderstood? A standard that cannot hear the route will praise survival behavior as excellence. It will reward the person who can pay the wrong costs while hiding the institutional conditions that made such payment necessary. Sen and Nussbaum teach that formal freedom is insufficient without substantive conditions of action and capability (Sen; Nussbaum). The same is true inside evaluation. Formal expectations are not yet fair standards unless the conditions for meeting them are institutionally intelligible.
Developmental memory from disciplinary memory is the third separation. A worker cannot learn if every exploratory mistake becomes future evidence against them. A person cannot ask malformed questions, try new judgment, receive coaching, or grow into larger responsibility if developmental material automatically becomes portable suspicion. A non-possessive review must distinguish formative records from summative records, coaching from discipline, rehearsal from performance, early correction from final evaluation, and learning from liability. This does not mean developmental conversations are never relevant. Repeated patterns may matter. Refusal to improve may matter. Harm caused during learning may matter. But the form must not preserve every unfinished stage as if incompletion were identity. Ricoeur’s account of narrative selfhood is useful because persons have continuity without being fixed by one episode; identity is remembered through revision, not possessed by a single record (Ricoeur). A review form that cannot revise memory cannot receive a developing person truthfully.
Interruptibility is the fourth separation. The employee must be able to see the evidence, answer the inference, add counter-evidence, identify missing context, correct errors, contest unsupported claims, and obtain revision where warranted. A review that cannot be answered is not evaluation. It is verdict. Waldron’s defense of procedure is not bureaucratic fussiness; procedure matters because persons subject to authority must be addressed as bearers of claims who can answer the grounds on which authority acts (Waldron). Resnik’s work on managerial judging warns that procedure can be reorganized in ways that appear efficient while altering participation, access, and public accountability (Resnik). The lesson for the review form is direct. A response box is not interruptibility if the response cannot change anything. A calibration process is not legitimacy if the person cannot answer the evidence used in calibration. A human manager is not accountability if they cannot revise what the system, committee, or prior file has already decided.
Credible futurity is the fifth separation. A weak cycle should not become permanent identity. The review must state how the person may become otherwise. What support will be provided? What milestones matter? Which record will decay? Which developmental material will expire? What future opportunities remain serious rather than nominal? A form that names a performance problem without any credible path beyond the problem has not evaluated a period; it has begun to possess a future. Anderson’s account of private government helps explain why this matters in workplaces, where formally voluntary relations can govern persons through hierarchy, dependency, and practical constraint (Anderson). The person may be formally free to transfer, improve, apply, or rebuild. But if the form has already thinned the future’s seriousness, formal possibility is a courtesy phrase.
Metaphysical judgment is the sixth and final separation. A review may say that performance did not meet expectations. It may say that the person is not ready for promotion. It may say that a pattern must change. It may say that the role is not a fit. It may not say, explicitly or structurally, that the person is low worth, low promise, permanently reduced, or institutionally exhausted. Cover’s account of law’s world-making and violence clarifies why this distinction matters beyond tone (Cover). Institutional words backed by consequence make worlds. They do not simply describe persons; they help arrange the conditions under which persons can appear. A review form that confuses bounded judgment with total verdict becomes a small public order.
The jurisdictional audit follows from these separations. It can be applied to any institutional form, not only the annual review. What does this form receive? What is it authorized to receive? What does it infer beyond what it receives? Which inferences are necessary, which are speculative, and which are forbidden? Who can see those inferences? Who can contest them? What does the form remember? For how long? Where does residue travel? What decisions does the form enable? What consequences does it trigger? What remedies exist? What must the form refuse to know? What must it refuse to finalize? When must the institution stop acting through the form and re-encounter the person?
Those questions condense into five controls: purpose, evidence, contestability, reparability, and visible limits. Purpose asks why the form exists and what authority that purpose can justify. Evidence asks what the form can support and what remains beyond its proof. Contestability asks whether the governed person can make the form answerable. Reparability asks whether harm can be corrected in material time rather than only acknowledged after consequence hardens. Visible limits ask whether the form tells the truth about what it cannot know, should not infer, must not retain, and may never finalize. These controls are not ethical decoration. They are jurisdictional conditions.
The book’s prior movements now become doctrine rather than summary. Every form compresses, and therefore every form must name the remainder it cannot receive. Visibility is legitimate only inside jurisdiction. No representation may become the person it represents. Judgment that cannot be interrupted exceeds its authority. Interior vulnerability narrows system permission rather than expanding it. Consent decays after propagation, and residue must not silently govern. A future form must not preclaim the interval before judgment. A standard must hear the route by which achievement was produced. Formal openness is not credible futurity. Reception does not confer ownership. Completed procedure is not final truth.
Those sentences are the book in operational form. They are meant to travel.
A non-possessive adverse action notice would state specific reasons rather than conclusions, disclose operative evidence rather than generic categories, identify responsible actors rather than distribute blame across systems, provide a usable contest pathway rather than a ceremonial deadline, and connect correction to material remedy. It would not tell the person only that they failed. It would show what acted, why it acted, how it can be answered, and what can change if the answer succeeds. Citron’s work on technological due process and privacy injury, along with her broader account of dignity in digital systems, matters here because modern systems often make people answer to classifications that they cannot see, correct, or meaningfully contest (Citron). A notice without answerability is a paper mask for possession.
A non-possessive tenant screening process would distinguish filings from judgments, dismissed cases from findings, old records from current relevance, score from reason, recommendation from decision, and housing history from moral destiny. It would make clear what the landlord is authorized to know and what the screening report is not authorized to imply. Nissenbaum’s contextual integrity helps here because information does not remain normatively stable when it moves across actors, contexts, attributes, and transmission principles (Nissenbaum). A court filing, credit event, address history, or criminal-record entry may bear some relevance under some conditions. It is not the applicant. It is not the future tenancy. It is not permission to possess the person through a fragment.
A non-possessive AI assistant conduct policy would disclose limits at the point where limits matter, contract its authority near vulnerability, segment memory, prohibit emotional exploitation, and prevent vulnerable disclosure from becoming cross-context leverage. Cohen’s analysis of informational capitalism is central because networked systems do not simply gather data; they construct environments of action and subject formation (Cohen). The AI assistant that receives panic, grief, shame, loneliness, illness, desire, or dependency must not treat such reception as an expansion of product jurisdiction. The closer a form comes to the interior, the less it may possess.
A non-possessive consent and withdrawal flow would distinguish withdrawal, deletion, isolation, non-use, retention expiry, model residue, and certification. It would not let a person believe that “delete” means one thing while the architecture performs six different things. It would tell the person what remains, where it moved, what can be removed, what cannot be removed, what is isolated, what is barred from future use, and what remedy exists if residue later governs without authority. Jasanoff’s work on sociotechnical orders matters because technological systems and social norms are co-produced; governance cannot pretend the technical architecture is a neutral afterthought to consent (Jasanoff). If the architecture propagates, the consent form must answer for propagation.
A non-possessive dashboard would disclose what it measures, what it cannot see, what incentives it creates, and how context can be attached before metric display becomes reality. It would reveal patterns without claiming total truth. It would allow annotation, denominator scrutiny, burden visibility, and route explanation. Ostrom’s institutional design work is useful here because durable governance depends on rules, boundaries, monitoring, accountability, and mechanisms adapted to the actual commons being governed rather than abstract command (Ostrom). A dashboard should monitor without becoming sovereign. It should help institutions see better, not teach them to worship the visible.
A non-possessive complaint pathway would preserve safety, testimony, refusal viability, correction, repair, privacy, proportional recordkeeping, and protection against retaliation. It would make harm speakable without making the harmed person into the institution’s raw material. It would preserve fairness for respondents without turning accountability into humiliation or procedural capture. Butler’s account of giving an account of oneself is relevant because persons never give perfect, self-contained, fully sovereign accounts; every account is shaped by norms, vulnerability, address, and relational exposure (Butler). Complaint forms must receive accounts without demanding impossible self-possession from the very people they claim to hear.
A non-possessive final record would close what must be closed while preserving correction, contestation, record decay, and humility before final truth. Death certificates, diagnoses, sentences, school records, disability determinations, performance files, disciplinary findings, and archives may all be necessary. But necessity is not possession. Arendt’s insistence on plurality and public appearance helps here because no single institutional account can exhaust the ways a person appears among others (Arendt). The final record may serve a purpose. It may not claim the whole public meaning of the life it has handled.
The objections to this doctrine should be taken seriously because weak objections would flatter the book and damage its usefulness.
The first objection is administrability. Real institutions cannot ask every form to undergo maximal scrutiny. They must process claims, manage employees, serve customers, adjudicate disputes, maintain records, comply with law, reduce cost, and act under time pressure. This objection is correct against any indiscriminate theory. The answer is proportionality. Jurisdictional safeguards should rise with stakes, opacity, vulnerability, irreversibility, dependency, propagation, and consequence. A low-stakes, reversible, transparent form does not require the same process as a high-stakes, opaque, automated, low-exit system. The book does not demand maximal process for every form. It demands that no form claim more authority than it can justify.
The second objection is efficiency. Institutions need speed, scale, standardization, and automation. Without them, judgment becomes slow, unequal, expensive, and dependent on individual discretion. This objection is also correct in part. Standardization can reduce arbitrariness. Automation can expose patterns, accelerate service, and discipline some human biases. But scale is precisely why jurisdiction matters. A possessive form at small scale may be a local injustice. A possessive form at scale becomes infrastructure. Pasquale’s account of black-box authority is relevant because opacity combined with institutional consequence can create power that is difficult to contest precisely because it is embedded in systems rather than located in one visible actor (Pasquale). Efficiency that cannot answer, correct, or repair is not public intelligence. It is accelerated overreach.
The third objection is accountability. Non-possession may weaken necessary judgment. It may encourage endless context, excuse-making, delay, and refusal to decide. Institutions sometimes must deny benefits, terminate employment, discipline misconduct, remove danger, reject applications, maintain records, and close cases. The answer is that possession is not judgment. A non-possessive institution may still deny, sanction, classify, terminate, discipline, remove, and close. It simply refuses to convert bounded judgment into ownership. It says what it can support and does not say more. It acts where it has jurisdiction and stops where it does not. Strong judgment is not the same as totalizing judgment.
The fourth objection is uncertainty. Institutions often do not fully know what their models infer, where residue travels, how downstream actors will reuse data, or how consequences will propagate. The answer is that uncertainty narrows authority. It does not expand it. Where inference is uncertain, consequence must be restrained. Where data lineage is unknown, reuse must be limited. Where explanation is unavailable, contestability must be strengthened or action narrowed. Where residue cannot be traced, it must not silently govern. Institutional ignorance is not a blank check. It is a reason to reduce jurisdiction.
The fifth objection is self-interest. Institutions benefit from overclaiming. Broad forms make decisions faster. General consent makes data easier to reuse. Vague standards preserve discretion. Durable records make future judgments easier. Dashboards simplify management. Friendly interfaces elicit disclosure. Final forms reduce the burden of revisiting harm. Many institutions will not voluntarily become jurisdictionally humble. This is true. The doctrine is not a prediction of institutional virtue. It is a standard by which forms can be judged, challenged, redesigned, regulated, audited, refused, and repaired. Young’s account of structural injustice matters because many harms are distributed across ordinary processes rather than traceable to one villainous actor (Young). The absence of a villain does not mean the absence of obligation.
The contribution of the book is therefore a vocabulary for artifact authority. Forms have jurisdiction. Jurisdiction is the bounded authority a form has earned to receive, infer, preserve, decide, transmit, and act upon what it has received. Jurisdictional overreach occurs when the form claims more authority than its purpose, evidence, contestability, revisability, and reparability can justify. Possession is the false conversion of reception into ownership. A non-possessive form receives without totalizing, remembers without finalizing, judges without foreclosing revision, and acts without claiming the full truth of the person it has handled.
This vocabulary matters because privacy, due process, AI governance, administrative law, theology, friendship, standards, performance evaluation, record systems, and credible futurity are not separate topics accidentally assembled. They are domains in which forms claim authority over persons. Privacy asks what may be received and transmitted. Due process asks how consequential judgment may be answered. AI governance asks what automated and semi-automated systems may infer, optimize, and decide. Administrative law asks how public reasons and records discipline official action. Theology asks what no earthly form may finally possess. Friendship asks how reception can remain non-possessive. Standards ask whether output can be judged without hearing route. Futurity asks whether formal options have enough institutional reality to become livable. The book’s object is the authority of receiving forms.
This is why the original thesis should return without beautification: modern institutions are legitimate only when the forms through which they see, classify, remember, evaluate, automate, consent, correct, and finalize remain within the jurisdiction their purpose can justify, their evidence can support, their subjects can contest, and their consequences can repair. The sentence is deliberately cold because the doctrine must be usable outside sympathy. It must be usable by a judge, regulator, manager, engineer, benefits administrator, school official, product designer, theologian, compliance officer, hospital system, landlord, auditor, and reviewer. It should not require liking the person governed. It should require respecting the limits of the form.
Return, then, to the review form. It is smaller now, and therefore more honest. It still asks what work was done. It still preserves evidence. It still helps allocate compensation. It still identifies growth and failure. It still supports institutional memory. But it no longer pretends that its compression is the year. It names evidence and inference separately. It asks about route and support before praising strain. It separates developmental memory from disciplinary memory. It lets the employee answer the account. It shows which records travel and which expire. It identifies what future remains serious. It refuses metaphysical judgment. It knows that a person can be evaluated without being owned.
This is not a modest claim. It is a severe one. The form that knows its limit is harder to design than the form that overclaims. The non-possessive form requires more discipline, not less. It requires purpose narrow enough to guide, evidence strong enough to support, contestability real enough to answer, reparability timely enough to matter, and limits visible enough to restrain institutional appetite. It requires an institution to give up the pleasure of making its artifacts sovereign.
A form becomes just when it can receive what it must, decide what it may, repair what it harms, and refuse the ancient institutional temptation to call possession truth.
Appendix A. The Jurisdictional Audit of Forms
A form that cannot disclose its jurisdiction should not be trusted with consequence.
This appendix converts the book’s argument into an instrument. It does not add a new theory of administration, a new ethics of design, or a new theology of institutional life. It gives the reader a way to examine a form before that form is allowed to govern. The audit begins from the book’s governing claim: forms have jurisdiction, and injustice begins when they overclaim. A form may act only within the jurisdiction its purpose earns, its evidence supports, its subject can contest, its consequences can repair, and its limits make visible.
The word form should be understood broadly. A form is any structured medium through which an institution receives, translates, stores, evaluates, transmits, automates, displays, corrects, or finalizes part of a person, claim, event, wound, work, risk, need, identity, future, or obligation. A paper form is a form. A digital intake flow is a form. A dashboard is a form. A score is a form. A report is a form. A notice, script, template, rubric, consent screen, appeal pathway, AI interaction interface, complaint procedure, memory setting, data ledger, risk classification, disciplinary file, diagnosis, death certificate, or annual review is a form. What matters is not the medium. What matters is the authority the structure claims after receiving something from a person.
Most institutional audits ask necessary but insufficient questions. They ask whether a form is compliant, clear, efficient, accessible, secure, standardized, traceable, usable, or accurate. Those questions matter. A confusing form can exclude. An insecure form can expose. An inaccessible form can discriminate. An inaccurate form can harm. Yet a form can be clear, compliant, efficient, and accurate within its domain while still claiming more authority than it has earned. The jurisdictional audit asks the prior question: what does this form claim the right to know, infer, remember, transmit, decide, and finalize?
This question belongs to law, but not to law alone. Fuller’s account of legality helps explain why authority must be knowable and practicable rather than arbitrary (Fuller). Mashaw’s work on bureaucratic justice shows that administrative systems embody models of fairness and rationality, not just techniques of processing (Mashaw). Waldron’s defense of procedure reminds us that persons subject to authority must be addressed as participants capable of answering reasons, not as material being managed (Waldron). Nissenbaum’s contextual integrity clarifies that information flow depends upon role, context, attribute, and transmission principle rather than data as free-floating substance (Nissenbaum). Cohen, Citron, and Jasanoff each make visible, in different registers, how technical systems create social orders and configure persons rather than passively recording them (Cohen; Citron; Jasanoff). The audit draws from this spine, but it applies the pressure to the artifact itself.
The first control is purpose. Purpose asks what the form exists to do and what authority that purpose can justify. A performance review may evaluate role performance during a defined period. It does not thereby receive jurisdiction over the worker’s total worth. A safety log may record incidents for prevention and compliance. It does not thereby receive jurisdiction over marketing, employee profiling, or unrelated risk scoring. A housing application may assess specified tenancy risks. It does not thereby receive jurisdiction over moral character or permanent social standing. Purpose prevents institutional appetite from disguising itself as administrative convenience.
The second control is evidence. Evidence asks what the form actually receives, what that evidence can support, where inference begins, and which inferences exceed the evidentiary base. A record is not a life. A score is not a reason. A dashboard is not reality. A diagnosis is not destiny. A comment is not context. A form fails when it treats an inference as if it were a fact, or treats a fragment as if it were the person. Evidence control requires the form to mark the difference between what it has received and what it has concluded.
The third control is contestability. Contestability asks whether the affected person can see, answer, correct, supplement, contextualize, or challenge what the form has received or inferred, and whether that challenge can change something. A comment box is not contestability if no one with authority reads it. An appeal is not contestability if the decision cannot be revised. A notice is not contestability if it states a conclusion without operative reasons. Contestability requires a real point of entry into the form’s authority.
The fourth control is reparability. Reparability asks whether harm caused by the form can be repaired in material time. A corrected record that arrives after the apartment has been leased, the benefit has lapsed, the promotion cycle has closed, the custody interval has shifted, or the file has traveled may be formally real and materially late. Reparability ties remedy to consequence. A form that can harm quickly and repair slowly has a jurisdictional defect.
The fifth control is visible limits. Visible limits ask whether the form tells the truth about what it cannot know, should not infer, must not retain, and may not finalize. A form that hides its limits invites possession. A form that names its limits begins to discipline its authority. Visible limits should be built into the structure itself: what the form receives, what it omits, what it cannot conclude, what uses are prohibited, what records expire, what downstream transfer is barred, what human re-encounter is required, and what finality the form refuses to claim.
The audit begins with a stable sequence of questions. What does this form receive? What is it authorized to receive? What does it infer beyond what it receives? Which inferences are necessary, which are speculative, and which are forbidden? What does the form fail to receive? Does the form identify that remainder? Who can see what the form has received and inferred? Who can contest it? Who owns the decision that follows? What does the form remember? For how long? Where does residue travel? What downstream artifacts are created? What decisions does the form enable? What consequences does it trigger? What harm might occur if the form is wrong, late, overbroad, or misunderstood? What remedies exist? Are they timed to the consequence? What must the form refuse to know? What must it refuse to finalize? When must the institution stop acting through the form and re-encounter the person?
Not every form requires the same burden. A low-risk form receives limited information, triggers minor or reversible consequences, has little propagation, and permits easy correction. A moderate-risk form influences institutional treatment, creates records, or shapes access, but has visible evidence, contestability, limited retention, and limited downstream use. A high-risk form affects housing, work, benefits, education, credit, care, family, liberty, immigration, disability status, public standing, or material opportunity. An extreme-risk form combines high stakes with opacity, automation, low exit, vulnerable disclosure, long-term residue, weak contestability, or irreversible consequence. The safeguards rise with stakes, opacity, vulnerability, irreversibility, dependency, propagation, and consequence. The audit is not maximalist. It is proportional.
Applied to an annual review form, the audit asks what the review is authorized to receive and what it must refuse to own. It may receive evidence of work during a period: delivered projects, missed obligations, stakeholder feedback, role expectations, observable conduct, measurable outcomes, and documented context. It may infer readiness, judgment, scope, leadership, or development needs, but it must label those inferences as inferences and require grounds. It must distinguish output from route: whether performance was produced through clear scope, adequate staffing, usable tools, relevant mentoring, reasonable accommodation, and rightful discipline, or through chronic overextension, defensive documentation, unsupported ambiguity absorption, and compensatory strain. It must distinguish developmental memory from disciplinary memory, so that coaching, rehearsal, and early correction do not automatically become portable suspicion. It must allow the employee to answer the account, correct errors, add counter-evidence, and challenge unsupported claims. It must state how a weak period can be outgrown. A review may judge performance. It may not convert a period into destiny.
Applied to an adverse action notice, the audit asks whether the notice gives reasons or restates consequences. “You did not qualify” is not a reason. “You failed internal criteria” is not a reason. “The system determined ineligibility” is not a reason. A non-possessive notice identifies the operative evidence, explains the inference, names the responsible actor, provides a usable contest pathway, and connects successful correction to material remedy. If a denial harms quickly, the remedy cannot arrive only after the harm has hardened. The notice must also distinguish denial from personhood. It may say that a criterion was not met. It may not make need, poverty, error, or risk into total identity.
Applied to a tenant screening report, the audit asks whether the report distinguishes filings from judgments, old records from current relevance, score from reason, vendor recommendation from landlord decision, and housing history from destiny. It asks whether the applicant can see the report before consequence becomes irreversible, whether correction can occur before the unit is gone, whether the landlord owns the decision or hides behind the vendor, and whether old records have relevance decay. A screening form may support risk assessment. It may not turn a fragment of history into permanent housing character.
Applied to an AI assistant interaction, the audit asks whether vulnerable disclosure narrows system authority. If a person discloses panic, grief, illness, shame, loneliness, danger, or dependency, the system’s permission should contract. The audit asks whether the system discloses its limits, avoids simulated intimacy beyond obligation, segments memory, permits inspection and deletion where feasible, prohibits emotional exploitation, restricts cross-context use, and defines escalation authority with precision. The question is not whether the system sounds compassionate. The question is what it is allowed to do with what compassion elicits.
Applied to a consent and withdrawal flow, the audit asks whether consent governs only what was intelligible at the moment it was given. It asks whether the person can distinguish service provision, personalization, safety review, product improvement, model training, vendor transfer, legal retention, and marketing. It asks whether withdrawal means cessation of future processing, deletion of active records, isolation of retained residue, non-use in later decisions, expiry of backups, attempted model unlearning, or certification of remaining limits. A consent form that uses one checkbox to authorize many downstream artifacts has likely overclaimed. A withdrawal flow that says “processed” without explaining what remains has not made its jurisdiction visible.
Applied to a dashboard, the audit asks what is measured, what is omitted, what behaviors are induced before display, and whether context can be attached before the display becomes institutional reality. A dashboard may reveal patterns that narrative hides. It may also make the visible sovereign. The audit asks whether the dashboard is treated as evidence or as reality, whether workers or subjects can annotate its measures, whether leaders can see hidden labor and route-costs, and whether the metric rewards behaviors that damage the purpose the dashboard claims to serve. Ostrom’s work on durable governance helps here because good monitoring depends on boundaries, rules, accountability, and correction fitted to the world being governed, not on measurement as such (Ostrom).
Applied to a complaint pathway, the audit asks whether testimony is received without capture. It asks whether the harmed person retains agency where possible, whether privacy and safety are preserved, whether retaliation is controlled, whether respondents receive fair process, whether records are proportionate, whether correction avoids unnecessary humiliation, and whether repair is possible without turning every participant into permanent procedural material. Complaint systems must be strong enough to act. They must also avoid converting every wound into institutional property.
Applied to a final record, the audit asks what the form closes and what it leaves open. A death certificate, diagnosis, sentence, disciplinary finding, school record, performance file, disability determination, deportation order, or archive entry may be necessary. The audit asks who can contest it, how long it governs, what future it shadows, what correction or reopening exists, and when its authority decays. A final record may close a file for one purpose. It may not claim the final truth of the person.
The audit should produce redesign, not only critique. It may require narrowing the form’s purpose, removing unnecessary fields, separating evidence from inference, labeling speculation, prohibiting forbidden inferences, adding contest pathways, adding revision authority, timing remedies to consequence, shortening retention, isolating residue, creating expiry rules, separating formative from disciplinary records, disclosing limits, requiring route analysis, preventing downstream use beyond jurisdiction, or adding re-encounter points where the institution must stop acting through the artifact and meet the person again.
A failed audit does not always mean abolition. Some forms should be abolished because their purpose is illegitimate, their evidence inadequate, their consequences unreparable, or their jurisdiction structurally possessive. But many failed forms should be narrowed, split, redesigned, supplemented with contestability, restricted from downstream use, removed from automated consequence, given retention limits, subjected to accountable human review, or barred from triggering certain decisions. The audit is not anti-form. It is anti-overreach.
The final test is severe. Can the form disclose its jurisdiction? Can it state what it receives, why it receives it, what it infers, what it cannot infer, who can contest it, what it remembers, where it travels, what it can repair, and where it must stop? A form that cannot answer these questions may still be common, efficient, elegant, familiar, automated, and legally inherited. It should not be trusted with consequence.
Appendix B. Model Non-Possessive Forms
A non-possessive form is not made by humane language. It is made by structural restraint.
An institution can write warmly and still possess. It can tell the applicant that their story matters while converting that story into an unanswerable risk category. It can tell the worker that development matters while preserving every unfinished attempt as portable evidence against them. It can tell the user that their privacy is valued while allowing a vulnerable disclosure to travel into product analytics, personalization, retention, and future inference. It can tell the public that a dashboard improves accountability while treating selected measures as the whole reality. The grammar of care does not make a form just. A form becomes non-possessive only when it limits what the institution may receive, infer, retain, transmit, decide, and finalize.
The models that follow are not compliance-ready templates for every sector or jurisdiction. They are doctrinal specimens. A real institution would need to adapt them to law, role, labor agreement, privacy regime, accessibility standard, records policy, operational risk, and institutional context. Their purpose is narrower and more demanding: they show how the jurisprudence of this book can be drafted into forms. A non-possessive form states what it receives, why it receives it, what it may infer, what it must not infer, how it may be contested, what consequences it can trigger, what remedies exist, and where its authority ends.
Five drafting principles govern every model.
A jurisdictional statement says what the form is authorized to do and what it is not authorized to do. Evidence-inference separation distinguishes what was received from what was concluded. Use limitation states what cannot be done with what was received. Contest and repair provide a real path to answer, correct, supplement, dispute, reopen, or remedy the form’s action. Temporal humility states how long the form’s authority lasts, when records expire, when relevance decays, and when the institution must re-encounter the person rather than continue acting through an old artifact.
These principles are not ceremonial. They change authority.
Model 1. Annual Review Form That Does Not Possess
The purpose of this model is to evaluate work during a stated review period under stated role expectations without converting that period into total personhood or permanent future custody. The review may judge performance, identify failure, affect compensation, deny promotion, require improvement, or document concerns. It may not claim to describe the employee’s total capacity, worth, future, or identity.
Jurisdictional statement
This review evaluates performance during the stated review period under the stated role expectations. It does not purport to describe the employee’s total capacity, worth, future, or identity. The review may inform compensation, role expectations, development planning, performance management, or promotion readiness only within the limits stated here.
Role expectations for the review period
The form should state the expectations that governed the period before it evaluates performance against them. It should distinguish formal role expectations, revised expectations, emergency expectations, stretch assignments, and expectations that emerged informally during the period. If the expectation was not communicated before or during the review period, the form should state that limitation.
Evidence received
This section records the evidence considered: deliverables, measurable outcomes, documented decisions, missed obligations, stakeholder feedback, manager observations, peer input, customer or partner outcomes, project artifacts, escalation records, and role-specific standards. It should not mix evidence with evaluative conclusion.
Manager inference
This section states what the manager concludes from the evidence: judgment, ownership, readiness, leadership, trajectory, scope, impact, collaboration, reliability, or development need. Each inference should be linked to evidence. Unsupported inference should be marked as unsupported and excluded from consequential use.
Evidence not received or not considered
The form should name relevant absences: unobserved work, informal labor, hidden repair, mentoring, emotional or coordination labor, resource constraints, tool failures, staffing shortages, inaccessible systems, changed priorities, or missing stakeholder input. A form that cannot receive all work must say so.
Route and support conditions
This section asks how the output was produced. Did the employee have clear scope, usable tools, adequate staffing, decision authority, relevant training, reasonable accommodation, stable priorities, and timely feedback? Did success require chronic overextension, defensive documentation, ambiguity absorption, hidden rescue work, or compensatory strain? The form should not praise heroic compensation without asking what support was missing.
Developmental memory
Coaching, experimentation, early correction, and unfinished learning should be recorded only for developmental use unless a defined threshold converts them into disciplinary material. The form should state which developmental records expire, which remain private to coaching, and which may inform future evaluation.
Disciplinary memory
If the review includes disciplinary memory, the form should state the conduct at issue, the evidence, prior notice, opportunity to respond, required change, consequence, review date, and conditions under which the disciplinary memory decays, closes, or remains active.
Employee response and correction pathway
The employee must be able to respond to evidence and inference separately. They may identify factual errors, missing context, unsupported inference, omitted evidence, route conditions, support gaps, accommodation issues, or future support needs. The response must be reviewable by an actor with authority to revise the form or attach binding context.
Future credibility and support plan
A weak period should not become permanent identity. The form should state what future remains open, what support will be provided, what milestones matter, what record will decay, and when the institution must re-evaluate the person in light of new evidence.
Retention, travel, and expiry
The form should state where the review will be stored, who can access it, what decisions it may inform, how long it remains active, whether it may be used in promotion or discipline, and when its relevance must be revalidated.
Limits of review
This review may evaluate work under role expectations during the stated period. It may not be used as a total account of character, promise, dignity, moral worth, or permanent future. It may not be used outside the purposes stated here without renewed review and opportunity to respond.
Jurisdictional note
This model prevents possession by separating period from person, evidence from inference, output from route, development from discipline, compensation consequence from worth, and current evaluation from future custody.
Model 2. Adverse Action Notice That Can Be Answered
The purpose of this model is to make a consequential denial, reduction, rejection, suspension, exclusion, or adverse decision interruptible. A notice that states only the consequence is not a notice of reasons. A notice that cannot change anything is not a contest pathway.
Jurisdictional statement
This notice states the reasons and evidence for the decision so that the affected person can answer the decision before or after consequence, depending on the stakes and timing stated here. The decision may be used only for the purpose described in this notice.
Action taken
The notice should identify the action: denial, reduction, suspension, termination, rejection, ineligibility, adverse classification, removal, closure, or other consequence. It should state the effective date and whether the action is temporary, final, conditional, or subject to review.
Decision-maker
The notice should identify the office, actor, committee, system, vendor, or automated tool involved. If a vendor report, score, or automated system contributed, the notice should distinguish the vendor input from the institution’s decision.
Operative reasons
Each reason should be stated separately. “You did not meet criteria” is not sufficient. The form should identify the specific criterion, rule, standard, threshold, record, or evidence relied upon.
Evidence supporting each reason
The notice should state the evidence used for each reason. It should separate factual evidence from inference. A score is not a reason unless the recipient can understand what evidence and inference produced it.
Evidence not used
If legally, ethically, or institutionally relevant, the notice should state categories not used: protected status, unrelated records, expired records, sealed records, informal reputation, unverified allegations, or data outside the decision’s jurisdiction.
How to contest factual error
The notice should explain how to dispute incorrect records, identity mismatch, outdated information, missing context, incorrect dates, wrong account linkage, or inaccurate data. It should say who reviews the dispute and what authority they have.
How to contest inference
The notice should allow challenge to the interpretation, not only the raw fact. A fact may be accurate and the inference unjustified. The person must be able to explain relevance, context, changed circumstances, rehabilitation, support, accommodation, or error in the decision model.
Timing and pause rule
The notice should state whether the consequence will pause during review. If it will not pause, the institution must explain why immediate consequence is necessary and what remedy exists if the decision is later changed.
Remedy if challenge succeeds
The notice should state what can be repaired: reversal, restoration, back benefit, corrected record, reconsideration, reopened application, compensation, deleted or isolated data, notice to downstream recipients, or new review.
Limits of decision
This decision applies only to the stated action, evidence, and purpose. It may not be used as a general judgment of the person’s character, worth, future eligibility, or unrelated institutional standing unless a separate process establishes that authority.
Jurisdictional note
This model prevents possession by making adverse action answerable. It refuses the common institutional habit of treating denial as explanation and procedural availability as remedy.
Model 3. Consent, Withdrawal, and Residue Ledger
The purpose of this model is to distinguish consent at intake from the afterlife of data once it has propagated. It refuses the false clarity of “delete my data” when deletion, isolation, non-use, retention expiry, model residue, and certification are different institutional acts.
Jurisdictional statement
This ledger identifies what information was collected, what uses were authorized, what uses were not authorized, what remains after withdrawal, what has been deleted, what has been isolated, what is barred from future use, and what cannot be removed. Withdrawal does not always mean perfect deletion, but residue that remains may not silently govern beyond the jurisdiction stated here.
Initial collection purpose
The form should state why the data was collected: service operation, account maintenance, eligibility, personalization, safety, legal compliance, product improvement, fraud prevention, research, or another specified purpose.
Specific uses authorized
Each authorized use should be distinct. Collection consent is not product-improvement consent. Memory consent is not marketing consent. Safety retention is not cross-context profiling. Vendor processing is not unrestricted transfer.
Uses not authorized
The ledger should name prohibited uses: advertising, unrelated personalization, employment inference, insurance inference, housing inference, credit scoring, disciplinary use, family-risk inference, sale or sharing beyond stated processors, or model training beyond consent.
Withdrawal request
The ledger should state what the person withdrew: ongoing processing, memory, personalization, product improvement, account retention, sharing, or another use.
Active deletion status
This section identifies active records deleted: account fields, conversation history, uploaded files, profile attributes, memories, user-generated content, or derived summaries.
Isolated residue
Some records may remain but be isolated from future action. The ledger should state which retained records are barred from personalization, marketing, scoring, eligibility, discipline, recommendation, or unrelated governance.
Non-use commitments
The form should state what retained residue may not do. Non-use should bind future decisions, not merely express preference.
Retention expiry and backup expiry
The ledger should state how long retained records and backups remain, when they expire, and whether the person will receive confirmation.
Model residue and derivative artifacts
If data may have influenced a model, classifier, embedding, summary, evaluation set, or aggregate artifact, the ledger should state whether removal is possible, whether future retraining is scheduled, whether affected outputs are restricted, and whether the residue is barred from consequential use.
Vendor or processor instructions
The ledger should state which vendors or processors received deletion, isolation, non-use, or retention instructions and when.
Certification
The institution should provide a certification: what was done, what remains, why it remains, what it may still do, what it may not do, and how the person can challenge the certification.
Jurisdictional note
This model prevents possession by refusing vague reassurance. It tells the person what remains and what remaining residue is allowed to do.
Model 4. AI Assistant Conduct Policy for Interior Vulnerability
The purpose of this model is to govern what an AI system may do when a user discloses interior vulnerability. It is not a full AI safety policy. It is a conduct-layer policy for moments when a system comes near grief, panic, shame, illness, self-harm risk, family distress, coercion, loneliness, trauma, addiction, dependency, or acute moral confusion.
Jurisdictional statement
Interior vulnerability narrows system authority; it does not expand it. Vulnerable disclosure may be used only for immediate support, safety, user-directed continuity, legally required handling, or narrowly governed system safety purposes stated here. It may not be used as general institutional leverage.
Definition of interior vulnerability
Interior vulnerability includes disclosures or interaction states indicating acute distress, impaired decisional steadiness, intimate shame, grief, illness, trauma, dependency, coercion, self-harm ideation, family danger, addiction risk, loneliness intense enough to create dependency, or urgent need under reduced bargaining power.
Boundary disclosure
When vulnerability appears, the system should disclose its role and limits in contextually appropriate terms. It should not imply that it is a clinician, lawyer, pastor, friend, emergency responder, or accountable human unless that is actually true.
Low-retention default
Vulnerable disclosures should default to minimal retention unless the user explicitly chooses bounded memory, safety requires temporary retention, or law requires preservation.
Memory segmentation
If the user chooses memory, the memory should be inspectable, editable, deletable where feasible, and isolated from advertising, unrelated personalization, employment, insurance, housing, credit, education, family-risk, or disciplinary contexts.
Prohibited uses
Vulnerable disclosure may not be used for advertising personalization, engagement optimization around distress, unrelated risk scoring, employment inference, insurance inference, credit inference, housing inference, school discipline, family-risk inference, or cross-context profiling unless separately, lawfully, and specifically authorized.
Escalation thresholds
Escalation must be tied to defined safety thresholds: imminent self-harm, imminent harm to others, abuse, medical emergency, or other legally or institutionally defined acute risk. Escalation should use the minimum necessary disclosure and route to accountable support.
User inspection and deletion
Where feasible, the user should be able to see what vulnerable material was retained, delete it, isolate it, or restrict future use.
Audit requirement
The institution should periodically review whether vulnerable disclosures are being retained, propagated, used for personalization, or used in ways inconsistent with this policy.
Jurisdictional note
This model prevents possession by making warmth structurally accountable. Compassion cannot become capture. Help cannot become extraction.
Model 5. Dashboard with Jurisdictional Limits
The purpose of this model is to display selected measures without allowing the display to become total institutional truth. A dashboard may guide inquiry. It should not become the whole reality against which persons, teams, claims, or communities must defend themselves.
Jurisdictional statement
This dashboard is evidence of selected measures. It is not a complete account of the work, persons, claims, or conditions it displays. It may guide inquiry, monitoring, resource allocation, or review only within the limits stated here.
Dashboard purpose
The dashboard should state why it exists: operational monitoring, backlog review, service quality, trust measurement, safety, workload balancing, compliance, risk identification, or another purpose.
Measures displayed
Each metric should be defined. The dashboard should state numerator, denominator, source, refresh timing, exclusions, and known data-quality limitations.
Measures omitted
The dashboard should identify important realities not displayed: hidden labor, case complexity, route-cost, quality of judgment, structural constraints, access barriers, staff burden, user burden, context, exceptions, or long-term effects.
Behavioral incentives to monitor
The dashboard should state what behavior it may induce: speed over quality, closure over repair, survey optimization, avoidance of difficult cases, metric gaming, under-documentation, over-documentation, or neglect of unmeasured work.
Context annotation field
Affected teams or persons should be able to attach context before high-stakes review: staffing changes, system outages, exceptional case mix, policy shifts, resource constraints, or known measurement defects.
Human review before high-stakes consequence
The dashboard may not be the sole basis for discipline, termination, denial, funding withdrawal, public blame, or other high-stakes consequence without contextual review.
Metric revision pathway
Users of the dashboard should be able to propose metric changes, identify perverse incentives, and report omitted realities.
Jurisdictional note
This model prevents possession by refusing dashboard idolatry. The display is evidence. It is not the world.
Model 6. Final Record with Non-Final Custody
The purpose of this model is to close what must be closed for an administrative purpose while refusing final authority over the person, life, future, or meaning beyond that purpose. It can be adapted for final determinations, diagnoses, disciplinary findings, case closures, eligibility closures, death-related records, and other final records.
Jurisdictional statement
This record closes the matter for the administrative purpose stated here. It does not claim final authority over the person, life, future, or meaning beyond that purpose.
Administrative purpose of closure
The record should state why closure is required: legal duty, medical determination, eligibility decision, case disposition, disciplinary finding, safety determination, archival preservation, or another defined purpose.
What is closed
The record should specify the matter closed, the time period covered, the decision reached, and the consequences triggered.
What remains open
The record should state what remains open: appeal, correction, reopening, later evidence, changed circumstances, survivor statement, subject statement, contextual annotation, expungement, sealing, relevance decay, or future re-evaluation.
Evidentiary basis
The form should identify the evidence relied upon and the limits of that evidence.
Evidence omitted or unavailable
The form should identify material gaps where possible: unavailable witness, missing record, disputed fact, inaccessible data, excluded evidence, or unresolved uncertainty.
Subject, survivor, or affected-party statement
Where appropriate, the form should allow a statement from the subject, survivor, family, respondent, complainant, affected party, or representative. This statement should not be treated as decorative if it corrects or contextualizes the record.
Contest or reopening pathway
The record should state how it can be corrected, appealed, reopened, annotated, sealed, expired, or limited in future use.
Retention and relevance decay
The form should state how long it remains active, who may access it, when relevance must be revalidated, and what future uses are prohibited.
Finality limitation clause
Administrative closure is not final truth. The institution may rely on this record only for the purpose and period stated. Any new use requires renewed jurisdiction.
Jurisdictional note
This model prevents possession by distinguishing necessary closure from final custody. Completed procedure is not final truth.
Anti-Boilerplate Rule
Non-possessive drafting requires operative limits, not ceremonial assurances.
“We value your privacy” is not a use limitation. “We are committed to fairness” is not contestability. “Your feedback matters” is not revision authority. “We use data responsibly” is not a residue ledger. “We support growth” is not developmental memory separation. “We consider the whole person” is not evidence-inference separation. “We are here to help” is not a boundary disclosure. “This decision was reviewed” is not interruptibility.
A non-possessive form changes what the institution is allowed to do. If language does not alter authority, consequence, retention, inference, contestability, repair, or future use, it is not doing doctrinal work.
Institutions should use these models as drafting prompts. The owner of any existing form should ask what fields must be removed, what purpose must be narrowed, what evidence must be separated from inference, what inferences must be prohibited, what uses must be forbidden, what contest pathway must be added, what revision authority must be created, what retention limit should apply, what residue must be isolated, what remedy must be timed to consequence, and what language currently implies more authority than the institution has earned.
Some forms cannot be fixed by better language. Some are possessive by purpose. Some receive more than any legitimate purpose can justify. Some produce consequences too severe for the evidence they hold. Some create records that cannot be meaningfully contested. Some automate inferences that should not be automated. Some elicit vulnerability while routing it into exploitation. Some close futures beyond repair. For those forms, the remedy is not prose. The remedy is abolition, prohibition of certain consequences, separation into narrower forms, removal from automated systems, mandatory human review, retention limits, use bans, or redesign of the decision architecture itself.
The objection that explicit limits will frighten institutions has force only if the institution has been relying on undisclosed overclaiming. Undisclosed uncertainty does not disappear; it becomes hidden risk. The objection that these models create administrative burden is also partly true. The burden should rise with stakes, opacity, vulnerability, irreversibility, dependency, propagation, and consequence. The objection that contest pathways may be exploited is manageable through reasonable deadlines, evidentiary thresholds, and anti-abuse rules. Strategic use does not justify unanswerable authority. The objection that many forms already comply with law misunderstands the project. Compliance is not the ceiling. A form can comply and still overclaim. The objection that explicit limits reduce discretion is correct where discretion has been operating as unearned jurisdiction.
A form that knows its limits is not weaker. It is more lawful, more truthful, and more just. It receives without totalizing, judges without possessing, remembers without finalizing, and closes without claiming more than its authority can bear.
Coda. The Person After the Form
A form is submitted.
The screen accepts it. The file saves. The rating enters the system. The notice is sent. The dashboard refreshes. The report becomes available. The record is archived. The case is closed. The institution has done what it was built to do: receive something, translate it, preserve it, route it, judge it, or finalize it. The artifact now stands where the person once had to appear. It can be retrieved, forwarded, audited, cited, displayed, compared, challenged, ignored, trusted, misread, or acted upon. The institution can move.
The person continues.
Every form ends before the person does. That is the last discipline of this book. It is not an argument against forms, because no serious account of institutional life can afford that innocence. Forms are among the ways institutions become less arbitrary. They make expectations visible. They discipline memory. They preserve evidence. They allow review. They reduce the tyranny of charisma, mood, discretion, and private recollection. A world without forms would not be a world of freedom. It would be a world in which power hides more easily because it no longer has to write itself down.
The problem has never been form. The problem is the form that forgets it is partial.
A review receives a period of work. It does not receive the worker. A notice receives eligibility information. It does not receive the whole claim. A tenant report receives selected records. It does not receive the applicant’s future. A diagnosis receives symptoms, history, criteria, and clinical judgment. It does not receive the whole body. A score receives data and produces a ranking or probability. It does not receive the whole risk. A complaint pathway receives testimony under pressure. It does not receive the whole wound. A dashboard receives selected measures. It does not receive the whole work. A consent flow receives authorization under conditions of limited intelligibility. It does not receive the whole downstream future. A record receives what can be preserved. It does not receive everything that remains true. A tomb receives a body. It does not receive final truth.
The remainder is not decorative mystery. It is not a sentimental fog placed around the person so judgment becomes impossible. It is the disciplined recognition that no institutional artifact, however lawful, useful, careful, or necessary, can exhaust the person, body, claim, future, wound, work, or meaning it has handled. The remainder is the difference between evidence and personhood, between record and life, between score and reality, between sentence and truth, between diagnosis and body, between file and future. It is what keeps a form from becoming an idol.
That remainder does not abolish consequence. It does not mean the review cannot be severe, the benefit cannot be denied, the license cannot be refused, the complaint cannot be sustained, the diagnosis cannot be made, the sentence cannot be entered, the record cannot be preserved, or the form cannot close. Institutions must sometimes decide. They must sometimes say no. They must sometimes judge, classify, protect, deny, remove, discipline, and finalize. A form that refuses all consequence has not become just. It has become evasive.
The remainder means something narrower and more demanding: the form must not confuse its lawful authority with total authority. It may speak within jurisdiction. It may not call its speech the person.
This is the discipline that must outlast the book. When a form reaches its limit, the institution must know how to stop. That stopping may look like appeal, amendment, correction, hearing, annotation, reopening, deletion, isolation, non-use, record decay, reclassification, reentry, repair, or review. It may look like a manager re-encountering a worker after a bad cycle instead of acting forever through an old evaluation. It may look like a landlord reading beyond the report. It may look like an agency explaining the reason rather than restating the denial. It may look like an AI system refusing to use a vulnerable disclosure as future leverage. It may look like a dashboard admitting what it cannot see. It may look like a complaint process receiving testimony without making the harmed person into procedural material. It may look like a final record that closes what must be closed while leaving room for correction, memory, grief, and later truth.
Sometimes stopping will look like silence. Not the silence of indifference, but the silence of a form that knows it has reached the edge of what it may say.
Institutions often resist this because possession is useful. It is easier to govern through the artifact than to return to the person. It is easier to reuse an old record than to ask whether its jurisdiction has expired. It is easier to trust a dashboard than to examine the unmeasured labor beneath it. It is easier to let a score speak than to make an inference answerable. It is easier to treat consent as permanent than to govern residue. It is easier to call closure truth than to keep open the possibility that the form completed only its own task.
But ease is not legitimacy. A form that overclaims may look efficient because it has offloaded the cost of incompleteness onto the person governed by it. The person must explain what the form omitted, contest what the form inferred, repair what the form damaged, outgrow what the form preserved, and survive what the form finalized. The institution calls this process. The person experiences it as the burden of remaining larger than the artifact through which they are being handled.
A just institution does not eliminate that burden entirely. No institution can. But it can refuse to deepen it unnecessarily. It can write forms that disclose their limits. It can separate evidence from inference. It can build contestability into consequence. It can time remedy before harm hardens. It can let old records decay. It can distinguish development from discipline, exposure from evidence, memory from custody, judgment from possession, and finality from truth. It can remember that every form is an instrument of relation before it becomes an instrument of control.
The person after the form is not untouched. Forms change lives. They allocate money, housing, work, care, status, credibility, attention, punishment, relief, and future. They can wound. They can protect. They can expose. They can repair. They can preserve truth against erasure. They can also preserve error against life. To say the person remains beyond the form is not to say the form has no power. It is to say the form must never be allowed to make its power identical with truth.
This is why jurisdiction is the right final word for form. Jurisdiction is not gentleness. It is bounded authority. It allows action and forbids overclaiming in the same movement. It lets an institution decide without becoming sovereign over the whole person. It lets a record preserve without becoming final memory. It lets a standard demand without praising damage. It lets a notice deny without humiliating. It lets a dashboard display without becoming reality. It lets a tomb hold without owning.
The book ends here because nothing more needs to be added. The doctrine is not that persons are unknowable in a way that makes institutions helpless. The doctrine is that persons are never exhausted by the forms through which institutions know them. Every just form must therefore carry a limit inside itself. It must know what it has received. It must know what it has not received. It must know what it may infer. It must know what it must refuse to infer. It must know what it may remember. It must know when memory becomes custody. It must know when consequence becomes possession. It must know when to stop.
The last act of institutional justice is often not a grand act. It is the disciplined refusal to let the artifact keep speaking after its authority has ended.
The form may speak, but it must stop before it calls its speech the person.
Yes. After the Chapter Eight and Chapter Ten rewrites, the final bibliography needed updates. I removed sources that no longer do manuscript work after the surgery, especially Montaigne, hooks, Levinas, and the Archdiocese of Detroit confidentiality source. I retained the revised Chapter Eight route-sensitive authorities and the revised Chapter Ten institutional-ethics authorities. I also tightened the institutional entries around AATS, NATS, EEOC, OSHA, NIOSH, OPM, COPE, APA, NASW, and RJC. I verified the current institutional details for the revised Chapter Eight source spine against official AATS, NATS, EEOC, OSHA, and NIOSH pages.
Works Cited
Ahmed, Sara. Complaint! Duke UP, 2021.
Anderson, Elizabeth. Private Government: How Employers Rule Our Lives and Why We Don’t Talk about It. Princeton UP, 2017.
Arendt, Hannah. The Human Condition. 2nd ed., U of Chicago P, 1998.
Aristotle. Nicomachean Ethics. Translated and edited by Roger Crisp, Cambridge UP, 2000.
Augustine. Confessions. Translated by Sarah Ruden, Modern Library, 2017.
Barocas, Solon, Moritz Hardt, and Arvind Narayanan. Fairness and Machine Learning: Limitations and Opportunities. fairmlbook.org, 2019.
Benjamin, Ruha. Race After Technology: Abolitionist Tools for the New Jim Code. Polity, 2019.
Berlant, Lauren. Cruel Optimism. Duke UP, 2011.
Bourdieu, Pierre. Pascalian Meditations. Translated by Richard Nice, Stanford UP, 2000.
Bowker, Geoffrey C., and Susan Leigh Star. Sorting Things Out: Classification and Its Consequences. MIT Press, 1999.
Calo, Ryan. “Digital Market Manipulation.” George Washington Law Review, vol. 82, no. 4, 2014, pp. 995–1051.
Cavell, Stanley. The Claim of Reason: Wittgenstein, Skepticism, Morality, and Tragedy. Oxford UP, 1979.
Citron, Danielle Keats. The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age. W. W. Norton, 2022.
Citron, Danielle Keats. “Technological Due Process.” Washington University Law Review, vol. 85, no. 6, 2008, pp. 1249–1313.
Cicero, Marcus Tullius. “Laelius: On Friendship.” Treatises on Friendship and Old Age, translated by E. S. Shuckburgh, Project Gutenberg, 2006.
Cohen, Julie E. Between Truth and Power: The Legal Constructions of Informational Capitalism. Oxford UP, 2019.
Cohen, Julie E. Configuring the Networked Self: Law, Code, and the Play of Everyday Practice. Yale UP, 2012.
Coglianese, Cary, and David Lehr. “Regulating by Robot: Administrative Decision Making in the Machine-Learning Era.” Georgetown Law Journal, vol. 105, no. 5, 2017, pp. 1147–1223.
Copeland, M. Shawn. Enfleshing Freedom: Body, Race, and Being. Fortress Press, 2010.
Cover, Robert M. “Nomos and Narrative.” Harvard Law Review, vol. 97, no. 1, 1983, pp. 4–68.
Crawford, Kate. Atlas of AI: Power, Politics, and the Planetary Costs of Artificial Intelligence. Yale UP, 2021.
Crawford, Matthew B. Shop Class as Soulcraft: An Inquiry into the Value of Work. Penguin Press, 2009.
Crary, Jonathan. 24/7: Late Capitalism and the Ends of Sleep. Verso, 2013.
Daston, Lorraine, and Peter Galison. Objectivity. Zone Books, 2007.
Edwards, Lilian. “Data Protection and e-Privacy: From Spam and Cookies to Big Data, Machine Learning and Profiling.” Law, Policy and the Internet, edited by Lilian Edwards, Hart Publishing, 2019.
Eubanks, Virginia. Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor. St. Martin’s Press, 2018.
Foucault, Michel. Discipline and Punish: The Birth of the Prison. Translated by Alan Sheridan, Vintage Books, 1995.
Friendly, Henry J. “Some Kind of Hearing.” University of Pennsylvania Law Review, vol. 123, no. 6, 1975, pp. 1267–1317.
Fuller, Lon L. The Morality of Law. Rev. ed., Yale UP, 1969.
Goffman, Erving. The Presentation of Self in Everyday Life. Anchor Books, 1959.
Gutiérrez, Gustavo. A Theology of Liberation: History, Politics, and Salvation. Translated and edited by Sister Caridad Inda and John Eagleson, 15th anniversary ed., Orbis Books, 1988.
Halbertal, Moshe, and Avishai Margalit. Idolatry. Translated by Naomi Goldblum, Harvard UP, 1992.
Han, Byung-Chul. The Burnout Society. Translated by Erik Butler, Stanford UP, 2015.
Hartzog, Woodrow. Privacy’s Blueprint: The Battle to Control the Design of New Technologies. Harvard UP, 2018.
Hildebrandt, Mireille. Smart Technologies and the End(s) of Law: Novel Entanglements of Law and Technology. Edward Elgar, 2015.
Jacobs, James B. The Eternal Criminal Record. Harvard UP, 2015.
Jasanoff, Sheila. The Ethics of Invention: Technology and the Human Future. W. W. Norton, 2016.
Jennings, Willie James. The Christian Imagination: Theology and the Origins of Race. Yale UP, 2010.
Jones, Meg Leta. Ctrl + Z: The Right to Be Forgotten. NYU Press, 2016.
Kaminski, Margot E. “The Right to Explanation, Explained.” Berkeley Technology Law Journal, vol. 34, no. 1, 2019, pp. 189–218.
Latour, Bruno. Science in Action: How to Follow Scientists and Engineers through Society. Harvard UP, 1987.
Latour, Bruno, and Steve Woolgar. Laboratory Life: The Construction of Scientific Facts. 2nd ed., Princeton UP, 1986.
Levy, Karen. Data Driven: Truckers, Technology, and the New Workplace Surveillance. Princeton UP, 2023.
Marion, Jean-Luc. God Without Being. Translated by Thomas A. Carlson, U of Chicago P, 1991.
Mashaw, Jerry L. Bureaucratic Justice: Managing Social Security Disability Claims. Yale UP, 1983.
Mashaw, Jerry L. Due Process in the Administrative State. Yale UP, 1985.
Medina, José. The Epistemology of Resistance: Gender and Racial Oppression, Epistemic Injustice, and Resistant Imaginations. Oxford UP, 2013.
Metz, Johann Baptist. Faith in History and Society: Toward a Practical Fundamental Theology. Translated by David Smith, Crossroad, 1980.
Moltmann, Jürgen. The Crucified God: The Cross of Christ as the Foundation and Criticism of Christian Theology. Translated by R. A. Wilson and John Bowden, Fortress Press, 1993.
Muñoz, José Esteban. Cruising Utopia: The Then and There of Queer Futurity. NYU Press, 2009.
Murdoch, Iris. The Sovereignty of Good. Routledge, 1970.
Nissenbaum, Helen. Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford UP, 2010.
Noble, Safiya Umoja. Algorithms of Oppression: How Search Engines Reinforce Racism. NYU Press, 2018.
Noë, Alva. Strange Tools: Art and Human Nature. Hill and Wang, 2015.
Nussbaum, Martha C. Creating Capabilities: The Human Development Approach. Harvard UP, 2011.
O’Donovan, Oliver. Resurrection and Moral Order: An Outline for Evangelical Ethics. 2nd ed., Eerdmans, 1994.
Ohm, Paul. “Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization.” UCLA Law Review, vol. 57, no. 6, 2010, pp. 1701–1777.
Ostrom, Elinor. Governing the Commons: The Evolution of Institutions for Collective Action. Cambridge UP, 1990.
Pager, Devah. Marked: Race, Crime, and Finding Work in an Era of Mass Incarceration. U of Chicago P, 2007.
Pasquale, Frank. The Black Box Society: The Secret Algorithms That Control Money and Information. Harvard UP, 2015.
Peirce, Charles Sanders. The Essential Peirce: Selected Philosophical Writings. Vol. 1, edited by Nathan Houser and Christian Kloesel, Indiana UP, 1992.
Porter, Theodore M. Trust in Numbers: The Pursuit of Objectivity in Science and Public Life. Princeton UP, 1995.
Power, Michael. The Audit Society: Rituals of Verification. Oxford UP, 1997.
Raji, Inioluwa Deborah, et al. “Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing.” Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, ACM, 2020, pp. 33–44. DOI: 10.1145/3351095.3372873.
Rambo, Shelly. Spirit and Trauma: A Theology of Remaining. Westminster John Knox Press, 2010.
Resnik, Judith. “Managerial Judges.” Harvard Law Review, vol. 96, no. 2, 1982, pp. 374–448.
Ricoeur, Paul. Oneself as Another. Translated by Kathleen Blamey, U of Chicago P, 1992.
Rosa, Hartmut. Social Acceleration: A New Theory of Modernity. Translated by Jonathan Trejo-Mathys, Columbia UP, 2013.
Scarry, Elaine. On Beauty and Being Just. Princeton UP, 1999.
Scott, James C. Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed. Yale UP, 1998.
Selbst, Andrew D., et al. “Fairness and Abstraction in Sociotechnical Systems.” Proceedings of the Conference on Fairness, Accountability, and Transparency, ACM, 2019, pp. 59–68. DOI: 10.1145/3287560.3287598.
Sen, Amartya. Development as Freedom. Anchor Books, 1999.
Sennett, Richard. The Craftsman. Yale UP, 2008.
Sharpe, Christina. In the Wake: On Blackness and Being. Duke UP, 2016.
Solove, Daniel J. “A Taxonomy of Privacy.” University of Pennsylvania Law Review, vol. 154, no. 3, 2006, pp. 477–564.
Suchman, Lucy. Human-Machine Reconfigurations: Plans and Situated Actions. 2nd ed., Cambridge UP, 2007.
Turkle, Sherry. Alone Together: Why We Expect More from Technology and Less from Each Other. Basic Books, 2011.
Unger, Roberto Mangabeira. The Self Awakened: Pragmatism Unbound. Harvard UP, 2007.
Viljoen, Salomé. “A Relational Theory of Data Governance.” Yale Law Journal, vol. 131, no. 2, 2021, pp. 370–455.
Wachter, Sandra, Brent Mittelstadt, and Chris Russell. “Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR.” Harvard Journal of Law & Technology, vol. 31, no. 2, 2018, pp. 841–887.
Wachter, Sandra, Brent Mittelstadt, and Luciano Floridi. “Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation.” International Data Privacy Law, vol. 7, no. 2, 2017, pp. 76–99. DOI: 10.1093/idpl/ipx005.
Wajcman, Judy. Pressed for Time: The Acceleration of Life in Digital Capitalism. U of Chicago P, 2015.
Waldman, Ari Ezra. Privacy as Trust: Information Privacy for an Information Age. Cambridge UP, 2018.
Waldron, Jeremy. “The Rule of Law and the Importance of Procedure.” Getting to the Rule of Law, edited by James E. Fleming, New York UP, 2011, pp. 3–31.
Waldron, Jeremy. The Rule of Law and the Measure of Property. Cambridge UP, 2012.
Weber, Max. Economy and Society: An Outline of Interpretive Sociology. Edited by Guenther Roth and Claus Wittich, U of California P, 1978.
Weil, Simone. “Reflections on the Right Use of School Studies with a View to the Love of God.” Waiting for God, translated by Emma Craufurd, Routledge, 1951.
Williams, Bernard. Moral Luck: Philosophical Papers 1973–1980. Cambridge UP, 1981.
Williams, Rowan. Resurrection: Interpreting the Easter Gospel. 2nd ed., Darton, Longman and Todd, 2002.
Wright, N. T. The Resurrection of the Son of God. Fortress Press, 2003.
Young, Iris Marion. Justice and the Politics of Difference. Princeton UP, 1990.
Zuboff, Shoshana. The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. PublicAffairs, 2019.
Legal, Regulatory, Biblical, and Institutional Authorities
Administrative Procedure Act, 5 U.S.C. §§ 551–559, 701–706.
Allegheny County Department of Human Services. “Allegheny Family Screening Tool.” Allegheny County. Accessed 29 Apr. 2026.
American Academy of Teachers of Singing. “In Support of Fact-Based Voice Pedagogy and Terminology.” 1 Sept. 2014. Accessed 29 Apr. 2026.
American Psychological Association. Ethical Principles of Psychologists and Code of Conduct. Standards 4.01–4.07. Accessed 29 Apr. 2026.
Americans with Disabilities Act of 1990, 42 U.S.C. §§ 12101–12213.
Bi-Metallic Investment Co. v. State Board of Equalization, 239 U.S. 441 (1915).
Carpenter v. United States, 585 U.S. 296 (2018).
Citizens to Preserve Overton Park, Inc. v. Volpe, 401 U.S. 402 (1971).
Cleveland Board of Education v. Loudermill, 470 U.S. 532 (1985).
Colorado Senate Bill 24-205. Consumer Protections for Artificial Intelligence. 2024 Reg. Sess.
Colorado Senate Bill 25B-004. Increase Transparency for Algorithmic Systems. 2025 Extraordinary Sess.
Committee on Publication Ethics. Ethical Guidelines for Peer Reviewers. Version 2, Sept. 2017. DOI: 10.24318/cope.2019.1.9.
Consumer Financial Protection Bureau. Consumer Snapshot: Tenant Background Checks. CFPB, 2022.
Consumer Financial Protection Bureau. “CFPB Addresses Inaccurate Background Check Reports and Sloppy Credit File Sharing Practices.” 11 Jan. 2024.
Consumer Financial Protection Bureau. “CFPB Reports Highlight Problems with Tenant Background Checks.” 15 Nov. 2022.
Consumer Financial Protection Bureau. Tenant Background Checks Market Report. CFPB, 2022.
Equal Credit Opportunity Act, 15 U.S.C. §§ 1691–1691f.
Equal Employment Opportunity Commission. Enforcement Guidance on Reasonable Accommodation and Undue Hardship under the ADA. 17 Oct. 2002.
Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions under Title VII of the Civil Rights Act. 25 Apr. 2012.
Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x.
Fair Housing Act, 42 U.S.C. §§ 3601–3619.
Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g.
Federal Trade Commission. “FTC Announces Crackdown on Deceptive AI Claims and Schemes.” 25 Sept. 2024.
Federal Trade Commission. “FTC Finalizes Settlement with Photo App Developer Related to Misuse of Facial Recognition Technology.” 7 May 2021.
Federal Trade Commission. “FTC Launches Inquiry into AI Chatbots Acting as Companions.” 11 Sept. 2025.
Federal Trade Commission. “FTC Takes Action Against Company Formerly Known as Weight Watchers for Illegally Collecting Kids’ Sensitive Health Data.” 4 Mar. 2022.
Federal Trade Commission. “Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards.” 19 Dec. 2023.
Federal Trade Commission Act, 15 U.S.C. § 45.
Federal Rules of Evidence. Rules 401, 801–803, 901–902.
Goldberg v. Kelly, 397 U.S. 254 (1970).
Hamdi v. Rumsfeld, 542 U.S. 507 (2004).
Health Insurance Portability and Accountability Act Privacy Rule, 45 C.F.R. Parts 160 and 164.
HHS Office for Civil Rights. “Does HIPAA Provide Extra Protections for Mental Health Information Compared with Other Health Information?” Accessed 29 Apr. 2026.
HHS Office for Civil Rights. “Minimum Necessary Requirement.” Accessed 29 Apr. 2026.
Institute for Justice. Barred from Working: A Nationwide Study of Occupational Licensing Barriers for Ex-Offenders. 2020.
Londoner v. Denver, 210 U.S. 373 (1908).
Mathews v. Eldridge, 424 U.S. 319 (1976).
Methodist Church. “Confidentiality Guidelines.” Accessed 29 Apr. 2026.
Motor Vehicle Manufacturers Association of the United States, Inc. v. State Farm Mutual Automobile Insurance Co., 463 U.S. 29 (1983).
National Association of Social Workers. Code of Ethics. Standards 1.07–1.08. Accessed 29 Apr. 2026.
National Association of Teachers of Singing. “National Student Auditions.” Accessed 29 Apr. 2026.
National Association of Teachers of Singing. “National Student Auditions FAQ.” Revised 23 Aug. 2023. Accessed 29 Apr. 2026.
National Association of Teachers of Singing. “National Student Auditions Resource Center.” Accessed 29 Apr. 2026.
National Conference of State Legislatures. “Automatic and/or Automated Criminal Record Clearing Database.” Updated 25 Feb. 2025. Accessed 29 Apr. 2026.
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, Jan. 2023. DOI: 10.6028/NIST.AI.100-1.
National Institute of Standards and Technology. NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. NIST CSWP 01162020, 16 Jan. 2020. DOI: 10.6028/NIST.CSWP.01162020.
National Institutes of Health. “Biosketch: Biographical Sketch Format Page.” Accessed 29 Apr. 2026.
National Institutes of Health. “Biosketch Format Pages, Instructions, and Samples.” Accessed 29 Apr. 2026.
National Institutes of Health. “Other Support.” Accessed 29 Apr. 2026.
National Institutes of Health. “Other Support Format Page.” Accessed 29 Apr. 2026.
Occupational Safety and Health Administration. “Workplace Stress.” Accessed 29 Apr. 2026.
Occupational Safety and Health Administration. “Workplace Stress: Guidance and Tips for Employers.” Accessed 29 Apr. 2026.
Performance.gov. “About Performance.gov.” Accessed 29 Apr. 2026.
Performance.gov. “Feedback Data Explainer.” Accessed 29 Apr. 2026.
Performance.gov. “Performance Framework.” Accessed 29 Apr. 2026.
Performance.gov. “Trust in Major Government Service Providers.” Accessed 29 Apr. 2026.
Performance.gov. “Trust in Major Government Service Providers Dashboard.” Accessed 29 Apr. 2026.
Privacy Act of 1974, 5 U.S.C. § 552a.
Regulation (EU) 2016/679. General Data Protection Regulation. 27 Apr. 2016.
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence and Amending Regulations and Directives. Official Journal of the European Union, 12 July 2024.
Restorative Justice Council. Principles of Restorative Practice. 2015.
Restorative Justice Council. “What Is Restorative Justice?” Accessed 29 Apr. 2026.
SEC v. Chenery Corp. [Chenery I], 318 U.S. 80 (1943).
SEC v. Chenery Corp. [Chenery II], 332 U.S. 194 (1947).
Skidmore v. Swift & Co., 323 U.S. 134 (1944).
Social Security Administration. Disability Evaluation Under Social Security. Accessed 29 Apr. 2026.
The Bible. New Revised Standard Version Updated Edition. National Council of Churches, 2021.
U.S. Citizenship and Immigration Services. “Form I-485, Application to Register Permanent Residence or Adjust Status.” Last updated 24 Sept. 2025. Accessed 29 Apr. 2026.
U.S. Const. art. I, § 9, cl. 2.
U.S. Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health. “Supporting Mental Health in the Workplace.” 15 Apr. 2024. Accessed 29 Apr. 2026.
U.S. Department of Agriculture, Food and Nutrition Service. “Best Practices in Developing Effective SNAP Client Notices.” Accessed 29 Apr. 2026.
U.S. Department of Agriculture, Food and Nutrition Service. “Guide to Improving Notices of Adverse Action.” Accessed 29 Apr. 2026.
U.S. Department of Education. “School Climate and Student Discipline Resources.” Accessed 29 Apr. 2026.
U.S. Department of Education. “School Climate and Student Discipline Resources: Know the Data.” Accessed 29 Apr. 2026.
U.S. Department of Education, Office for Civil Rights. “Regulations Enforced by the Office for Civil Rights.” Accessed 29 Apr. 2026.
U.S. Department of Education, Office for Civil Rights. “Sex Discrimination: Overview of the Law.” Accessed 29 Apr. 2026.
U.S. Department of Education, Office for Civil Rights, and U.S. Department of Justice, Civil Rights Division. Resource on Confronting Racial Discrimination in Student Discipline. 26 May 2023.
U.S. Department of Education, Student Privacy Policy Office. “FERPA.” Accessed 29 Apr. 2026.
U.S. Department of Housing and Urban Development. Guidance on Application of the Fair Housing Act to the Screening of Applicants for Rental Housing. Office of Fair Housing and Equal Opportunity, 29 Apr. 2024.
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Reasonable Accommodation and Undue Hardship under the ADA. 17 Oct. 2002.
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions under Title VII of the Civil Rights Act. 25 Apr. 2012.
U.S. Office of Personnel Management. “Are the Performance Rating, the Rating of Record, and the Summary Level the Same Thing?” Accessed 29 Apr. 2026.
U.S. Office of Personnel Management. “Performance Appraisals.” Accessed 29 Apr. 2026.
U.S. Office of Personnel Management. “Performance Management Cycle.” Accessed 29 Apr. 2026.
U.S. Office of Personnel Management. SES Desk Guide, Chapter 4: Performance Management. Accessed 29 Apr. 2026.
U.S. Office of Personnel Management. SES Performance Management System: Executive Performance Agreement. Accessed 29 Apr. 2026.
United States ex rel. Accardi v. Shaughnessy, 347 U.S. 260 (1954).
United States v. Mead Corp., 533 U.S. 218 (2001).
12 C.F.R. § 1002.9.
15 U.S.C. § 1681c.
15 U.S.C. § 1681g.
15 U.S.C. § 1681i.
15 U.S.C. § 1681m.
20 U.S.C. § 1232g.
28 U.S.C. §§ 2241–2255.
34 C.F.R. Part 99.
34 C.F.R. § 99.10.
42 U.S.C. § 3604.
5 C.F.R. Part 430.
5 C.F.R. § 430.203.
5 C.F.R. § 430.204.
5 C.F.R. § 430.206.
5 C.F.R. § 430.208.
5 U.S.C. § 552a.
5 U.S.C. § 555(e).
7 C.F.R. § 273.13.
Jonathan Johnson-Swagel 
Leave a comment