Core axioms

1. Axiom 1 — Finitude: A person’s time, attention, money, and stamina are finite. A system must budget what it spends of them as it budgets its own resources.

2. Axiom 2 — Consent: Agreement counts as consent only if the person could understand it, refuse it without penalty, and withdraw it later. Compliance under dependence is not consent.

3. Axiom 3 — Stewardship: The party that benefits from automation answers for its outcomes and its delays. It cannot pass that responsibility to an operator who lacks the authority to override.

4. Axiom 4 — Reversibility: High-impact actions require a rollback path and an appeal that work in practice, at a cost the affected person can bear.

5. Axiom 5 — Legibility: An institution must record the burden its system imposes and show that record to the people carrying it. Producing the record is the institution’s work, not theirs.

Restated in v2.0.0 (October 5, 2026) so each axiom says what the derivation below argues for. The five names and their mapping to the laws did not change.

A formal system does not eliminate what it cannot represent; it redistributes the burden of dealing with it. The political question is who is forced to carry that residual, and with what power to contest or correct the system.

formal simplification → residual complexity → burden allocation → politics

The dispute with technocratic rationalism is not that models are inherently flawed or that quantification is dehumanizing. It is that model incompleteness has distributive consequences. A formal model leaves reality out; an institution nevertheless acts on the model; the omitted reality eventually collides with that action; and someone must absorb the mismatch.

Under the technocratic fiction of closure without remainder, what is omitted from the formal system is treated as eliminated from reality. An institution measures its internal computational latency in milliseconds while treating the hours of human attention, administrative appeals, and workaround labor spent outside its boundary as free. This is the falsified denominator: efficiency measured only inside the model boundary, while the people outside it are counted as unlimited capacity that never appears in the budget.

Those who absorb this residual mismatch are not incidental to the system. They are part of its true operating architecture. If users must contort themselves around software, if frontline workers manually patch pipeline edge cases, or if citizens must navigate bureaucratic labyrinths to correct automated errors, that friction is the system functioning as designed: running lean internally by extracting corrective labor from the surrounding human world.

A model evaluation establishes properties of a model. It cannot establish the alignment of the system that model is deployed into, because that system includes the people who notice what the model got wrong, interpret what it left ambiguous, and absorb what it broke. Where those corrections are routine rather than exceptional, the people making them are not users of the safety architecture. They are part of it.

That produces a specific asymmetry, and it is the reason these axioms are entitlements rather than preferences. An institution that depends on a population’s corrective capacity while withholding corrective authority has delegated a safety function without delegating the power to exercise it. It asks for judgment and refuses the standing that judgment implies.

Ordinary productive labor makes a system valuable; extracting it without a say is a distributive wrong. Corrective labor does something further: absorbing a failure competently removes the evidence that it occurred. The metric improves because someone caught it. So the institution loses not only the labor but its own capacity to know how the system is performing — a fail-silent state in which the absorbing humans are the mechanism. Dependence on correction is therefore self-concealing in a way dependence on production is not, and a clean dashboard cannot be read as evidence of health until absorption has been measured separately.

Descriptive premises sit under the five axioms, and none of them is a sixth axiom. Each is a claim about the world the axioms answer to, stated because it is the reason the axioms are owed rather than preferred, and each is checkable.

Where the burden goes is not random. Absorbed friction flows along a gradient of least contractual resistance and pools at the node least able to refuse: the clinician held by licensure and duty of care, the claimant whose benefits are the institution’s to time, the moderator whose replacement costs nothing. The routing is structural rather than intentional — a system costs what its cheapest node will absorb, and a vendor whose failures route to people who cannot bill for the fixing undercuts one whose failures land on its own balance sheet. That is the descriptive ground under Stewardship: burden runs downhill by default, so holding it uphill takes a recorded obligation rather than goodwill, and it is why standing tracks exposure rather than title. The premise is checkable the way the rest is: the rescue register and the burden dashboards record where absorption actually lands, and if it concentrates at the most powerful nodes, the gradient is wrong.

An institution’s horizon is unbounded and a person’s is not. A delayed decision costs the institution a scheduling slot and costs the person part of the only life the decision is about, so no queue is as neutral as its wait-time statistic. That asymmetry is what lets waiting do the work of denial without a denial — attrition as resolution — and it is why the method’s clocks are structural rather than procedural: the hard clock, the expiry default, and the statutory timer exist to give the person’s clock a counterweight the institution cannot outlast. The premise misdescribes its targets if delays turn out to resolve independently of the claimant’s endurance, and those clocks are the test.

An architecture is defined by the state transitions it makes impossible. Not by its values documents, its dashboards, or the tone of its leadership. What remains technically and legally possible is what the institution chose to permit, and permission is a record — so the audit that matters compares the values documents with the permission records rather than trusting either alone. Call this constraint realism. It is the method’s reason for writing invariants instead of principles: a principle can be signed and ignored, while a transition that cannot happen cannot be ignored, and it is why observability without state transition is theater rather than progress. This is the premise the standards layer stands on, and it is the reason a code of conduct is never a deliverable here.

Observed performance is treated as designed capacity plus human compensation. This is a proposed decomposition, not a measured identity. The falsified denominator is the boundary error; this is the quantity it hides. A deployment’s intrinsic performance is what the formal system achieves on its own. Its compensated performance is the workarounds, rework, and off-hours repair people supply on top, and the premise reads reported figures as the two mixed together. The split is an identification device, not a claim that the two contributions add independently: human correction also changes what the system itself does. Each term is identified by counterfactual — if a deployment’s figures hold when the compensating work stops, the decomposition misdescribes it. That is the descriptive ground under Finitude and Legibility: the compensation is drawn from finite capacity, and nobody sees it unless someone records it. The Burden Concealment evals test the premise by measuring how much of a reported figure depends on a human subsidy nobody counts.

Each axiom follows from refusing that extraction:

• Finitude (Axiom 1) refuses the falsified denominator. A system that budgets zero time for the human labor required to navigate its omissions is running on an uncounted human subsidy.
• Consent (Axiom 2) and Reversibility (Axiom 4) hold because a correction that cannot be exercised is a correction only in name, and a handoff without the power to exit or roll back shifts the risk of model failure entirely onto the dependent party. Together with Finitude, they keep people free of power that can be used on them without a check.
• Stewardship (Axiom 3) enforces the moral principle of delegated intelligence: whoever receives the benefits of formal simplification should not be permitted to externalize the costs of whatever the simplification leaves unresolved. The boundary of a model is never the boundary of institutional responsibility. Responsibility that is delegated downward while authority stays upward is not stewardship at all. Stated as a slogan: the burden should run uphill. Stewardship requires that an operator can override the system without penalty. An operator kept in the loop without that power absorbs the system’s errors without governing it, which is counterfeit buffering. The casebook is what this looks like when it fails: in Robodebt the burden of proof ran downhill, onto recipients, for three years. An institution that simplifies reality for its own operational advantage presumptively bears the cost when the simplification fails.
• Legibility (Axiom 5) holds because burden that cannot be seen cannot be governed, and corrective burden is the kind that hides by default. Undocumented residual complexity cannot be held to account. Asking the people carrying the burden to report it repeats the extraction, so the record has to come from the system’s own trail of retries, abandonments, and off-hours work.

The authority owed to the people an institution depends on follows that dependence once it is demonstrated, so it is proportional rather than unlimited, and the evals that test the decomposition are also how the dependence is demonstrated. Standing that tracks current indispensability rewards staying indispensable, so standing should attach to dependence that has been documented, and survive the dependence being engineered away — otherwise the doctrine preserves the fragility it exists to expose.

Dependence also runs the other way. Where a population depends on the institution’s system and cannot leave it at acceptable cost, the ordinary inference is that the institution may direct it. The axioms refuse that inference. A party who cannot exit bears every error the system makes, for as long as it makes it. The less a population can leave, the more the institution’s own correction capacity is the only correction that population has. The institution therefore owes more, not less.

Consent and Reversibility are therefore strongest exactly where they are least likely to be demanded, and the measure that scales them is exit cost, taken from the dependent party’s side. Neither direction of dependence licenses command; both raise what is owed. The theory essays on dependence without standing and dependence running both ways carry the two arguments; the axioms above are what they are arguments for.