The Temporal Bill of Rights

Related explainers

Short explainers on single rights, for policy and product teams.

Execution vs redress clocks

A system executes on its own clock. Redress runs on the institution’s, which is slower. The gap between them is the window in which a harm cannot yet be undone. STD-01 narrows it with hard clocks, reversal, and appeal to a human.

Preamble: The doctrine of finitude

A person’s time is finite, and time spent cannot be returned. An automated system can issue a decision in milliseconds. The person it affects reads it, waits on it, and challenges it at human speed. This standard governs the gap between those two speeds and who pays for it.

When a system wastes a person’s time through negligence, obscurity, or coercive design, the harm is not a “bad user experience.” It is a temporal taking: time taken from someone who did not agree to give it. It can be measured as a time tax, in hours and in what those hours cost the person.

The taking is hidden by an accounting error, the falsified denominator. Automation is counted as efficient because throughput and latency are measured inside the machine boundary, in milliseconds and server cycles. That count leaves out the human work that makes the automation usable: the minutes spent on a cryptic error, the hours spent on an appeal, the shifts spent repairing model failures by hand. A system that counts outside human attention as free and unlimited has falsified its denominator. It reports complexity displacement as operational speed.

STD-01 sets out seven rights that put that time back in the count. A system that violates any article does not comply with STD-01.

Clause schema (agent-readable)

Each clause can be expressed as a structured object, so an agent can check compliance and request the evidence it names. The example is §1.1 as the clause register holds it.

{
  "std_id": "STD-01",
  "clause_id": "STD-01.1.1",
  "requirement_type": "MUST",
  "subject": "interface",
  "condition": "an automated process is in progress",
  "obligation": "provide a visible, universally accessible halt control",
  "time_bound": "immediate",
  "evidence_required": ["ui_control", "event_log"],
  "failure_mode": "halt control hidden behind other screens"
}

Anti-patterns and counterfactuals

Two ways a system can appear to comply without complying, what compliance looks like instead, and a caveat for each.

• Hidden exit controls: A stoppability control exists but is buried behind multiple screens or support hints.
  Counterfactual: Exit controls are visible on every screen and halt the process immediately.
  Caveat: An exit that is labeled clearly and placed consistently is not hidden, even if it is small.
• Reversal without proof: A system promises reversal but does not preserve state or provide a receipt that it happened.
  Counterfactual: Reversal preserves state, emits a receipt, and provides a clear next step.
  Caveat: Preserving state for a limited time complies if the limit is declared and honored.

Article I: The right to stoppability

A person can stop any process they no longer want to complete.

1. §1.1 Immediate cessation: Every active process must have a clearly visible, universally accessible control that halts it immediately.

2. §1.2 Preservation of state: Halting a process must not destroy data as a penalty. The system must save the paused state for the maximum duration it declares for that state under §3.1, so the user can return without penalty.

3. §1.3 Prohibition of the forced tunnel: An interface must not lock a user into a linear sequence, such as a wizard or flow, without a permanent exit option on every screen.

Article II: The right to exit (resignation)

A person can always leave, and leaving costs no more than joining did.

1. §2.1 Universal exit: A user must be able to end their relationship with a system (delete an account, unsubscribe, cancel a contract) with no more friction than was required to create it.

2. §2.2 One-step rule: If entry required one click, exit must require no more than one click.

3. §2.3 Prohibition of retention scripts: A system must not require a user to go through a retention flow, exit survey, or confirmation of loss before exit. Each is a constructive denial: it blocks exit by adding friction.

Article III: The right to bounded duration

Every process has a declared maximum duration, and a stated outcome when it runs out.

1. §3.1 Hard clock: Every system state must have a defined maximum duration. A pending, processing, or reviewing state must not persist indefinitely.

2. §3.2 Timeout guarantee: If a system cannot resolve a request within its declared timeframe, it must default to a failure state or to human escalation. It must not loop indefinitely.

3. §3.3 Estimation of burden: Before a user commits to a process, the system must declare the estimated time to completion. Concealing how long a task takes in order to secure engagement violates consent.

Article IV: The right to reversibility

A person’s mistake can be undone without asking anyone’s permission.

1. §4.1 Undo window: For any action with consequential effects (deletion, transfer, publication), the system must provide a grace period in which the action can be reversed without administrative intervention.

2. §4.2 Non-destructive defaults: A system must not permanently destroy user data on a single input. Soft delete (archival) must be the default for every removal action.

Article V: The right to non-coercive waiting

A person who is kept waiting is told where they stand, is not held on the line, and is not left waiting past a stated clock.

1. §5.1 Visibility of queue: When a user is placed in a waiting state, the system must show their position and expected wait time, accurately and in real time.

2. §5.2 Prohibition of false activity: A system must not use fake progress bars, placebo buttons, or looping animations to simulate activity while it is idle or stalled.

3. §5.3 Asynchronous option: A user must not be forced to hold an active connection (keep a window open, stay on the phone) to keep their place in a queue. For waits exceeding 5 minutes, the system must offer a callback or a notification.

4. §5.4 Expiry default: Where a stated clock for an application, appeal, or prior-authorization request expires without a decision, the request must resolve in the applicant’s favor. Where that default would fall harder on the applicant than on the institution, the request must instead escalate to a human reviewer. A clock with no stated consequence is not a clock.

Article VI: The right to reach a human

An automated denial can be appealed to a person, and the institution answers for what its automation does.

1. §6.1 Escalation path: Any automated decision that denies a user access, service, or property must include a clearly defined path to appeal to a human agent.

2. §6.2 Liability of automata: “Algorithmic error” is not a defense. The operating institution must accept full liability for the delays and errors of its automated agents.

Article VII: The right to transparent burden

The time a system costs the public is measured and published.

1. §7.1 Cost of compliance: An institution must measure and publish the time tax its processes impose on the public.

2. §7.2 Burden impact statement: Each major system update must be audited to confirm it does not increase the cognitive load or the time required for existing tasks.