Years ago an office was told to collect one fact about the people who needed its help. The fact turned out to be useful for a second decision, so the office used it. A third need showed up, and it used it again. Neither the second use nor the third was forbidden. Neither was mentioned in the grant, either. Nobody extended the office's authority. The authority just followed the data, the way water follows the ground, with nobody approving the direction. Grants run out that way, one useful step at a time, with no decision on record anywhere, and most institutions never run the test that would catch it.
%% title: Where a justification stops
%% caption: A justification does not spread to whatever is nearby. A materially different use of power needs its own grant, and an inference does not carry the authority that allowed the data to be collected.
flowchart TD
classDef gate stroke-width:2px;
A[Collection<br/>authorized]:::gate --> B{Derived<br/>inference?}:::gate
B --> C[Action]
B -. "possession does<br/>not transmit" .-> C
D{Capacity changed<br/>since the grant?}:::gate -->|materially| E[Reauthorization<br/>required]
B -. "scope exceeded<br/>since the grant" .-> E
The skipped inference
In each of the office's moves, a fact is allowed to carry whatever authority it seems to imply. Capability does not carry permission, dependence does not carry a right to control, and a rule's remainder does not carry the rule's authority. This site keeps having to make those three versions of the same point.123 Relevance does not carry jurisdiction either, and success at a task does not carry consent to do it.
Underneath all of them, legitimacy does not travel. A justified use of power does not justify the one next door because the second is useful, convenient, or nearby. Justification holds where it was granted and thins with every step past it. Law already distrusts this spread in particular places. Purpose limitation, ultra vires, proportionality and enumerated powers each make the same point in one corner of institutional life. None of them states the general rule, that having an advantage does not entitle an institution to expand. Two tests make that rule usable against the office. One asks whether the capacity has changed since the grant, and Same Charter, Different Office carries it through to a burden of proof. The other asks whether an inference sits inside the grant.
Same words, bigger tool
The office's grant still reads the way it did when the office had one filing cabinet. Keep the words while changing what gets done, with more scale, more persistence and more inference, and you have the permission slip an institution writes for itself. It says the purpose is the same and only the tool is bigger. A boat becomes a fleet, then an industry, then a grid, and it is still called the boat. By now the office is no longer in the relationship it was authorized for, and the grant has expired on its own terms without anyone noticing the date.
Authority is justified for what it was described as doing. Change what is being done and the old description may no longer cover it. Instead of announcing a new description, the institution usually stretches the old one over the new power and calls the fit good. Institutions differ in how far the words stretch. A low-elasticity institution finds its grant tearing at the first material change. A high-elasticity institution can fold a fleet, a grid, or a predictive apparatus inside a sentence written for a boat and the grant never visibly breaks. High elasticity looks like fluency, but it removes the moment when the institution has to come back and ask.
A change is material when it alters what the institution may do to people, rather than helping it do better what it was already authorized to do. The tell is rarely one dramatic act. Usually the institution has moved along one of several lines. It acts on a new kind of fact, or governs a new class of people. Its intervention gets more continuous or more intimate, or its consequences get harder to reverse. Something previously inaccessible becomes inferable, refusal gets harder, or its capacity to shape behavior grows. Any one of them means the conditions the grant rested on no longer hold.
A material-change test settles the easy cases without a hearing. An infrared gate camera that speeds up passport verification at an international terminal does the authorized job better, so the justification holds. It is the same border crossing, the same statutory identity check and the same traveler class, with faster throughput. Now network that same airport biometric database to municipal cameras to track pedestrian movement three hundred miles inland. That changes what the institution does to people, even if every agency still calls the program identity verification. The first improved an authorized checkpoint, while the second established an inland surveillance regime without a grant.
Possession
Possession is the quietest expansion of all. The office holds data lawfully, and holding starts to look like standing for everything the data can be made to reveal. That breaks a basic rule, which says the further authority reaches past the original grant, the stronger the reason it needs. Inference is the sharpest case, because authority over inputs does not extend to authority over what can be derived from them. Permission to collect data does not cover inferring from it, and an inference that is permitted still does not authorize action.
The strongest cases look obvious: a hospital can predict it, a bank can score it, an employer can measure it. That obviousness is the trap, since being able to do something is never permission to do it. The question is whether the office holds authority over the output, and whether the output is inside the original grant.
A model is a device for turning data into attributes the data never contained. Better accuracy makes an unauthorized inference more effective without making it any more lawful. "Can we predict this?" sits downstream of "is an office of this kind entitled to predict this, from these inputs, for this purpose?" When the second answer is no, no improvement to the model changes the first.
Expansion by the hour, correction by the year
For the office, expansion is cheap and correction is expensive. A new data use is a spreadsheet change. A correction needs a formal process, a legal argument, and a review board that meets quarterly.4 The design should run the other way, with correction cheap and expansion expensive. Expansion is sometimes right, but every expansion still crosses a boundary, and crossings are exactly the events that need friction so someone notices them. An institution that expands without friction grows past its grant while nobody weighs the crossing. Someone downstream absorbs the cost of the correction it decided not to make.5
Jurisdiction is the entry condition for power. Corrigibility is the exit condition for error. An institution that cheapens entry while raising the price of exit does worse than get the balance wrong, because it stops its own mistakes from counting.
Even the boundary has to stay open to revision, because institutions will draw it too close to their own operations and too far from the people it exists to protect. Revision cannot become a blank check for expansion, so the process that redraws the line has to be as protected from the institution's interest as the line.6 The office may redraw its own limits only under conditions it does not control.
More generally, institutions become illegitimate when capability, success, expertise, necessity, or dependence move the limits of their powers and no one announces the change. Abuse is not required. Drift is enough, and drift is what the office did. None of this is specific to data. Education, employment, medicine and public administration all hold grants their tools have outgrown, and the same two tests travel.
A grant of authority is a promise between an institution and the people it governs. The promise has terms, and anything claimed beyond them is persuasion.
Notes
Five Ways a Fact Becomes a Right: the five moves and the refusal that stops them.
Before Public or Private: the constraints that have to hold before any ideology gets to answer.
Nine Thousand Claims and One Woman: who gets made responsible for what a rule cannot hold.
Corrective machinery that routes back into the institution it was meant to bind: Filed at the Wrong Size.
The cost profile of correction, and an economy that selects against institutions that carry it: All the Machinery, None of the Correction.
Why an instrument never tries itself: The Corrigible Machine and The Rule Is Never on Trial.