We comfort ourselves with the idea that institutions fail because of an epistemic crisis. We call the problem misinformation, polarization, declining trust. We assume the core damage is interpretive: that if we could just correct the record and produce the ultimate proof, the machine would output the right answer. For more than a decade that assumption funded fact-checking desks, media-literacy curricula and warning labels on social platforms.
The failures that wreck lives rarely happen because an institution doesn’t believe you. They happen because you don’t have standing.1
In the legal sense, standing is the right to have a court hear your case. In the administrative sense, standing is the technical capacity to force a system to turn your reality into an obligation: a check written, a hold lifted, a record corrected, a flag removed. It’s the difference between a claim that can be acknowledged and a claim that has to be acted on.
Most people meet this distinction first as slow humiliation, and only later as theory.
You gather receipts, upload documents, follow instructions, stay polite, escalate through the blessed channels. And you watch nothing happen. Nobody refutes your claim or even denies it. It just never acquires the force to bind the institution to a response.
The institution may well believe you. What it has done is nullify the claim.
The non-decision regime
A denial hurts, but it’s legible. It produces a decision artifact: a reason, a timestamp, a deadline, a path to review. “Pending” dissolves the handle. It sounds temporary. It sounds like progress. It keeps you checking, resubmitting, waiting, participating in a process that never commits.
Non-decision, consequences arriving without any decision, is how many institutions fail people. We call it bureaucracy, red tape, inefficiency. Those words flatter the machine. They imply there’s justice underneath and the pipe is merely clogged.
In more and more domains the pipe is the policy.
Many institutions now govern by controlling contestability: they accept input and avoid being bound. They will generate reference numbers and case IDs. They will route you through portals that can ingest you. They will not necessarily offer the one thing that turns listening into justice: a contestable decision that creates a record, triggers duties, and can be appealed.
The incentive structure is simple. Decisions create records. Records create contestability. Contestability creates exposure, and delay is how an institution manages exposure.
Non-decision is a stable state that extracts compliance. Case numbers and status updates give you enough contact to keep you from escalating, and the claim can be marked “handled” without ever gaining binding force.
The pipe is the policy
Governance has moved out of courts and into workflows: submit a ticket, upload documentation, wrong channel, missed window, unable to verify, case closed. Rights don’t exist as abstractions. You have them only if you make it through a sequence of gates.
View source
%% title: Where an uploaded claim stops short of a decision
%% caption: A claim binds the institution only if the portal can parse it and it can then force a written decision. A claim that parses without that force sits at pending while the claimant resubmits, until she stops and the case is marked handled.
flowchart TD
classDef actor stroke-width:1.6px;
classDef system stroke-width:1.2px;
classDef gate stroke-width:1.6px;
classDef binding stroke-width:3px,font-weight:bold;
classDef status stroke-dasharray:4 3;
classDef burden stroke-width:2px;
classDef repair stroke-width:2.4px,font-weight:bold;
classDef failure stroke-width:2.2px,stroke-dasharray:6 3;
C(["Claimant uploads<br/>her receipts"]):::actor --> I["Portal issues<br/>a case ID"]:::system
I --> A{"Admissible:<br/>does it parse?"}:::gate
A -- "no: wrong channel,<br/>missed window" --> X(["Unable to verify,<br/>case closed"]):::failure
A -- "yes" --> S{"Standing: can it<br/>force a decision?"}:::gate
S -- "no" --> P(["Status: pending"]):::status
P -- "weeks pass" --> L["She checks, resubmits,<br/>calls again"]:::burden
L --> G(["She stops calling,<br/>case marked handled"]):::failure
S == "yes" ==> D[["Written decision:<br/>reason, date, appeal path"]]:::binding
D ==> R(["Hold lifted,<br/>record corrected"]):::repair
Each gate has a cost: time, literacy, documentation, connectivity, stable identifiers. When getting through is expensive, treating everyone the same at the interface still produces unequal results. Some people can pay and others can’t, so inequality gets laundered through friction.
In systems design, the happy path is the default journey where no exceptions happen. Anyone can fall off it. One divorce, one fire, one eviction, one name mismatch is enough to convert you from a “user” into an edge case, and the happy path becomes a machine for inequality.
View source
%% title: One eviction moves you off the happy path
%% caption: When every field matches the record on file, the case resolves automatically. One divorce, fire or eviction produces a mismatch the system treats as risk, and the delay that follows ends in drop-off recorded as resolved.
flowchart TD
classDef actor stroke-width:1.6px;
classDef system stroke-width:1.2px;
classDef gate stroke-width:1.6px;
classDef binding stroke-width:3px,font-weight:bold;
classDef status stroke-dasharray:4 3;
classDef burden stroke-width:2px;
classDef repair stroke-width:2.4px,font-weight:bold;
classDef failure stroke-width:2.2px,stroke-dasharray:6 3;
U(["Applicant on file"]):::actor --> H["Happy path<br/>name and address match"]:::system
H --> A[["Approved automatically"]]:::binding
U -- "Divorce, fire<br/>or eviction" --> E{"Edge case:<br/>name mismatch"}:::gate
E --> F["Treated as risk:<br/>unable to verify"]:::burden
F --> D["Each resubmission<br/>adds weeks"]:::burden
D --> X(["Drop-off<br/>recorded as resolved"]):::failure
And the pipe treats edge cases as risk. Risk triggers friction. Friction produces delay. Delay produces drop-off. Drop-off gets recorded as “resolved.”
Admissibility vs. truth
Contemporary injustice so often feels like unreality. You can be right and still lose. You can have the receipts and still fail.
The system is deciding what’s admissible, and whether it is true is a separate question.
Admissibility is what parses: what can be represented as an object in the system. Forms, fields, identity rails, time windows, evidence formats. The institution often doesn’t start with “is this true?” but with “does this parse?” What cannot be represented cannot be decided.
Standing is what binds: what can force the system to produce a decision you can contest. You can be admissible, logged, routed, assigned a case ID, and still have no standing, which is how a case stays “in review” forever.
You can be 100% factually correct, physical proof in hand, and still be functionally wrong because the system can’t ingest the format of your truth.
Where that lands is worked out concretely in If Every User Is a Potential Threat, where the presumption of innocence gets inverted and produces a class of people whose claims no system will process.
Standing as an asset class
If standing is what makes reality contestable, then standing is a resource that gets distributed. And because it’s scarce, it behaves like an asset class.
When the ability to make a system bind is rationed, it can be bought, usually by paying for legibility rather than by bribing a clerk.
View source
%% title: Matching paperwork reaches a decision, shifting paperwork a flag
%% caption: Someone with years of matching records, paid help and time to wait can force the institution to decide. Someone whose income and records shift trips a fraud flag, burns hours guessing at the form, and drops out as a compliance failure.
flowchart TD
classDef actor stroke-width:1.6px;
classDef system stroke-width:1.2px;
classDef gate stroke-width:1.6px;
classDef binding stroke-width:3px,font-weight:bold;
classDef status stroke-dasharray:4 3;
classDef burden stroke-width:2px;
classDef repair stroke-width:2.4px,font-weight:bold;
classDef failure stroke-width:2.2px,stroke-dasharray:6 3;
subgraph Resourced["Stable papers, paid help: standing compounds"]
direction TB
R1["Same name and papers<br/>for years"]:::actor --> R2["Intermediary turns her life<br/>into admissible packets"]:::system
R2 --> R3["Time to wait out<br/>months of pending"]:::repair
R3 ==> R4[["Institution must<br/>decide and act"]]:::binding
end
subgraph Precarious["Shifting income and records: attrition compounds"]
direction TB
P1["Income shifts monthly,<br/>name mismatch on file"]:::actor --> P2{"Fraud flag tripped"}:::gate
P2 --> P3["Guesses at the form,<br/>burns hours she lacks"]:::burden
P3 --> P4(["Drops out, filed as<br/>'compliance failure'"]):::failure
end
Resourced ~~~ Precarious
The wealthy don’t only get better outcomes. They get more situations in which a wrong can be recognized as wrong, because they hold the portfolio of assets it takes to force the machine to bind: time to persist through latency, stable identifiers that satisfy proof regimes without tripping fraud flags, documentation continuity that prevents mismatch errors, and intermediaries whose whole job is translating messy life into admissible packets.
The asset class compounds. Stable paperwork means fewer mismatches, fewer flags, easier future standing. Precarity compounds the other way: volatility produces flags, flags produce gates, gates produce drop-off.
The precarious face the raw interface. They guess what the machine wants. They burn hours they don’t have. And when they finally drop, the institution records it as “compliance failure,” as if endurance under administrative coercion were a character trait.
People aren’t fooled, they’re cornered
At public scale the gap looks the same. Boeing withheld crucial information about the 737 Max, including its own test data, from the FAA, its customers and its pilots, and two of the planes crashed.2 Purdue acknowledged in 2007 that it had marketed OxyContin as less addictive than other pain medications with no research to support the claim.3 In Flint, the state’s own task force found “intransigent disregard of compelling evidence of water quality problems” and “callous and dismissive responses to citizens’ expressed concerns.”4 In each case the evidence existed and reached institutions built to keep it from binding them.
Blaming falsehood on gullibility comforts both power and its critics, because the remedy it implies is harmless: teach people to inspect URLs and trust certified experts. It turns political domination into a deficiency of the audience.
People who repeat an institution’s falsehoods are rarely confused about reality. They repeat them when contradicting the official line carries private ruin, such as losing health insurance or facing legal retribution under a non-disclosure agreement. The junior engineer who signs off on a compromised software release is rarely deceived by the company’s slide deck. She signs because the mortgage is due and the company holds the references she needs for her next job. What she knows has no standing, and calling her compliance an epistemic failure lets the architecture that coerced her drop out of the account.
How power repels evidence
An institution can permit criticism indefinitely as long as its wiring keeps evidence from gaining leverage over decisions.
Authority can be made authorless. When decisions run through cross-functional working groups, automated risk models or outside consultancies, responsibility has no single address. The finding that documents a defect lands with an administrator whose job permits intake and withholds the authority to change the rule that produced it. Logged in a queue, it decays while the organization keeps its reputation for transparency.
Dissent can be treated as insubordination. Questioning a flawed project stops being quality control and becomes a loyalty test, and the argument moves from whether the claim is accurate to whether the person making it has shown enough deference. Once the contradiction counts as a moral violation, the institution can eject the dissenter before the facts force a redesign.
Loss can be absorbed asymmetrically. An organization can survive being publicly wrong for decades if its errors cost people outside its walls. Purdue Pharma profited from every pill sold while families and municipal budgets paid the social, medical and funeral costs. Boeing gave the 737 Max’s chief project engineer a bonus in restricted stock for keeping the program on schedule, while passengers and crew carried the risk.2 When an institution doesn’t pay for its defects, accuracy gives it no advantage.
Contestability by design
If the problem were mainly misinformation, the remedy would be better information. If the problem is standing, the remedy is structural constraint.
Standing over the decision is not standing over the category.
Most administrative reform stops at the decision level. An appeal asks whether the clerk read the manual correctly, and leaves the manual in charge and untouched. It’s better than a whim, and it still reduces justice to a private endurance test. When a system’s model systematically fails a population, making each person fight for an individual variance is how an institution buys the right to keep a defective rule.5
Domination in the modern administrative state needs no tyrant’s whim. It happens whenever a lossy representation of people is given final authority over them with no return path through which the people it fails to fit (the remainder) can force a revision. An agency can hand decisions to forms, risk models and rulebooks. It cannot take from the person a form misreads the right to put the form itself on trial.6
At minimum, any institution with the power to materially affect a person’s life should have to output a decision artifact inside a bounded window. Call it a decision guarantee. Start the clock when input is accepted, and make it visible. Bound the latency: “pending” cannot persist past a fixed window. Forbid ghost closure: no case ends without a disposition artifact.
Inside that window the institution has to output one of three states. Approve. Deny, with reasons and an appeal path. Or request specific information, with exactly what is needed, a deadline, and a commitment to decide afterward.
View source
%% title: The decision guarantee
%% caption: Legitimate administration bounds latency: accepted input must resolve into one of three binding terminal states inside a mandatory window.
flowchart TD
classDef actor stroke-width:1.6px;
classDef system stroke-width:1.2px;
classDef gate stroke-width:1.6px;
classDef binding stroke-width:3px,font-weight:bold;
classDef status stroke-dasharray:4 3;
classDef burden stroke-width:2px;
classDef repair stroke-width:2.4px,font-weight:bold;
classDef failure stroke-width:2.2px,stroke-dasharray:6 3;
I["Input accepted<br/>Clock starts"]:::system --> W{"Bounded window T"}:::gate
W == "State 1" ==> A[["Approve<br/>Relief granted"]]:::binding
W == "State 2" ==> D[["Deny<br/>Written reason & appeal"]]:::binding
W == "State 3" ==> R[["Specific info request<br/>Firm deadline & guaranteed ruling"]]:::repair
W -. "forbidden: unbounded hold" .-> P([Indefinite 'pending']):::failure
Evidence inside an organization needs the same constraint. A documented defect forces a change only when it can strip someone’s authority, halt an operation, trigger independent review or force restitution. That takes exit costs low enough that an employee can decline a fraudulent command without risking poverty. It takes decisions signed by people who face personal liability when they suppress a known defect, and return paths where a verified pattern of complaints suspends an operating license automatically. No fact-check or warning badge supplies any of these.
For a system that governs benefits, credit, housing, employment or health care, whether it listens settles nothing. What settles a case is what the system counts as admissible input, which artifacts create standing, when the clock starts, and whether it can close without deciding.
That sounds technical because it is. The decisions that matter are made in parsers, permissions and queues.
The system can know you’re right and still have nothing forcing it to act.7
Notes
Miranda Fricker, Epistemic Injustice: Power and the Ethics of Knowing (Oxford University Press, 2007), owns the neighboring ground. Fricker’s testimonial injustice is a credibility deficit: a speaker’s word carries deflated weight because of who they are, and the hearer misjudges what they were told. Standing turns on a different distinction, belief versus binding. A credibility deficit deflates the weight of testimony; a standing deficit strips the claim of any power to obligate the institution even when the testimony is fully believed. The institution can know you are right and still owe you nothing, and that gap is where design decisions do their work.
House Committee on Transportation and Infrastructure, Final Committee Report: The Design, Development & Certification of the Boeing 737 MAX (September 2020): “Boeing withheld crucial information from the FAA, its customers, and 737 MAX pilots, including internal test data.” The chief project engineer’s restricted-stock bonus “for helping to keep the program on schedule” is on p. 117.
Testimony of John L. Brownlee, U.S. Attorney for the Western District of Virginia, Senate Judiciary Committee, 31 July 2007: Purdue acknowledged “falsely claiming that OxyContin was less addictive, less subject to abuse and diversion, and less likely to cause withdrawal symptoms than other pain medications when there was no medical research to support those claims.”
Flint Water Advisory Task Force, Final Report (March 2016).
The sequel is Appeals Test the Clerk, Never the Rule, on what it takes to put the manual itself in question rather than relitigate the clerk.
The machinery behind this sentence is Nobody Broke a Rule, and Nobody Can Fix It: the two kinds of dependence, the ladder from transparency to corrective standing, and the design questions a return path has to answer.
Standing as access control is the first rung of what A Good Complaints Office Can Protect a Bad Rule calls signal authority: a signal can be admitted, heard and displayed and still bind nothing. Feedback Without Standing Fixes Only the Cases It Finds sets out the ladder of consequence a binding channel has to climb.