Make Whoever Runs a Harmful System Post a Bond

A bond that drains when a system fails puts the cost of failure on the people who chose to run it. It has one obvious leak. An organization can meet its bond by cutting staff, raising charges or dropping the exposed service, which moves the burden sideways onto another population and leaves the decision-makers where they were. A bond worth writing has to be protected against that move.

Systems fail again and again because the people who decide can push the cost of their mistakes onto someone else. In 2013 Michigan’s unemployment agency installed a $47 million automated system called MiDAS a year after laying off about 400 staff. Over the next two years it flagged tens of thousands of claimants for fraud, often with no human review, and a state review later found it wrong in 93 percent of the cases it examined. The accused lost benefits and faced penalties of four times the amount they supposedly owed, collected through wage garnishment and seized tax refunds.1 They carried the error. The people who chose and ran the system carried none of it.

A bond that drains on overturned decisions

Recalibration bonding ties the decision-maker’s interests to what happens to the people the system acts on. Before a high-stakes automated or administrative system goes live, the organization responsible posts a bond, in money or in operating capacity. When errors cross a threshold, such as a count of decisions overturned on appeal, the bond drains automatically. The money goes straight to the people affected without waiting on the ordinary appeal, and a drained bond puts the system’s license under review.

The instrument is old. Under the Miller Act, contractors on federal construction projects post performance and payment bonds, so the government and unpaid subcontractors are covered if the contractor fails. Since 1977 the Surface Mining Control and Reclamation Act has required coal operators to post a bond covering the cost of reclaiming the land before they can get a mining permit.2 In both cases the party that could walk away from its damage has to put up the cost of repair first.

Who Corrects the Corrector? asks who decides when the bond drains. As little as possible should be left to deciding. The bond drains on the same count that trips the stop button in Any Toyota Worker Can Halt the Line. You Can’t.. Disputes about the count still need an adjudicator, and that adjudicator can’t answer to the institution holding the bond.

A bond is leverage. It supplies money and a reason to recalibrate, but by itself it doesn’t show where the cost finally lands. Stopping there is the sideways move again. A remedy is complete only when the burden has been followed through: who paid the bond, and whose resources, work or exposure changed to supply it. A bond paid by cutting the caseworkers who serve the same claimants has only moved the cost around.

The transition tax

An institution that starts carrying its own errors will look worse on its old metrics. Stops, reviews and bonds lower throughput and raise costs. That drop is the transition tax. It looks like a loss only on books that never recorded the cost, and what it shows is the true price of the system, carried until now by the people it misread.

Governments may want to help institutions through the drop. Help that forgives what was owed is a bailout, cushioning the borrower and leaving the lender unpaid. Any subsidy should depend on the institution paying what an audit finds it owes to the people who carried the cost. The order matters too. First audit what the system has been pushing onto people, then install the stop button where harm is highest, and only then bring the whole system under bonds and review.

Decision-makers will design systems that can be corrected only when they have to answer for where the cost of their abstractions lands.