A patient’s treatment is rejected by a claims engine because a metric threshold was missed. The clerk explains that the system allows no override. The hospital administrator points to software compliance, the vendor cites the contract, and the regulator notes that the standard was adopted under proper procedure. Everyone involved is conscientious, polite and free of malice, and the patient is still going to die of a threshold.
Nobody in that chain exercised arbitrary will, and so the case defeats the usual theory of domination, which imagines a master. In Philip Pettit’s version, freedom requires the absence of arbitrary power: the slave stays unfree even when the master is kind, because everything depends on his mood. The patient is subject to no one’s mood. She is subject to a representation, and no one in the building has the standing to correct it. This is a failure of corrigibility, not of intent—a system that’s safe for its operators and has lost its legitimacy with the people it governs.
The Axiom of Corrigibility
What I call principal corrigibility is an authority’s ability to correct its tools, its agents, and its algorithms. Safety requires it. An authority that can’t fix a broken tool or a rogue clerk is merely incompetent.
Subject corrigibility runs the other way: it’s the ability of the people under an authority to correct it. Legitimacy requires it. An authority that the people harmed by its errors can’t correct has stopped governing them. It acts on them, and they have no say in what it does.
A legitimate institution follows one rule. The people who bear the cost of its actions must have at least as much power to correct it as it has to act.
View source
%% title: Who can correct the claims engine
%% caption: The hospital, the vendor and the regulator can fix the claims engine, which keeps it safe for them. If the denied patient cannot force them to change the threshold, the whole chain dominates her, however politely it runs.
graph TD
classDef actor stroke-width:1.6px;
classDef binding stroke-width:3px,font-weight:bold;
classDef failure stroke-width:2.2px,stroke-dasharray:6 3;
subgraph "Principal Corrigibility (Safety)"
A["Hospital, vendor, regulator"]:::binding -- "can fix" --> B["Claims engine and clerk"]:::actor
end
subgraph "Subject Corrigibility (Legitimacy)"
C["Patient denied treatment"]:::binding -- "forces a new threshold on" --> A
end
B -. "If she cannot force it" .-> D["Domination<br/>She dies of a threshold"]:::failure
A -. "If she cannot force it" .-> D
What the institution knows you as
People act through institutions they depend on: employers for income, states for legal standing, families for care, technical systems for access to ordinary life. Some of that dependence is permanent, the plain fact of being a mortal body that needs other people. Some of it was manufactured, when people were cut off from direct access to subsistence and left with only their time to sell.1 Political theory that confuses the two ends up treating market compulsion as biology. But neither kind of dependence is going away, so the work is making dependence compatible with agency rather than domination.
When the Los Angeles fires started in January 2025, the first working logistics system in several neighborhoods was a shared spreadsheet. Mutual aid networks were dispatching supply runs and housing lists through it within hours, before official relief had a phone number. Nobody owned it, anyone could see who needed what, and stepping back carried no penalty. Dependence built that way is governable because its terms are visible, and the terms are also settable in advance. Who carries the risk, who does the maintenance, and who decides when support ends can be treated as design parameters rather than afterthoughts.
Institutions coordinate at scale by simplifying. A tax agency needs income brackets, a disability office needs functional criteria, a state needs census categories. James C. Scott showed that centralization requires legibility, and Herbert Simon showed that organizational rationality is bounded. Nobody serious proposes abolishing categories, so the question is how they get corrected.
The trouble starts when the category decides who gets what they need to survive. At that point the institution is claiming, without ever saying so, that this model is what you are for everything that decides your material life. For most people the model fits well enough, so the political test comes at the boundary. Boundary cases include the condition the diagnostic code excludes, the caregiving schedule the shift-clock penalizes, the seasonal worker the benefit algorithm flags as fraudulent, and the applicant whose history the credit pipeline misreads.
The remainder is whatever the representation leaves out. At the boundary an institution can treat the person as an anomaly in an otherwise complete system. Or it can treat the mismatch as evidence that the system’s model of reality is incomplete, and that choice decides who does the correcting. If the model is presumed right, the person contorts their body, schedule and household until they fit. If lived experience keeps its standing, the model is what gets revised.
No model anticipates the full variety of human life, so the remainder is a permanent feature of governing through abstraction rather than a bug. Correction can’t be bolted on afterward. Either the institution’s idea of its own authority includes being revised by the people it misrepresents, or the institution is set up to discard whoever it cannot describe.
Domination without a tyrant
The bureaucracy keeps the representation insulated, because no single person holds the power to override and every person can point to a rule. Market compulsion insulates it separately. The administrator, the clinic director and the logistics manager are disciplined by competition and by the need to stay solvent for lenders and investors. Nobody governs the market, but the pressure to contain costs and protect margins pushes institutions to offload their costs onto people’s bodies. Correcting the business model can threaten the revenue the institution runs on, so the misrepresentation stays.
The Post Office’s Horizon system in the UK and Michigan’s MiDAS fraud system had no tyrant at the controls. They were automated representations with the final say over people’s lives, and the people carrying the remainder had no standing to challenge the machine’s version of the truth. Both are cases of agentless domination.
Arkansas built a smaller version in 2016. When the state merged its Medicaid home-care programs for older and disabled people, it took the weekly-hours decision away from the assessing nurse and gave it to an algorithm that sorted each person into a resource group from a diagnosis and a questionnaire. Bradley Ledgerwood has cerebral palsy, and his parents had been paid to care for him 56 hours a week. Under the algorithm he got 32.2 The nurse asked the questions, the software set the hours, and the department argued that the federal waiver required the algorithm. Legal Aid of Arkansas sued on behalf of seven recipients, and in May 2018 a Pulaski County judge barred the formula until the state adopted it properly, finding that the public hadn’t been given adequate notice.3 Officials answered with an emergency rule, and by December a legislative committee had approved a different method for awarding hours. Legal Aid won on whether the public had been consulted. Whether 32 hours was enough for Bradley Ledgerwood’s body was not the question the ruling answered.
View source
%% title: The 32 hours nobody could correct %% caption: A questionnaire and a formula set Bradley Ledgerwood’s home care at 32 hours a week, and the nurse who asked the questions cannot change the number. The care it leaves out falls on his body and his parents, and the lawsuit that followed turned on notice, not on his hours. flowchart TD classDef actor stroke-width:1.6px; classDef system stroke-width:1.2px; classDef gate stroke-width:1.6px; classDef burden stroke-width:2px; classDef failure stroke-width:2.2px,stroke-dasharray:6 3; A["Arkansas home-care algorithm<br/>diagnosis plus questionnaire"]:::system -- "sets weekly hours for" --> S(["Bradley Ledgerwood<br/>cerebral palsy"]):::actor A -- "outputs" --> M["Resource group:<br/>32 hours a week"]:::system S -- "still needs" --> R["Care the 32 hours<br/>do not cover"]:::burden M -- "nurse cannot override" --> I["Department: the federal<br/>waiver requires the formula"]:::system R -- "carried by his body<br/>and his parents" --> D(["Agentless domination<br/>nobody chose the cut"]):::failure D -. "suit wins on notice,<br/>not on his hours" .-> I
What people are offered instead
Institutions answer the demand for correction with a ladder of lesser things, and every rung below the top looks like the top from a distance.
View source
%% title: The ladder of institutional response %% caption: Each rung below corrective standing looks like accountability and leaves the rule itself in place. flowchart TD classDef actor stroke-width:1.6px; classDef system stroke-width:1.2px; classDef gate stroke-width:1.6px; classDef binding stroke-width:3px,font-weight:bold; classDef status stroke-dasharray:4 3; T["1. Transparency<br/>See how it decided"]:::status --> V["2. Performative Voice<br/>Microphone, no lever"]:::status V --> A["3. Procedural Appeal<br/>Test clerk, preserve rule"]:::system A --> P["4. Upfront Participation<br/>Legitimacy settled at origin"]:::system P ==> S[["5. Corrective Standing<br/>Compels category revision"]]:::binding
Transparency lets you see how the system works: the rulebook, the feature weights, your classification. It shows you how the decision was made without giving you any way to change it. Voice lets you speak, at town halls and feedback panels. Albert Hirschman noticed that channels for voice can reduce exit, and institutions exploit this by granting performative voice, installing microphones connected to no levers. Appeal tests whether the clerk followed the manual, and if the manual is what’s wrong, the appeal confirms the injury. Participation lets you help design the process at the start, which settles legitimacy at the origin and says nothing about the cases the rule meets later.
The top rung is corrective standing, an enforceable path by which your run-in with the institution’s failure can compel it to revise the category, the rule, or the jurisdiction. Unlike a “voice” or a “feedback loop”, it’s a lever.
Institutions can take in a great deal of criticism without changing what earns them money. A platform or an insurer can install user panels, ombuds and algorithmic audits precisely to vent friction so the underlying machinery runs longer. Standing that only lets people adjust the settings on their own exploitation is a shock absorber. Standing counts when it can reach the imperative itself: eliminate the classification, halt the deployment, take the resource off the market.
The legitimacy of an institution depends on whether the knowledge through which it governs remains corrigible by those whom that knowledge misrepresents.
How correction could work
Saying institutions must be corrigible is easy. The hard part is saying how they govern without dissolving into paralysis, because an institution that rewrote its general rule for every grievance would have no rule.
View source
%% title: What it would take to correct the 32 hours
%% caption: Under these six gates, Bradley Ledgerwood could bring the challenge himself, and a pattern of recipients held below 40 hours would put the formula on trial. The path ends with the formula rebuilt or the state paying for the care it leaves out.
flowchart TD
classDef actor stroke-width:1.6px;
classDef system stroke-width:1.2px;
classDef gate stroke-width:1.6px;
classDef binding stroke-width:3px,font-weight:bold;
classDef repair stroke-width:2.4px,font-weight:bold;
E(["Weekly care hours<br/>drop from 56 to 32"]):::actor --> G1{"1. Standing<br/>He and his parents can file"}:::gate
G1 --> G2{"2. Thresholds<br/>Most held below 40 hours:<br/>the formula goes on trial"}:::gate
G2 --> G3{"3. Authority<br/>Judged outside the department"}:::gate
G3 --> G4{"4. Scale<br/>Formula stays provisional,<br/>his hours held meanwhile"}:::gate
G4 --> G5{"5. Power<br/>State must prove the cut,<br/>his advocate is funded"}:::gate
G5 ==> G6[["6. Finality<br/>Kept only to protect the program,<br/>and the state pays the gap"]]:::binding
G6 ==> R(["Formula rebuilt, or the state<br/>pays for the missing care"]):::repair
Standing belongs to whoever bears the material cost of the representation’s failure, not to accredited experts or designated representatives. A tenant, a claimant or a patient who can show a persistent mismatch between their circumstances and the category governing them has standing by that fact.
A threshold separates a one-off from a broken rule. A single mismatch gets immediate relief, so the person isn’t ruined while the dispute is examined. When mismatches cluster across a region, a demographic or a job class, the institution loses the right to treat them as isolated. The accumulated remainder opens a mandatory review, and the category itself goes on trial.
Authority over a contested category can’t sit with the institution that wrote it. That institution has every reason to file its failures as user error, and it appears in the process as an interested party. Adjudication has to be independent, in the polycentric way Elinor Ostrom described for commons governance: citizen juries, mixed councils, ombuds with subpoena power.
Scale is handled by acting provisionally. A hospital cannot freeze admissions while a diagnostic category is contested, so it acts on its best abstraction. Any decision that is challenged becomes provisional, and interim benefits and liability shields keep the people at the edge from paying for the delay while the model is rebuilt.
The return path has to be protected from capture, because correction channels are quickly taken over by whoever has the most stamina, money and administrative literacy. Herd and Moynihan showed that administrative burden is rationing by another name. Putting the burden of proof on the institution when it terminates a benefit or reclassifies a worker protects the path, and so does funding public advocates to defend the remainder without charging it for the privilege.
Finality is allowed, under conditions. An institution may keep a challenged rule if it shows that the rule preserves a capability that can only be exercised collectively (a “collective capability,” extending Amartya Sen’s capability approach) that narrower tailoring would destroy. It must also have tried every feasible accommodation and agree to absorb the cost of the people the rule still fails. “The rule stands, and the collective will carry the cost of your difference” is governing. “The rule stands” alone is domination. Even so, the collective cannot restore an indivisible resource or undo every loss. Carrying the cost keeps the obligation live without closing the account, and some losses remain tragic even where finality is legitimate.
What ownership leaves unsolved
Ownership alone solves none of this. Abolish private ownership and the profit that made correction expensive goes with it, which matters. The bureaucracy stays, and the questions are still sitting there: who administers, who classifies, who decides, who can refuse, who holds standing to correct the institution when its model fails. A democratically governed workplace, commune or planning board doesn’t gain unlimited jurisdiction just because the collective built it. A model that spreads its exclusions with perfect statistical parity still dominates if the people it misrepresents can’t contest the metric.4
Expertise does not become sovereignty. Knowing more about a grid, an algorithm or a disease doesn’t give you the right to govern the person. Nor does provision become command, since distributing medicine, housing or compute does not entitle you to dictate how the recipient lives. And dependence does not become jurisdiction, because someone’s vulnerability calls for support, never subordination.
Collective authorship does not entail collective ownership of individual agency.
Power is corrigible when it pays the cost of repair. An institution that admits error but pays nothing for it has only kept the right to stop hurting someone once the damage is done. The machinery of correction also hardens into a self-protective bureaucracy like everything else, so it carries its own sunset and expires unless the people it governs renew it.
Marx asked how our own powers stop confronting us as alien powers. Collective ownership leaves a further question:
And once those powers become genuinely ours, how do we stop “ours” from becoming a new justification for ruling each of us?
A collective needs enough power to sustain shared life. Its members also need enforceable limits on what it can demand of them, including when they lose a vote.
A machine aligned perfectly with its operators’ intentions still dominates the people it governs if they cannot make it change.
Notes
On how this severance was made rather than found, see Silvia Federici, Caliban and the Witch: Women, the Body and Primitive Accumulation (Autonomedia, 2004), which reads primitive accumulation as an assault on collective subsistence and care rather than on land and tools alone.
KATV, “7 disabled file suit against state” (January 27, 2017). Before the merger the program for younger recipients allowed up to 56 hours a week; under the algorithm most recipients were held below 40.
Arkansas Democrat-Gazette, “DHS to appeal ban on formula; algorithm pared home-based care” (June 12, 2018), which also reports the department’s argument that the federal waiver required the algorithm. The judge later held the department in contempt over the emergency rule; the Arkansas Supreme Court reversed that finding in 2019.
The word is imported. Corrigibility names an agent’s willingness to permit its own correction and shutdown in Nate Soares, Benja Fallenstein, Eliezer Yudkowsky, and Stuart Armstrong, “Corrigibility” (Machine Intelligence Research Institute, 2015). That paper puts the problem inside the agent’s mind. Here it moves into an institution’s charter, where the optimizer is a clinic, a market or a party and the operator is a committee that may never meet. The full accounting of borrowed terms lives at Lineage.