A log and a letter

There is a difference between recording something and accounting for it, and the difference is almost never visible from inside the system doing the recording. A log captures events as they pass — a timestamp, an identifier, a state transition, a code. It is faithful, it is complete in its way, and it is written in the only language the machine has, which is the language of its own internal motion. It answers the question the engineer asked of it: what happened, in the order it happened, with enough fidelity to debug. That is an honorable thing for a log to do, and most logs do it well.

But a log is addressed to no one. It is a transcript kept by a process for the benefit of whoever later has reason to read the process. A letter is a different kind of object entirely. A letter has a recipient. It is written in the recipient's language, not the writer's. It anticipates what the recipient does not know, and supplies it. It explains not only what occurred but why it occurred, in terms the reader can hold and weigh and, if necessary, dispute. The gap between these two things — the log and the letter — is the gap between data retention and accountability, and an organization can fall into it without ever noticing it is there.

The fall happens because the two objects look adjacent. Both are records. Both are timestamped, both are stored, both can be produced when someone asks. So the organization that keeps exhaustive logs concludes, reasonably enough, that it has been thorough — that it has kept its accounts. It has not. It has kept a transcript of its own machinery and mistaken it for an explanation owed to a person. When that person finally arrives, asking why a decision went the way it did, the logs are handed over, and they are useless to the asker, because they were never written to the asker. They were written to the machine.

A log records what the system did for the system. A letter explains what the system did for the person it did it to. Only the second is an account.

What a recipient changes

The moment a record acquires a recipient, almost everything about it has to change. A log can assume context, because the engineer reading it shares the system's vocabulary; the letter can assume nothing, because the person reading it stands outside. A log can be a heap, because tooling will sort it; the letter must be ordered as an argument, because a human reads in sequence and reasons from it. A log can be silent about meaning — it states that a threshold was crossed, not what crossing it signified — but the letter cannot be silent about meaning, because meaning is the entire reason the recipient is reading. The recipient does not want to know that a value exceeded a bound. They want to know what was decided about them, on what grounds, and whether those grounds were sound.

This is why the discipline of provenance matters more than the discipline of retention. Retention is the log's virtue: keep everything, lose nothing, write it all down. Provenance is the letter's virtue: be able to say, of any claim in the account, where it came from and why it was trusted. A system can retain perfectly and account for nothing, because retention preserves the trace without preserving the reasons. The reasons are what the recipient is owed. A Decision Receipt is the attempt to write the letter at the moment the log is being written — to capture, alongside the machine's record of its own motion, the human-addressable account of why the motion was justified.

Writing the letter at the moment, not after

The temptation, once the distinction is clear, is to suppose the letter can always be composed later — that the log is the raw material and the account is a thing you assemble when someone finally asks. This is the most expensive mistake available, because the letter written after the fact is not a record of the decision; it is a reconstruction of it, performed by people who already know how it turned out and who are, however honestly, motivated to make the past look reasonable. The account composed in hindsight tends toward coherence, and coherence is exactly the property a real decision rarely had. A decision made in real conditions was uncertain, was made on partial information, weighed considerations that later proved irrelevant and skipped ones that later proved decisive. The honest letter says so. The reconstructed letter, written backward from the outcome, smooths all of that away and produces a clean story that no one actually lived.

So the letter has to be written when the log is written — at the moment of decision, with the inputs that were actually present and the reasons that were actually operative, before anyone knows whether the decision was right. This is harder than logging, and it is harder than reconstruction, because it demands that the system articulate its grounds in human terms at the instant it acts, when it has no incentive to and no certainty about what will matter. But it is the only point at which the letter can be honest, because it is the only point at which the writer does not yet know the ending.

The standard, then, is not whether a system records. Nearly all of them record; recording is cheap and the tooling is mature. The standard is whether, when the person finally comes asking, the system can hand them something written to them — something that explains, in language they can hold, what happened and why, and that was composed before the answer was known. A drawer full of logs is not that. It is a faithful transcript of a conversation the machine had with itself, and the person standing in the doorway was never part of it. Accountability begins the moment you stop writing for the machine and start writing the letter.

— Dispatches · Summit Cognitive