The cost of a good record

The strongest objection to admissibility-grade records is not a quibble about feasibility. It is a true statement: they cost something. Capturing the evidence a decision actually consulted, with its provenance intact, costs engineering. Freezing the rules as they stood at the moment of decision costs storage and discipline. Preserving enough state to replay the decision later costs more storage still, and care about what counts as state. Signing each record and chaining it to the ones before costs a little latency and a permanent obligation to manage keys. None of this is rhetorical inflation. A serious person who builds systems will feel each of these costs in their schedule, their bill, and their patience, and they are right to. The worst thing you can do with a real objection is wave it away.

So I want to take it seriously, and then argue that it is the wrong question. "Is the record free?" has a clear answer, and the answer is no. But that was never the question that mattered. The question that matters is comparative: what does the alternative cost? Every decision is going to be recorded somehow — in a logline, a memo, a screenshot, a vague institutional memory, or nothing at all. The choice is not between an expensive record and no expense. It is between paying for a record you can stand behind and paying, later, for one you cannot.

Two bills, paid on different days

The two costs have profoundly different shapes, and the shape is the whole argument. The cost of a defensible record is paid up front, in small visible increments, on every decision, whether or not that decision is ever questioned. It is steady, predictable, slightly annoying, and almost entirely wasted in the narrow sense that most decisions are never contested. You can see this cost. It shows up in code review and on invoices. It is exactly the kind of cost a quarterly mind learns to resent.

The cost of having no defensible record is paid rarely, all at once, and catastrophically — on the one day the decision is questioned and you have nothing to offer but your own assurance that you did the right thing. It is the dispute you lose for lack of evidence you could have kept. It is the regulator's finding you cannot rebut, the customer you cannot win back, the failure you cannot explain to the people it touched. And it is the trust that does not return, because trust does not survive an account of the form we believe we acted correctly but cannot show you how. This cost is invisible right up until it is the only thing you can see.

The record's cost is paid in advance, in coin, by the person who chose it. The alternative's cost is paid later, in full, and usually by someone who didn't.

That last asymmetry is the one institutions are quietest about. The person who decides to skip the record is rarely the person who absorbs the consequence of its absence. An engineer under a deadline declines to capture provenance; two years later it is a different team, or the customers, or the public, who discover that the decision affecting them cannot be reconstructed. The up-front cost and the back-end cost fall on different people, which is precisely why a rational individual can keep choosing wrong while a rational organization keeps wishing they wouldn't. Misaligned incentives wear the costume of prudence. "We don't have budget for that" is often true, and is also, often, a sentence whose subject and object are different people.

Match the rigor to the stakes

None of this means every decision deserves an admissibility-grade record. That would be its own kind of unseriousness — a tax levied without regard to what it is protecting. Most decisions are reversible, low-consequence, and self-correcting; recording them with the full apparatus of provenance, frozen rules, and replayable state would be like notarizing a grocery list. The discipline is not maximalism. The discipline is proportion: match the rigor of the record to the consequences of the decision, and be honest about which decisions are which.

A throwaway action and an irreversible one do not deserve the same treatment. Choosing the color of a button and approving a loan are both decisions, but only one of them will ever be the subject of a complaint that turns on what was known and what rule applied. The skill worth developing is the triage: looking at a decision before you make it and asking how badly it could go, who would be harmed, whether the harm could be undone, and whether anyone would later be entitled to an account. Where the answer is "not much, no one, easily, no," keep a light record or none. Where it is "severely, someone specific, never, yes" — the consequential decisions, the irreversible ones, the ones that touch people who did not consent to be touched — that is where the full cost is not a cost at all but a price worth paying. The error is not recording too much. It is recording uniformly: lavishing care on the trivial and improvising on the grave.

This reframes the original objection one last time. The person who says "admissibility-grade records cost too much" is usually, on inspection, objecting to applying them everywhere. Fair. But the live question is never "everywhere." It is "here, on this decision, given what it can do to whom." Answered decision by decision, the cost stops being a flat tax and becomes an investment sized to the exposure — which is what every other form of insurance already is.

Insurance you write before you know

That is the right name for it. A good record is insurance you write before you know you need it, on a decision you cannot yet tell will be the one that gets challenged. Like all insurance, it looks like pure cost on every day it is not used, and like the only sane thing you ever did on the day it is. You do not buy it because you expect the fire. You buy it because the cost of being uncovered when the fire comes is not survivable, and because you cannot tell in advance which building burns.

So the people who keep defensible records are not paranoid, and it is worth retiring the suggestion that they are. They have simply done the arithmetic that the asymmetry demands: a known, bounded, up-front cost against an unknown, unbounded, deferred one — and concluded that on the decisions that matter, paying in advance is cheaper than paying in arrears. That is not anxiety. That is solvency. The paranoid keep records they will never need against threats that will never come. The solvent keep records proportional to consequence, and can therefore, when the day comes, simply show their work. Everyone else is uninsured and calling it efficiency.

— Dispatches · Summit Cognitive