The half-second nobody saw

There is an old, comfortable assumption buried in how we think about records, and it goes like this: the record is a backup. Something happened, people saw it happen, and the record is there to settle disputes about the details — to refresh failing memories, to adjudicate between accounts, to fix in writing what would otherwise blur. On this picture the record is secondary. The primary event is the witnessed event; the record merely preserves a copy. For most of human affairs this assumption was sound, because most consequential things took long enough to be seen while they were happening.

That assumption has quietly stopped being true for an enormous and growing class of decisions. An automated system can evaluate a transaction, consult its inputs, apply its rules, and commit to an outcome in a span of time too short for any human to observe. Not too short to review afterward — too short to witness. By the time a person could in principle have looked, the deciding is already over. There was a moment in which the decision was made, and that moment had no occupant. It was not slow enough to be seen.

This changes what a record is for, and it does so completely. If no one watched the event, the record is not a backup of anyone's memory, because there is no memory to back up. The record is not a copy of the primary event. It is the primary event, as far as anyone will ever be able to reach it. Everything we will ever know about what happened in that half-second, we will know through whatever the system chose to keep. There is no eyewitness standing behind the record to correct it. The record is the witness, or there is none.

The record stops being secondary

It is hard to overstate how large a shift this is, precisely because it is so quiet. For nearly all of history, if a record was incomplete, you could go back to the people who were there. The record was checkable against something outside itself. A clerk could be questioned, a participant could be deposed, a gap in the minutes could be filled from recollection. The written account lived inside a web of human memory that could ratify or contradict it. That web is what made an incomplete record survivable: the record was not load-bearing on its own.

Strip away the witness and the record becomes load-bearing in a way it never was before. Its omissions are no longer gaps that something else can fill; they are simply the edge of the knowable. If the system did not capture the evidence it actually consulted, that evidence is gone — not misremembered, gone. If it did not preserve the rules that were in force at that instant, no one can reconstruct them from memory, because no one was there to remember. The selectivity of the record is no longer a matter of convenience or storage cost. It is a decision about how much of reality will continue to exist.

Where no one watched, the record is not a copy of what happened. It is the entire surviving extent of what happened, and its silences are permanent.

This is why the design of the record can no longer be an afterthought left to whoever builds the logging. When the record is the only witness, the question of what it captures is the question of what can ever be known, contested, or corrected about the decision. A record that keeps only the outcome and discards everything that produced it has not saved space; it has destroyed the only existing account of an event no human ever saw. The verdict survives; the reasoning that no one watched is annihilated. We have kept the verdict and thrown the minutes away, and in the witnessed world that was merely careless. In the unwitnessed world it is the deletion of the one and only testimony.

Designing for the absence of an eyewitness

If the record is the sole witness, it has to be built to the standard we would demand of one. A witness we trust is a witness who can be cross-examined — whose account exposes enough of what it saw that we can test it rather than simply accept it. The equivalent, for a record, is not more narrative. It is more substance: the evidence the decision actually consulted, in the order it was consulted; the rules that were active at the precise moment, frozen as they stood; and enough state that the decision can be replayed against exactly what it knew. A record that carries those things can be interrogated by someone who does not trust it, which is the only kind of witness whose word is worth anything.

And the record has to be honest about its own integrity, because there is no second witness to catch it out. In a witnessed world, a falsified account could be contradicted by the people who were present. In an unwitnessed world, the record's provenance has to do that work itself — it has to be verifiable that the account has not been altered since the moment it was made, because no living memory stands ready to say otherwise. Provenance is not a technical nicety here. It is the substitute for the corroborating witness who no longer exists.

The deepest mistake we can make about automated decisions is to keep treating their records as conveniences — nice to have, helpful for audits, a supplement to what people already know. That mental model was formed in a world where people were there. For the decisions that now happen in a half-second no one saw, the record is not a supplement to anything. It is the whole of the evidence, the only testimony, the single thread connecting a consequential act to anyone who might later need to understand it. Build it as though nothing else will ever exist to corroborate it, because for that half-second, nothing does.

— Dispatches · Summit Cognitive