The receipt in the aggregate

There is a familiar way of thinking about a decision record that treats it as a private possession. It belongs to the person the decision was about. It exists so that one person, wronged or merely uncertain, can hold one decision up to the light and ask whether it was made fairly. That account is true, and it is the right place to begin. But it understates what a record is for, because it stops at the boundary of a single case. The deepest thing a per-decision record does, it does only when you have many of them, and you read them not one at a time but all at once.

A single Decision Receipt answers a single question: was this decision sound, on the evidence it actually used, under the rules that were active when it was made. That is a real question and a worthwhile one. But there is a second class of question it cannot touch alone. Is the system fair across the people it decides about? Has a rule that was reasonable when written quietly drifted into something it was never meant to be? Is there a bias here that no one chose and no individual case reveals, because in any single case the decision looks defensible? These are questions about the system, not the instance, and they cannot be asked of one record. They can only be asked of the pile.

What only the pile can show

Consider what becomes visible when you read a thousand records together that is invisible in any one of them. A pattern, first of all — the shape that emerges only at scale, the way a single grain of sand tells you nothing about the dune. A decision that lands harder on one group than another will, in any individual case, have a perfectly adequate local justification; the evidence was weaker, the threshold was met, the rule was followed. It is only when you lay the cases side by side, holding the justifications constant and varying the person, that the disparity surfaces. No single record is the evidence of unfairness. The aggregate is.

Drift, second. A rule does not announce that it has wandered from its purpose. It keeps applying itself, decision after decision, each application individually consistent with the last. The drift is the slow accumulation, the gradual migration of where the line actually falls, and you can only see it by reading the records in sequence and watching the center of mass move. A system that keeps each decision's active rules frozen inside the record gives you the instrument to measure that motion. A system that keeps nothing gives you a rule that is wherever it currently is, with no way to know where it used to be.

And bias of the quiet kind, third — the bias no one intended, that lives not in any single decision but in the correlation between decisions and something they should have been independent of. This is the hardest thing to find and the most important, because it is precisely the failure that hides behind locally reasonable accounts. You cannot interrogate it case by case. You have to be able to add the cases up.

One receipt is a remedy for a person. A thousand receipts are an instrument for an institution. The same artifact does both, but only the second saves the system from itself.

The audit needs something to audit

Here is the consequence that follows, and it is not optional. A system that keeps no per-decision record cannot be audited in the aggregate either, because there is nothing to add up. Oversight of a decision-making system is not a separate apparatus that can be bolted on later; it is, at bottom, the act of reading many decision records and looking for what no single one reveals. If the records were never kept, the aggregate does not exist. You can survey the people affected, you can sample outcomes, you can run the system again on synthetic cases — but you cannot reconstruct what actually happened across the real population of decisions, because the actual evidence and the actual rules and the actual reasoning were not preserved at the moment each decision was made.

This is why the case for per-decision records does not rest only on the individual's right to contest. That right is real and sufficient on its own terms. But even an institution that cared nothing for the individual and only for its own governance would still need the records, because they are the raw material of every honest audit it will ever run. The data from which systemic failure becomes visible is the same data the wronged individual needs to fight a single decision. They are not two requirements. They are one artifact serving two ends, and a system built without it forfeits both at once.

There is a tempting shortcut here, which is to keep statistics instead of records — to log the rate, the distribution, the summary, and discard the underlying decisions. This fails for the same reason a summary fails the individual. A statistic is a claim about the records that you cannot check against the records, because the records are gone. When the aggregate looks wrong, you need to descend back into the particular cases to find out why, and a system that kept only the aggregate has nowhere to descend to. The pile is not redundant with the summary computed from it. The pile is what lets you doubt the summary.

So the per-decision record is doing quiet double duty every time it is written. It is a receipt for the person, kept against the day they want to contest. And it is one entry in a ledger that, read whole, is the only thing that lets anyone — a regulator, an internal reviewer, the institution's own future self — see the system clearly enough to find the failure that no single decision would ever confess. Keep the records, and you can both answer the individual and audit the whole. Keep nothing, and you can do neither, and you will not even know what you cannot see.

— Dispatches · Summit Cognitive