The vendor is not the witness

There is a sentence that surfaces whenever an automated decision is challenged, and it is always offered in the same reassuring register, as if it settles the matter rather than evades it. Our vendor's system determined it. The phrasing does a great deal of quiet work. It relocates the decision somewhere else, names a party with apparent technical authority, and implies that the question has already been answered by someone more qualified to answer it. What it actually does is borrow standing from a party who was never in the room and cannot be brought into it.

Notice what the sentence asks you to accept. It asks you to treat the vendor as a kind of witness — the entity that knows what happened and can vouch for it. But the vendor was not present when your case was decided. The vendor sold a system; it did not adjudicate you. And it is not standing where you can question it. You cannot put a procurement relationship under oath. You cannot cross-examine a license agreement. The authority being invoked belongs to someone who, by the structure of the arrangement, is absent and unreachable — which is exactly the kind of authority that should not be allowed to decide anything that affects a real person.

A witness, in the sense that matters here, is not whoever has the most impressive claim to know. A witness is someone present, answerable, and available to be tested — someone who can be asked how do you know that and required to respond. By that standard the vendor is disqualified twice over. It was absent at the moment of decision, and it is shielded from examination afterward by contract, by trade secrecy, by the simple fact that it has no relationship with the person harmed. To name it as the source of authority is to point at an empty chair and call it the expert.

Borrowed authority from an absent party

The deeper move is a transfer of authority that was never the vendor's to lend. The vendor built a general capability. It did not look at your circumstances and reach a judgment; it sold a tool, and someone else pointed that tool at you and acted on what came out. The decision that affected you was not made by the vendor. It was made by the party who chose to deploy the system, fed it this input, and treated the output as authoritative enough to act on. That choice is the decision. Everything upstream is provenance.

This is why "our vendor's system determined it" is not an account but a deflection. It tries to convert a question about a specific decision — yours — into a question about a general product, which the speaker can then decline to answer on the grounds that the product belongs to someone else. The sleight is to make the chain of supply do the work that only an examinable record can do. But where a thing came from is not the same as whether it was sound. Provenance tells you the lineage of the output. It does not tell you whether acting on it, here, in your case, was justified.

Pointing at the vendor answers the wrong question. The question was never who built the system. It was who relied on it, and what they can show for it.

And the party who relied on it cannot escape that question by gesturing upstream. When you act on an output — when you turn it into a denial, a flag, an adverse decision against a named person — you have adopted it. You have made it yours. The duty to account for a decision attaches to the act of deciding, and deploying a system to decide is still deciding. You cannot outsource the judgment and keep the duty parked with the supplier, because the supplier never assumed it. Duties do not travel down a purchase order. They stay with whoever pulled the trigger.

The duty stays with the buyer

Which means the obligation is exactly where intuition says it should not be: not on the party who built the powerful thing, but on the more ordinary party who chose to rely on it. The buyer who acted on the output is the one who owes the record. Not a screenshot of the vendor's interface. Not a clause in the master services agreement naming the vendor as the source of the determination. An actual account of this decision — the evidence that was in front of it, the rules that were active when it was made, enough state to reconstruct and replay it — held by the party who acted, because that party is the one present and answerable.

This reframes what a responsible buyer of automated decisioning is actually procuring. It is not enough to acquire a capable system and inherit its confidence. What has to be acquired alongside it is the ability to produce, for any decision made and acted upon, a record that the buyer can stand behind in person. The vendor's brochure is not that record. The vendor's reputation is not that record. A Decision Receipt that the deploying party holds and can defend on its own terms is. The provenance of the model is a fact about the supply chain; the account of the decision is a fact the buyer owes, and owes alone.

So when the sentence arrives — our vendor's system determined it — the right response is to decline the relocation. The vendor is not the witness, because the vendor is not present and cannot be examined, and the decision in question was not the vendor's to make. The witness is the party who acted: the one who took the output, treated it as authority, and turned it into a consequence for someone with a name. That party can either produce a record that answers for the decision, or it cannot. There is no third party to hide behind. There never was.

— Dispatches · Summit Cognitive