Who keeps the key

We talk about records as though their virtue lives entirely in their contents — as though a complete and honest account, once written, simply is what it says it is. But a record is not only a set of statements. It is a set of statements held by someone, somewhere, under some arrangement that decides who may read it, who may change it, and who may make it disappear. Those arrangements are not a clerical footnote to the record. They are part of what the record means. A faithful account in the sole keeping of the party it would condemn is a different object, with different evidentiary weight, than the identical account kept somewhere that party cannot reach.

This is the part of provenance we tend to skip. We ask whether the record is accurate. We less often ask who holds it, and what that holder is able to do to it between the moment of the decision and the moment someone asks to see it. Yet the second question can quietly dissolve the first. An accurate record under the exclusive control of an interested party is accurate only for as long as accuracy serves that party. The contents are hostage to the custody.

A record you cannot reach is a record someone else can revise. Custody is not where the record is kept. It is who gets to decide what the record was.

Custody is an allocation of power

Begin with the plainest version. Suppose a decision affects you, and the only record of how it was made is held by the institution that made it — on its systems, under its administrators, governed by its retention choices. When you ask what happened, you are not consulting a record. You are asking a party with an interest in the answer to tell you what its own record says, after whatever interval it chose, in whatever form survived its own housekeeping. The institution is, at once, the actor being judged, the author of the account, and the keeper of the only copy. Each of those roles is reasonable on its own. Together, in one set of hands, they make independent scrutiny structurally impossible, because there is no version of events that the judged party did not have the standing and the means to shape.

This is why custody is correctly understood as an allocation of power, not a matter of storage. To hold the record exclusively is to hold the account. To hold the account is to hold the ability to determine, after the fact, what the decision will be remembered as having been. Whoever can edit the record can edit the past; whoever can withhold it can edit the present; whoever can lose it can edit it out of existence. None of these powers requires bad faith to be dangerous. They only require that the power exist and sit with the party who would benefit from using it — because the mere possibility erodes the trust the record was supposed to supply.

Integrity is what makes the contents survive the custodian

The remedy is not to find a custodian we trust more. Trust in the custodian is exactly the thing a record is supposed to let us do without. The remedy is to build the record so that its integrity does not depend on the goodwill of whoever happens to hold it — so that any change to it is detectable, any version of it is verifiable against the one made at the time, and no single party can present a quietly altered account as the original. When integrity is structural, custody loosens its grip on meaning. It no longer matters quite so much who keeps the record, because no keeper can change what the record was without the change itself becoming visible.

That is the real point of provenance applied to decisions. It is not nostalgia for paper or suspicion of institutions. It is the recognition that a record's value to a person who was not in the room depends entirely on whether that person can be sure they are seeing the thing as it was, and not as it became convenient. A record whose integrity can be checked independently of its holder is one the holder cannot silently rewrite. A record that travels with the means of its own verification is one that does not require you to take the custodian's word for the custodian's conduct — which is precisely the word you have least reason to take.

So the question to ask of any decision that claims to be on the record is not only what the record says. It is: who keeps the key, and what can they do with it that I would never see? If the only copy lives with the party who would be judged by it, you do not have an independent record; you have that party's standing offer to remember the matter in its own favor. The contents may be true today. But truth held at someone else's discretion is not evidence. It is a courtesy — and a courtesy can be withdrawn the moment it stops being convenient to extend.

— Dispatches · Summit Cognitive