The argument in one minute
Recording changes power. A system capable of preserving contribution evidence can also preserve accusation, error, evaluation, inference, uncertainty, and adverse judgments.
1. The missing constitutional layer
A provenance institution cannot credibly protect contributors from institutional amnesia while giving institutions unilateral power over the memory that replaces it. Durable records can make useful evidence portable, but they can also make mistakes and adverse judgments portable. Procedural protections therefore belong inside provenance governance rather than outside it.
2. Who is a recorded contributor?
A recorded contributor is any identifiable or lawfully pseudonymous person whose alleged or verified contribution, participation, performance evidence, attribution, allocation, use history, dispute status, or related metadata is preserved in a provenance process and may reasonably affect a decision concerning that person or a claimed contribution.
Rights attach to procedure
A person can have procedural rights even when a system later finds that a claimed contribution was not material, was misattributed, or creates no entitlement.
The person is not the asset
The object of recording should remain a defined contribution, transaction, use, or evidentiary event. Dignity, citizenship, basic rights, essential services, and equal legal standing cannot be made conditional on an aggregate contribution score.
3. A proposed bill of procedural rights
1. Notice
Intelligible notice when a contribution is intentionally recorded, when new evidence materially changes the record, when the record enters a new evaluation process, and before a materially different use where feasible.
2. Access
Ability to inspect materially attributed evidence, claim status, lawful source or attestation class, material inferences, and consequential uses.
3. Correction
A practical mechanism to identify inaccurate, incomplete, duplicated, stale, or misattributed provenance and submit corrective evidence.
4. Methodological contestation
Ability to challenge the value function, baseline, comparison group, counterfactual method, materiality threshold, interaction or substitution treatment, temporal assumptions, and allocation rule when consequential.
5. Uncertainty disclosure
Clear distinction among observed facts, attestations, model outputs, causal estimates, allocation choices, and legal determinations.
6. No automated judgments of personal worth
A contribution record must not become a general judgment of moral worth, civic worth, dignity, employability, creditworthiness, essential-service eligibility, or social standing.
7. Privacy and purpose limitation
Collect and expose only what is reasonably necessary; prohibit silent repurposing for unrelated surveillance, profiling, ranking, marketing, credit scoring, or exclusion.
8. Withdrawal, expiration, reuse, and transfer
Specify what can be withdrawn, what must remain for audit or lawful reliance, when claims expire or need revalidation, and how downstream reuse is governed.
9. Independent appeal
Material disputes should reach a reviewer institutionally independent from the actor that created the record or selected the disputed method.
10. Protection against retaliation
Invoking access, correction, contestation, optional refusal, good-faith claims, assistance, or appeal should not itself trigger unrelated penalties.
4. Consent is necessary but not sufficient
The framework treats consent as important but insufficient by itself. Employment, platform participation, research, public administration, regulated markets, and collaborative production may involve unequal bargaining power, legal duties, third-party interests, or records that cannot depend on unilateral permission.
5. Contestability across the canonical sequence
| Stage | Question | Minimum protections |
|---|---|---|
| Provenance | What happened, who participated, and what evidence supports the record? | Notice, access, correction, source/status labeling, privacy, purpose limitation. |
| Performance | What outcome occurred and under what measurement conditions? | Access to metrics, domain validity, measurement limitations, correction of erroneous inputs. |
| Attribution / Allocation | How are recorded inputs related to outcomes, and under what allocation rule? | Method disclosure, contestation, uncertainty, alternative-model review, independent appeal. |
| Entitlement / Payment | What rule creates an enforceable consequence? | Notice of rule and decision, reasoned determination, appeal, anti-retaliation, law-consistent enforcement. |
6. Correction without historical erasure
The framework rejects both silent deletion and immutable error. The historical fact that a claim once existed can remain in a restricted audit history while present views and consequential decisions carry the corrected status. If a record remains disputed, the dispute itself should be visible where the unresolved status matters.
7. Exit, expiration, and the limits of persistence
Expiration and revalidation
Facts can remain historically true while becoming weak evidence for a current decision. Domain rules may require revalidation when measures, attestations, models, or contexts become stale.
Withdrawal and future use
Withdrawal should ordinarily end optional future processing to the extent promised, while preserving completed transactions, lawful audit history, counterparty evidence, and records another institution must legally preserve.
Transfer of economic interests
Transfer of a license, royalty interest, security, or other economic claim should not automatically transfer unlimited control over identity or personal data.
8. Independent review as an institutional requirement
A provenance institution becomes vulnerable to capture when the same actor controls evidence collection, measurement, attribution, enforcement, and appeal. The paper does not prescribe one universal review body. It identifies functional independence, an opportunity to be heard, a reasoned disposition, and a correction path proportionate to the consequence as the core requirements.
9. Anti-retaliation and unequal bargaining power
Formal rights can become hollow if invoking them threatens employment, contracting, platform access, funding, distribution, licensing opportunities, or other unrelated interests. Anti-retaliation protection therefore covers the act of using the process rather than guaranteeing that the underlying contribution claim is correct.
10. The economic-surveillance objection
The paper treats the strongest criticism of contribution provenance as the possibility that it succeeds too well. Continuous measurement of work, creative activity, collaboration, use, reputation, performance, and downstream effects can become infrastructure for monitoring persons.
Purpose limitation, data minimization, selective disclosure, bounded retention, correction, independent review, and protection against generalized human ranking are therefore constitutive safeguards. If a deployment cannot supply them proportionately, the framework allows the conclusion that provenance should not be deployed in that domain.
11. Rights by design for bounded demonstrations
A bounded pilot should test rights performance as seriously as attribution performance. The paper proposes examining whether contributors actually receive notice, understand purpose, obtain usable access, correct errors, challenge methodology, see uncertainty, restrict secondary use, exit where promised, obtain independent review, and invoke rights without retaliation.
12. Frequently asked questions
Do these rights guarantee a favorable outcome?
No. Access is not acceptance, contestation is not a larger allocation, appeal is not a right to prevail, and optional withdrawal does not erase lawful obligations or records.
Does every record require consent?
No. The proposal distinguishes consent from other possible warrants such as contract, law, safety, audit, or another legitimate institutional function, while requiring the basis to be identified rather than disguising compulsion as consent.
Can access be limited for trade secrets or third-party data?
Yes. The paper permits redaction, controlled review, summaries, or independent inspection where confidentiality, security, or third-party rights require it, provided the contributor can still meaningfully understand and contest a consequential decision.
Does withdrawal require deleting history?
No. The framework distinguishes prospective exit from rewriting historical fact and allows necessary audit history to remain while optional future processing ends.
Are these proposed rights already a unified legal regime?
No. The paper presents them as institutional safeguards to be tested and adapted to the governing domain and jurisdiction.
13. Read the paper and understand its status
Selected references
- Bovens, “Analysing and Assessing Accountability” (2007).
- Citron, “Technological Due Process” (2008).
- Crawford, Atlas of AI (2021).
- Fung, Graham, and Weil, Full Disclosure (2007).
- Hess and Ostrom, Understanding Knowledge as a Commons (2007).
- Lessig, Code and Other Laws of Cyberspace (1999).
- Nissenbaum, Privacy in Context (2010).
- Ostrom, Governing the Commons (1990).
- Solove, Understanding Privacy (2008).
- Zuboff, The Age of Surveillance Capitalism (2019).