The Price of Perfect Memory
You could not be born at a better period than the present, when we have lost everything.
— Simone Weil, Gravity and Grace (1947)
The first three equations describe what systems must do. The fourth becomes visible only when the machinery of proof is working, because the same architecture that makes authority legible also expands what institutions can preserve and combine about a person.
A system may satisfy the five witness properties, bind coercive acts to receipts, divide power against capture, and survive adversarial pressure. Without limits on retention and composition, every attested fact about a person (every transaction processed, every credential verified, every receipt issued, every dispute filed, every appeal adjudicated) can travel to any context and compose with every other attested fact. The result is a portrait of comprehensive fidelity whose facts may be accurate and whose reach may be inescapable. It becomes, in the most important sense, a lie when the institution treats the sum of a person's documented past as equivalent to the person herself. Persons are not sums.
The danger does not arise because the witness protocol failed. It arises because the protocol makes truth durable, the receipt regime makes power legible, and the constitutional machine resists capture while none of them, by itself, limits how long a true record may govern a life. Success without that limit produces a system that remembers everything, composes everything, and never lets go.
Constitutional protections operate at two points in time. Before imposed coercion becomes practically final, notice, deliberation, and appeal must be able to catch it; there the mismatch is between the tempo of the act and the tempo of contest. The problem here begins after the act has entered the record. The question is how long that record may supply a reason for another institution to act against the same person. Durable, composable memory allows one decision to continue through later decisions that its author never considered. This concern is limited to imposed coercion. Parties may bargain for final settlement, and records of public or platform power must remain available so the authority can answer for what it did. The asymmetry concerns the governed person: proof of a past act can outlive the period in which that act remains a sufficient reason to constrain her.
Theologians would recognize the problem immediately. Confession and absolution, developed over centuries in the Catholic Church, joined a pastoral practice to a theory of personhood: genuine contrition could mark a break in moral continuity. The secular tradition arrived at a similar insight by a different path. Enlightenment theories of punishment assumed that punishment, properly calibrated, could reform an offender and that the reformed person had claims upon society the unreformed offender did not. Both traditions recognized what the perfect-memory system denies: persons change, and a just society must acknowledge the change.
The receipt regime is right about power and incomplete about persons. A system that remembers every exercise of coercive authority must also release its grip on the people subject to that authority. The release requires a deliberate constitutional choice: records that expire, limits on composition across domains, and places where the past loses jurisdiction over the future.
David
David is thirty-four years old and a licensed nurse. He works overnight shifts in the ICU, where his colleagues trust him with the hardest hours because he is calm under pressure and meticulous with dosages: two qualities that the person who stumbled into the emergency room at twenty-two would not have been able to claim. He coaches his daughter's soccer team on weekends. He volunteers at a clinic in the neighborhood where he grew up.
David is a composite built from familiar records and legal mechanisms. His dates, occupations, scores, and retention periods are illustrative; the constitutional question does not depend on any one calibration.
Between twenty-two and twenty-six, David was a different person, not literally, but in the sense that matters for institutional evaluation. At twenty-two, an emergency-room visit for alcohol poisoning. At twenty-three, a misdemeanor conviction for disorderly conduct, community service completed, and a termination from a restaurant job for chronic lateness during the worst of his drinking. At twenty-four, a student loan default during a period of unemployment. At twenty-five, an eviction proceeding dismissed after he paid the overdue rent, and enrollment at a community college. At twenty-six, a bankruptcy filing, discharged at twenty-seven. Between twenty-one and twenty-four, a series of social-media posts expressing political views he no longer holds and personal circumstances he would prefer not to be defined by.
The transformation was not miraculous. It was ordinary: the slow, grinding, undramatic work of changing one's life, day by day, over a decade. He stopped drinking. He paid his debts. He went back to school. He studied pharmacology and anatomy and the ethics of patient care. He passed his boards. He showed up, every shift, for four years. His credit score climbed from the low 500s to the mid 700s over eight years. The nursing degree, the licensure, the clean employment record: all document the transformation. But in a system of perfect memory, the transformation competes with the crisis for institutional attention, and the crisis has a structural advantage: it is specific, dramatic, and easily categorized, while the transformation is diffuse, gradual, and resistant to summary.
In the system as built (receipts permanent, composition unlimited) an employer running a background check on David at thirty-four encounters the ER visit, the misdemeanor, the loan default, the bankruptcy, the eviction proceeding, the employment gap, and the social-media archive, all composable into a single portrait that determines what he can do, where he can live, who he can be. The person those records describe no longer exists. The records do not know this.
Designed Forgetting
Five operations constrain the record's jurisdiction over David's future.
His emergency-room visit is twelve years old. Under expiration rules, health records related to substance use that are more than seven years old and not associated with ongoing treatment leave the composition space. An employer running a background check cannot see it. An insurance company pricing a policy cannot use it. The record still exists in the hospital's archive, accessible by court order if a future medical emergency requires the full history. But it no longer speaks in contexts where it has no legitimate business.
His misdemeanor conviction, completed with community service, is sealed. It appears in a law-enforcement database accessible to courts and certain governmental agencies. It does not appear in commercial background checks. Sealing distinguishes between the state's legitimate interest in maintaining a criminal record for sentencing purposes and the illegitimate interest of commercial actors in using a twelve-year-old misdemeanor to evaluate a person's current fitness.
Aggregation limits prevent any single system from composing David's records across more than three domains without his explicit consent. A background-check company may query each domain separately and report what it finds, but it may not join health, criminal, and financial records into a single cross-domain portrait. This prevents the composition pathology: aggregation of individually innocuous facts into a comprehensive assessment that exceeds any individual system's jurisdiction.
Separation enforces boundaries between David's social-media archive and his professional records at the protocol level. An employer may evaluate his nursing credentials and employment history. The employer may not access social-media posts from a period that predates his current career. Systems holding social-media data and those holding professional credentials are barred from communicating without David's authorization.
The eviction proceeding, dismissed after payment, is subject to jurisdictional amnesty for dismissed housing cases older than five years. David can rent an apartment without explaining a resolved legal action from nine years ago. The amnesty reflects a legislative determination that dismissed cases (cases in which the court found no ongoing obligation) should not burden the respondent's housing prospects indefinitely. Whether the amnesty applies to cases dismissed within thirty days or ninety days, whether it has exceptions for property damage or repeated nonpayment: these are political decisions made by the jurisdiction that administers the housing database. The architecture provides the mechanism by which the decisions, once made, are enforced at the protocol level.
David at thirty-four, under this architecture, is evaluated on the basis of his current credentials, his current employment record, and his current financial standing. The records of his difficult years exist: archived, sealed, separated, expired as appropriate. They are not destroyed. They are bounded, in the same way that the writ of habeas corpus does not free the prisoner but bounds the detention by requiring that it be justified, reviewed, and limited in duration.
These limits do not require David to prove that every institution must ignore his past. They change who must justify its use. If a hospital believes the old emergency-room visit or misdemeanor still bears on this nursing role, it must identify the present safety concern and explain why current licensure, four years of performance, and intervening conduct do not answer it. A limited inquiry may be warranted. It does not authorize the record's use by a landlord, lender, insurer, or unrelated employer, and it does not begin a new period of unrestricted use. Where practicable, David receives notice before an adverse act. The resulting decision must name its purpose and duration and carry independent review, a receipt, and an appeal.
A society that treats the twenty-two-year-old's emergency-room visit as permanently relevant to the thirty-four-year-old's employment prospects has confused documentation with identity and memory with justice.
What Designed Forgetting Is Not
Designed forgetting is broader than deletion. Some records may be destroyed after a lawful retention period; others remain sealed, segregated, or available only under stated process. A court may unseal a record for cause, and a medical emergency may justify access to an archive under rules set in advance. What ends is automatic availability for composition by actors with no legitimate claim to the record.
Four questions must remain separate. Did the event occur? May an institution retain the record? Who may access it, and for what purpose? May it materially support a present adverse act? The last question concerns the record's coercive jurisdiction. A record can remain true, retained, and accessible for a defined purpose while losing authority over an unrelated decision.
Every memoir is an act of designed forgetting: the assertion that some events matter more than others, that the person who emerges from the telling is not identical to the sum of what happened. Designed forgetting is not forgiveness. Forgiveness is a moral act performed by one person toward another: it requires a wronged party, a wrongdoer, and a relationship between them. Designed forgetting is an architectural constraint performed by a system on its own memory. The system does not forgive David. It lacks the capacity for forgiveness. What it does is refrain from presenting David's past to every institution that queries him, acknowledging that persons change and that the past's jurisdiction over the future must have limits. The restraint is constitutional: required by the same architecture that requires the receipt. Receipts constrain power by making it visible. Designed forgetting constrains the receipt by making it finite. Without the constraint, the receipt becomes a tool of the power it was designed to check.
Designed forgetting is not privacy. Privacy prevents information from being collected. Designed forgetting limits the use of information already collected. The receipt regime requires collection: every exercise of power produces a receipt, and receipts are records. A system cannot simultaneously produce receipts and prevent the existence of records. What it can do is constrain the scope and duration of the records' availability, and the constraint is what makes the receipt regime compatible with the possibility of personal transformation.
Fragments of designed forgetting already exist in law. Juvenile record sealing acknowledges that a sixteen-year-old's actions should not determine a twenty-five-year-old's possibilities. Bankruptcy discharge acknowledges that a person who has submitted to the discipline of the process should be able to re-enter economic life without carrying the failure permanently. The European Union's right to be forgotten acknowledges that search engines should not present outdated personal information indefinitely. Empirical work on criminal records has estimated when rearrest risk approaches the arrest risk of same-age people in the general population, with different intervals by age and offense; those estimates can inform calibration but cannot determine the constitutional rule.1 Pennsylvania's limited-access statute supplies a narrower legal analogue: specified records become subject to restricted dissemination after stated conditions, while exceptions and criminal-justice access remain.2 Each mechanism is partial, domain-specific, and contested. What they share is a structural commitment: the past does not own the future, and systems that remember everything must be taught when to let go.
There is an asymmetry in who is building. Every mechanism on the memory side of this architecture has engineers today: logs that cannot be rewritten, records that any stranger can check, provenance that survives its author. Permanence is the direction that comes cheaply: a record persists by default, and an industry exists to make it persist more durably still. The forgetting side has fragments of law, and engineering only where the law has forced it: delisting pipelines, records that age off credit reports on statutory schedules. What has no engineers is the harder object the constitutional principle below requires — a record that remains checkable while it can be contested and then verifiably loses its force, expiration a stranger can confirm rather than a deletion the operator merely promises. In practice, then, deletion is already well supplied with engineering effort, whereas verifiable forgetting attracts almost none — largely because no one is yet paid to produce it. The architecture this chapter describes is therefore not a refinement of the memory infrastructure now being assembled, but the part of it that will be left unbuilt unless someone sets out to build it.
The Constitutional Principle
The architecture must encode a temporal asymmetry. Power-time is eternal; person-time is mortal.
Receipts for the exercise of authority persist indefinitely. The liquidation, the denial, the freeze, the suspension: these must remain inspectable as long as the institution that issued them exists. An institution that exercised coercive power fifty years ago must still answer for that exercise. Institutions do not have the capacity for transformation that persons do; the institution that denied a loan in bad faith in 1975 is structurally continuous with the institution that operates today, and the receipt of the denial is the mechanism of accountability.
Records of individual conduct must be capable of expiration, sealing, separation. The borrower who defaulted at twenty-two may be creditworthy at forty. A former convict who served his time and built a new life may be an exemplary neighbor. The person who expressed foolish opinions at nineteen may be a thoughtful citizen at thirty-five. Perfect memory denies all three possibilities. Designed forgetting restores them.
Without this asymmetry, the receipt regime becomes a system of permanent caste. A person flagged at twenty-two carries the flag forever. It composes with every other record, producing a portrait that determines what David can do, where David can live, who David can be. The receipt supposed to constrain power becomes a tool of power: wielded by institutions to determine David's future from David's past. Sociologists call this credentialed exclusion: formal records creating barriers to participation that persist long after the underlying condition has changed. A criminal-record check preventing a reformed offender from obtaining housing. A credit report presenting an eight-year-old bankruptcy as evidence of current unreliability. An employment gap raising questions regardless of what happened during the gap. In each case the record is accurate; the person has changed; and the system cannot perceive the change, because the system's perception is constituted by the record. Designed forgetting does not falsify the record. It constrains the record's jurisdiction (limiting the domains in which it can speak and the duration for which it speaks) so that the person standing before the institution is evaluated as the person she is, not as the person she was.
The Irreducible Human Element
The five operations of designed forgetting—expiration, sealing, aggregation limits, separation, and amnesty—can be automated once a legitimate authority sets their rules. The hard question is who sets the rule, hears the exceptional case, and answers when its application becomes unjust. That decision is moral and political before it is computational.
An arbiter deciding that David's twelve-year-old emergency-room visit should expire is making a judgment about David's capacity for change. A legislature granting amnesty for dismissed eviction cases is making a judgment about whether a society wants to permanently punish resolved disputes or allow people to move on. A court sealing a juvenile record is making a judgment about whether a sixteen-year-old's actions should determine a twenty-five-year-old's possibilities.
No default settles every case. A seven-year rule may be defensible in one domain and dangerous in another; even a well-calibrated rule will produce exceptional cases in both directions. Rules provide the baseline. Arbiters hear claims that the baseline has failed in application and give reasons that can be reviewed.
Those rules govern constitutional release rather than forgiveness. They stop an old record from deciding the case before judgment begins. A deterministic sunset and an exception classifier can each apply a rule, but neither can own the later judgment that the rule does not settle.
The architecture places an answerable human institution at its center. A model may calculate, categorize, and estimate whether later conduct supports a claim of change. It may even outperform individual reviewers on a defined prediction. It may not be the final constitutional author of a coercive judgment about whether a person's past will govern her future. The institution adopting the judgment must be identifiable, give reasons in the particular case, and remain subject to appeal.
The arbiter reads David's record and says nevertheless. She does not correct the past. She considers the evidence of change, the remaining risk, the purpose of the rule, and the cost of letting an old record continue to speak. Her decision may be wrong, which is why it must carry reasons and an appeal. What matters is that the record has met an authority empowered to limit its jurisdiction rather than an automated exception that no one can own.
No protocol forgives by verifying more accurately. A protocol can apply an exception rule; an algorithm can recommend one. Mercy begins when an authorized institution accepts responsibility for saying nevertheless: the record is true, and it will not be permitted to exhaust the person before us. The judgment limits the record's jurisdiction. That limit is the fourth equation's demand.
C12. Without temporal limits, accurate records can compose into durable exclusion. The Mercy Threshold is the point at which a true record must cease to determine a person's future by default. If a receipted system without designed forgetting produces no pathology of permanent exclusion, this claim is wrong.
Notes
1. Alfred Blumstein and Kiminori Nakamura, “Redemption in the Presence of Widespread Criminal Background Checks,” Criminology 47, no. 2 (2009), pp. 327–359, estimate how the hazard of rearrest changes with time clean, age at the earlier event, and offense type. The study supplies evidence for differentiated calibration, not a universal expiration period. ↩
2. 18 Pa. Cons. Stat. § 9122.1(a)–(d) provides petition-based limited access for qualifying records after specified conditions, preserves enumerated exceptions, and directs notice through the criminal-history repository. It is a bounded legal analogue, not an implementation of the constitutional rule proposed here. ↩