Chapter 2
The Membrane
The Figure That Traveled
Aa
We are not really at home in our interpreted world.
The Shortfall
At the end of a trading period, a British subpostmaster using the Horizon accounting system had to complete a Branch Trading Statement. Horizon calculated how much cash and stock the branch should contain. The subpostmaster entered what was physically present, and any difference appeared on the screen as a shortfall. The branch could not move into the next accounting period until the statement had been completed. Horizon was mandatory, there was no parallel ledger to which the subpostmaster could retreat, and the system itself supplied no field in which its figure could be disputed. A disagreement began elsewhere, usually with a call to the Helpline, while the number on the screen remained unchanged. 1
The contract supplied the next movement. A subpostmaster was expected to make good a shortfall, either by placing money into the branch or accepting a deduction from future remuneration. Some borrowed. Some used savings. Some entered false figures while hoping that a correction would arrive later. The machine had not established that cash had been taken from a drawer or stock removed from a shelf. It had established a difference between two accounts, one physical and one computational, and the institutional arrangement gave the computational account priority. Even the word shortfall had begun to decide the case, since it named the difference as missing property rather than as an unresolved discrepancy.
On 14 January 2008, an audit at Seema Misra's branch in West Byfleet produced an alleged shortfall of £74,609.84. Her own explanation was untidy, as explanations drawn from life often are. She said staff thefts had occurred, that losses continued after the employees she suspected had been dismissed, and that faults in Horizon had compounded the problem. She admitted making false entries because she feared losing the branch if she disclosed the figures. She had also reported unexplained losses to the Helpline and borrowed from friends and family to put money into the Post Office's accounts. At trial, her sister-in-law testified that she had lent her £22,000. 2
Misra was convicted of theft in October 2010, having already pleaded guilty to six counts of false accounting, and the following month she was sentenced to fifteen months in prison. The prosecution relied upon Horizon evidence. A Fujitsu engineer testified about the system's reliability, while the defence sought material concerning known faults and the operation of the wider accounting environment. The jury encountered a dispute that had already been narrowed: on one side stood the integrity of a system operated by institutions with access to its records, and on the other the explanations of the woman standing before it.
The record changed as litigation forced more of the system into view. The High Court found that Horizon contained numerous bugs, errors and defects capable of producing branch discrepancies. The Court of Appeal later examined what had happened in Misra's prosecution. The ARQ audit data disclosed to the defence was filtered, did not cover the whole indictment period, and had not been examined for bugs, errors, defects, or evidence of theft. There was no evidence corroborating the Horizon figure and no proof of an actual loss distinct from a shortage generated by the system. The prosecution had been unfair and, the court concluded, an affront to justice. Her convictions were quashed in April 2021. 3
The judgment did not turn Misra into an uncomplicated heroine or reconstruct every transaction in West Byfleet. Staff theft, bookkeeping error, software defects, remote intervention and false accounting could have coexisted. That resistance to a clean story matters. The constitutional failure was not that a computer had been wrong and a person right. It was that one participant controlled the instrument, the audit trail, the vocabulary of the discrepancy, the investigation, and the prosecution, while the person made answerable for the result lacked an equal means of examining any of them.
No official needed to announce that the machine would be believed and the subpostmaster would not. The hierarchy was distributed through the design. Horizon was compulsory. Its figure survived a complaint to the Helpline. The contract made the subpostmaster responsible for making the figure good. The audit began from the system balance, the investigation inherited the audit, and the prosecution inherited the investigation. Each office received a fact that the preceding office had already stabilized. By the time the figure reached a courtroom, what had begun as an output had acquired the posture of evidence.
I will call this passage through institutions the membrane: the sequence by which a computational judgment acquires consequences in a life. The membrane is often distributed rather than located. In Horizon it ran through terminals, contractual duties, audit practices, investigative assumptions, expert evidence, disclosure rules and criminal procedure. The person encountered the consequence at the far end, although no single office experienced itself as the author of the whole.
Every society has had crossings of this kind. The city gate decided who entered. The courthouse door determined whose grievance would be heard. Customs houses, licensing offices, ports and border posts stood where an administrative judgment became a fact about movement, work, or possession. Their visibility should not be romanticized. A guard could lie, a clerk could be bribed, a court could close its doors, and the rule itself could be cruel. Still, the crossing usually had a place, an office and a custodian. The newer membrane is harder to confront because its operation may be divided among institutions, each responsible for a portion of the chain and none obliged to explain the whole.
Five questions follow any consequential crossing. What happened to the person, and what part of the event was observed rather than inferred? What authority allowed the institution to act? Where did that authority end? Which evidence supported the judgment, including evidence that cut against it? Where could the person challenge the act before its consequences became irreversible? At the membrane these are constitutional questions, because they determine who may turn a record into a binding fact and whether the person rendered legible by the system can make the system legible in return.
When Infrastructure Governs
In 1998, Andy Clark and David Chalmers argued that the boundary of mind need not coincide with the boundary of the skull. 4 If an external process reliably performs the work of an internal cognitive process, it may belong to the cognitive system rather than remain a tool consulted from outside. Their familiar example was a notebook that stores information and returns it when needed, functioning for its user as memory. They called the idea the parity principle.
Political functions have migrated in a comparable way. Speech is ranked and distributed by platforms. Transactions pass through private payment rails whose risk decisions can exclude a business or an entire corridor from ordinary commerce. Identity systems determine whether a person appears valid to the institutions waiting downstream. An accounting system supplies a presumptive fact to an investigator. None of these systems claims general sovereignty, and the differences between them and states remain important, but the functions they perform help determine whether a person can speak, transact, work, travel, or appear as a recognized participant.
The legal discontinuity is visible in the state-action cases. In Marsh v. Alabama (1946), the Supreme Court held that a privately owned company town could not prohibit the distribution of religious literature on its sidewalks. 5 Chickasaw was private in title and municipal in operation. One company owned the streets, residences, stores and public spaces through which ordinary civic life occurred, and the Court refused to let ownership erase the constitutional character of the place.
The analogy to digital infrastructure is tempting, particularly where a platform organizes speech or commerce for populations far larger than any company town. The law has not accepted the analogy merely because a forum has become important. In Manhattan Community Access Corp. v. Halleck (2019), the Supreme Court held that operating public-access television channels did not make a private operator a state actor, emphasizing that hosting the speech of others is not a function traditionally and exclusively reserved to government. 6
That refusal belongs inside the argument. Private ownership and association carry constitutional value of their own, and declaring every consequential firm a state would create powers and obligations that require scrutiny. The harder condition is one the doctrine leaves largely intact: infrastructure can become functionally political without becoming governmental in law. People then encounter decisions resembling public administration, often in domains essential to work or expression, while the operator retains the latitude of a private owner.
The difference appears in procedure. A public authority that freezes property must confront some form of due process. A private intermediary commonly provides a notice, a form and an internal queue. A state suppressing protected speech may have to defend the action under constitutional doctrine. A platform ranks, removes or demotes speech under rules it wrote and may revise. Public law still reaches these systems through consumer protection, contract, competition, civil rights and sectoral regulation. Its most developed constitutional restraints, however, do not automatically follow the function into the infrastructure now performing it.
The useful question is therefore less dramatic than whether a platform is the state. It is what obligations should attach when a system becomes difficult to avoid and gains the capacity to impose consequential classifications on people who cannot inspect its operation. The answer begins with an account attached to the act, not because state-action doctrine has already supplied one, but because the function has acquired consequences that private contract alone can no longer explain.
Conditional Tenure
The membrane is owned.
Someone maintains the servers, writes the software, bears the costs and decides what the system is for. Ownership becomes constitutional when control of infrastructure becomes control of another person's practical standing. An account serves as identity, access to a payment rail becomes the ability to trade, a recommendation system becomes the route to an audience, and an internal appeal process becomes the only court available. The resulting order has a neo-feudal logic, though the analogy concerns dependence rather than costume: tenure is conditional, authority is difficult to see, and departure may be formally permitted while remaining ruinously expensive.
Cheap verification and network effects helped produce this arrangement. A platform can inspect millions of users at low marginal cost, while no user can inspect the platform on comparable terms. Alan Westin described informational privacy as the claim of individuals to determine when, how and to what extent information about them is communicated to others. 7 Much digital infrastructure reverses the relation. The institution learns enough about the person to classify them, and the person learns only the classification. Surveillance subsidizes entry, data accumulates option value, and a record collected for one purpose remains available for another.
Aadhaar shows both the power and the danger of machine-verifiable identity. Its use across public and private services makes authentication part of India's ordinary administrative surface. Authentication can reduce duplicate records, speed payment and make a benefit portable across locations. It can also turn identity from a fact about a person into an event at a terminal, contingent on connectivity, matching and the availability of a fallback when either fails.
The empirical record is mixed in ways that resist a verdict about biometrics in the abstract. An exploratory study of compulsory Aadhaar-based authentication in Ranchi found that only fifty-two percent of ration-card households successfully purchased rations in August 2016, with mandatory biometric authentication an important contributor to the low transaction rate. 8 In Andhra Pradesh, a broader smartcard reform made employment-guarantee payments faster, more predictable and less corrupt without reducing access. 9 A later study of stricter identity requirements in Jharkhand found lower corruption alongside substantial costs to legitimate beneficiaries, 1.5 to 2 million of whom lost access at some point during the transition. The authors traced much of the harm to the protocols governing the change rather than to biometric verification considered alone. 10
The comparison is instructive because the relevant constitutional object is not the credential by itself. It is the whole route through which the credential is requested, tested, rejected and repaired. Manual fallbacks, reconciliation procedures, transition timing and the authority of a person at the counter may matter as much as the matching technology. A fingerprint failure becomes political when the person standing at the counter loses food or payment because the institution has decided that no other form of recognition will count.
Tracie Ann Grijalva's case supplies a narrower, documented version of conditional standing. After Arizona revoked her certified nursing assistant license in 2011, the federal government excluded her from federally funded health-care programs. Years later, an ADP background report disclosed both the continuing exclusion and the old revocation that explained it. The Ninth Circuit held in 2025 that the continuing exclusion could be reported under the Fair Credit Reporting Act. The license revocation, treated as a separate adverse item more than seven years old, could not. Because ADP's interpretation of unsettled law had not been objectively unreasonable, the court nevertheless affirmed judgment in the company's favor. 11
The holding identifies the institution’s own responsibility. The report was not false, and the court did not erase the current exclusion. It separated a continuing legal consequence from an old event offered as its explanation. Relevance did not itself renew the authority to report. A record may therefore be accurate, connected to a live status, and still lack jurisdiction to travel in full. The membrane governs purpose and time as well as identity.
Visibility, recourse and exit complete the dependence. A creator may own the files uploaded to a platform while the audience, recommendation history, reputation signals and verified status remain embedded in the platform's graph. An archive can be downloaded without carrying the relations that gave it public life. The export is a carcass, not a person. An appeal may exist but return to the institution that made the original decision, on a timetable set entirely by the party against which relief is sought. Exit remains possible in the thin sense that the account can be closed, while the standing accumulated inside it does not travel.
These dependencies are often discussed separately because different departments administer them. Identity belongs to trust and safety, settlement to payments, ranking to recommendation, appeal to operations, and portability to data policy. The user experiences their composition. Losing the credential can interrupt payment. Losing payment can collapse a livelihood. Losing visibility can make nominal access commercially useless. A system may therefore be open at every layer and closed in the life assembled from them.
The pattern need not emerge from conspiracy. Network effects reward concentration, cheap verification rewards collection, and contract gives the owner broad authority over a domain that may become indispensable only after the bargain has been made. Each local decision can be commercially intelligible. Their composition can still leave the governed dependent upon permissions they did not negotiate and cannot meaningfully replace.
Code as Constitution
Langdon Winner asked whether artifacts have politics and answered that they do. 12 His famous illustration concerned Robert Moses's low parkway bridges on Long Island, said to have excluded buses and the communities that depended upon them. Bernward Joerges later challenged the story in detail and called it counterfactual. 13 The dispute is more than a footnote. It shows how an elegant parable can harden into doctrine when the theory it serves is attractive enough. A serious account of technological power cannot ask evidence to become obedient merely because the moral is useful.
Winner's larger question survives the failure of the anecdote. A factory plan can separate workers who might otherwise organize. A highway can divide a neighborhood whose ordinary life depended upon crossing the route now occupied by traffic. A staircase, turnstile, or inaccessible form can distribute access without issuing a rule in words. The arrangement governs by changing what bodies can do in the space, often long after the meeting at which its dimensions were chosen has been forgotten.
Lawrence Lessig carried the insight into software through the formulation that code is law. 14 Law regulates through publicly stated commands and the prospect of later sanction. Norms regulate through approval, shame and reputation. Markets attach prices. Architecture acts earlier by arranging the environment in which conduct occurs. It can make an action easy, costly, invisible, or impossible before anyone asks whether the actor ought to be punished for attempting it.
The distinction appears in ordinary objects. A speed bump makes haste physically uncomfortable. Digital rights management makes a copy fail. A content filter can make speech disappear without notifying the speaker that anyone has acted. An API permission can render a business model impossible from one release to the next. Material constraints occupy space and can usually be photographed. A software constraint may be encountered only through a missing result, a declining graph, or a field that never appears on the screen.
Horizon governed in this architectural sense because its role exceeded calculation. It required the subpostmaster to use its figures, supplied no field in which those figures could be disputed, prevented the branch from moving into the next period without completing the statement, and connected a discrepancy to a contractual duty to make good. The interface arranged the controversy before an investigator entered it. By the time someone telephoned the Helpline, the system had already decided which number remained fixed and which participant had to explain the difference.
Software rules operate inside law, markets and norms. Law can require an interface to expose a right, markets reward architectures that collect more data, and norms enter code through ideas about safety, convenience, or acceptable risk. The modalities form an ecology. Architecture occupies a privileged place within it because a right with no usable route through the interface may survive in doctrine while disappearing at the moment of need.
This is how decisions by engineers, product managers, lawyers, risk officers and operations teams acquire constitutional weight without anyone intending to write a constitution. They select categories, defaults, thresholds, permissions, escalation paths and retention periods, most often under deadline pressure and for reasons sensible within the product. The people affected arrive later. Edge cases appear, responsibility has moved among teams, and the original trade may survive only in a ticket written for readers who already knew the system. The constitution is written in sprints.
Calling the architecture constitutional does not turn every interface into a state. A constitution, in the functional sense relevant here, determines how rules change, who may invoke an exception, where a dispute can enter, and what standing the governed possess against the authority acting upon them. At the membrane, software helps decide which proposal becomes consequence and which person receives an opportunity to resist it.
The Permanent Exception
Carl Schmitt's famous definition in Political Theology was that the sovereign is the person who decides on the exception. 15 Normal rules govern anticipated situations. A case arrives that the rules do not settle, someone decides whether the rule applies or yields, and the authority to make that decision reveals where power ultimately resides. Schmitt's prescription need not be accepted for the diagnosis to remain useful.
Private infrastructure decides exceptions as part of ordinary administration. A platform removes a post because context places it outside the rule as written. A fraud system suspends an account because behavior resembles a pattern associated with loss. A developer's access ends after an API is reclassified. These decisions may be necessary. No system can operate without handling anomalies, emergencies and uncertain cases. The constitutional problem appears when the party deciding the exception also controls the evidence, the timetable and the only route of review.
The financial practice known as de-risking shows how far a private decision can travel. In May 2013, Barclays notified Dahabshiil, a major money-transfer company serving Somalia and other markets, that it intended to end their banking relationship. Barclays had reviewed its exposure to money-service businesses amid concerns about money laundering, terrorist financing and the cost of satisfying regulatory expectations. Those concerns were real. A bank providing access to the international financial system bears legal and reputational risks that may be difficult to price customer by customer. 16
Dahabshiil's account was also part of a remittance corridor upon which people outside the contract depended. Barclays was then the last large British bank providing accounts to Somali remittance firms, in a country whose conventional banking system could not readily replace them. 17 The bank's decision remained one about its own commercial relationship, but the material effect would have reached households, traders and aid operations elsewhere. No one receiving money in Hargeisa or Mogadishu had participated in the risk committee that reconsidered the account.
Dahabshiil sought an injunction. The High Court did not declare a constitutional right to banking and did not decide the merits of the competition claim. It found serious issues to be tried concerning market dominance and objective justification, concluded that damages would not provide an adequate remedy, and required Barclays to keep the account open pending trial or further order. 18 Contractual freedom, regulatory exposure, market concentration and dependence all remain visible in the record. The bank made a decision about one commercial relationship; people absent from the contract would absorb part of its effect. That distance is what turns an ordinary risk decision into a constitutional problem.
Uncertainty changes behavior before exclusion occurs. Michel Foucault used Bentham's Panopticon to describe discipline exercised through the possibility of observation. 19 Oscar Gandy later described the panoptic sort, through which institutions classify populations and distribute treatment accordingly. 20 Observation matters, but the consequential movement comes when the record becomes a category and the category changes what the person may do.
Bentham's tower achieved economy through uncertainty. The guard could see the cells, while the prisoners could not know when the tower was occupied. It might even be empty (which is the economical cruelty of the design). Possible observation induced conduct that continuous observation would have required far more labor to obtain.
A platform can govern through a similar uncertainty. A user who cannot identify the boundary of suspension learns to avoid conduct that might approach it. The platform need not specify every forbidden case, which would be impossible at the scale of speech and context it administers. The governed person performs the interpretive work, imagining how an opaque classifier or reviewer may read the act and narrowing behavior accordingly. Vagueness may reflect genuine difficulty, strategic discretion, institutional neglect, or all three. From the user's side, the result is the same posture of caution before a boundary that moves when approached.
Platform power remains narrower than state sovereignty and lacks a general monopoly on force. Yet it may control an interface among speech, work, payment, identity and recognition that is decisive for the person who must cross it. The exception becomes political at the membrane because its consequence arrives before the question of authority has found a forum.
The Verification Inversion
A receipt regime creates an immediate danger. If every consequential action must leave a trace and every claim must be witnessed, the same infrastructure that makes power accountable may make persons perfectly observable. An institution can call its records receipts while demanding that the governed disclose identities, movements, associations and histories at every crossing. Accountability then becomes another name for papers.
China's social-credit system is often invoked as the obvious warning, though the familiar picture of a single national score assigned to every citizen is inaccurate. The actual arrangement is more fragmented and, in some respects, more administratively ordinary. It consists largely of compliance files, public records, sectoral ratings and blacklists maintained across institutions and levels of government. There is no unified score controlling the whole of a person's life. 21
The correction makes the example more useful. A judgment defaulter can be placed on a public enforcement blacklist and face restrictions on air travel, high-speed rail and luxury consumption. In 2026 the Supreme People's Court described continuing coordination with financial, transport and other agencies to locate assets and enforce these restrictions. 22 The consequential movement does not require an omniscient algorithm. A record created for one legal purpose becomes available to other institutions, and sanctions attach across domains. Fragmented systems can compose, sometimes more easily than they can explain themselves.
A quieter commercial version appeared in connected vehicles. The Federal Trade Commission alleged that General Motors and OnStar collected precise location and driving-behavior data, disclosed some of it to consumer-reporting agencies, and failed to obtain adequate informed consent. Reports derived from the data were used in insurance decisions. In January 2026 the Commission finalized an order imposing a five-year restriction on covered disclosures to consumer-reporting agencies and, over twenty years, requirements concerning consent, access, deletion, disabling location collection and opt-out rights. 23
The consequences belong to different moral orders. A changed insurance rate is not a prison sentence, and a commercial data practice is not the Chinese enforcement apparatus. What recurs is the institutional movement: a record collected in one relationship acquires authority in another, while the person learns about the passage only after the downstream consequence arrives. The ordinary case matters because infrastructure becomes constitutional through repetition as much as through catastrophe.
The governing allocation must therefore run in one direction. Exercises of consequential authority should become legible to the person affected, while the private life of that person remains opaque beyond what the immediate transaction requires. The phrase civic asymmetry can name the allocation, but the plainer statement is enough: power owes the account. The person does not owe a total biography merely because they have asked power to explain itself.
Several technical designs can support that allocation in bounded settings. A zero-knowledge proof can establish that a proposition is true without revealing the underlying data from which the proof was derived. Selective-disclosure credentials can reveal a relevant attribute without exposing every attribute contained in the credential. Data-minimization and retention rules can prevent a record collected for one purpose from remaining indefinitely available for another. Their contribution is narrower than liberation. They reduce the amount of trust a just institution must ask from the person crossing it.
Grijalva's case gives this distinction temporal form. A verifier could establish the continuing federal exclusion without reopening every adverse item in the history that produced it. If an institution relies on an older event, that use requires its own authority and time rule. The burden of explaining the additional disclosure travels with the party imposing it.
A receipt should follow the same logic. The authority issuing a consequential act bears the cost of describing what it did, citing the rule, stating the operative bounds, preserving the evidence and naming a usable path of challenge. The affected person may need to establish standing, but the proof should disclose only what standing requires. A borrower contesting a denial need not publish a life history. A worker challenging a credential error should not have to become more legible to every future employer. The apparatus of contest must not create a second market in the person.
None of this emerges automatically from verification technology. Institutions benefiting from comprehensive collection have reasons to preserve it, users may lack meaningful alternatives, and cryptographic privacy can be undermined by the surrounding interface, metadata, or a rule requiring excessive disclosure before the proof is accepted. The boundary of what must be shown is political before it is technical. A zero-knowledge proof can reduce disclosure, but the entitlement to demand the proposition remains a political question.
The distance between specifying this asymmetry and imposing it on existing infrastructure remains large. That distance contains competition law, procurement, technical standards, collective action, sectoral regulation and the bargaining power of users who may have nowhere else to go. The limited claim is that verification need not entail total exposure. It can be arranged so that the institution exercising power becomes more visible while the person subjected to it remains partly unknown.
Witness, Work, Receipt
Three requirements meet at the membrane, though they arrive by different routes.
Truth requires witnesses. Horizon produced a figure, but a figure without accessible provenance could not tell the subpostmaster which transactions created the discrepancy, whether remote changes had occurred, what known errors might bear on it, or why the institution treated it as proof of loss. Witnessing does not require every affected person to understand the entire system. It requires a claim carrying consequence to preserve enough of its lineage to be examined by someone with standing to contest it.
Value requires work. Authority exercised at negligible cost can be repeated casually while the person subjected to it bears the full consequence. A platform can issue a million suspensions more easily than a million users can appeal them. A bank can terminate a category more cheaply than each customer can reconstruct the reasons for inclusion. Requiring an institution to preserve evidence, fund independent review, post a bond, or bear a consequence for an invalid act places something of its own behind the decision. The stake does not guarantee wisdom. It makes care less expensive than indifference.
Freedom requires receipts. At the membrane, a receipt is the account that travels with consequential power: what occurred, where authority came from, what limited it, what evidence supported the act, and how the affected person can challenge it. Liberal constitutions state limits, but a limit leaving no trace at the moment of exercise may be impossible to invoke before harm compounds. The receipt gives the governed a contemporaneous object of contest.
The witness, signature and receipt compose. The witness makes a claim inspectable. The signature makes commitment harder to disown or revise after the event. The receipt makes the exercise of power answerable to the person upon whom it has acted. Each can exist without the others, but the constitutional effect weakens when they are separated. A signed falsehood remains false, a witnessed act may remain unaccountable, and a receipt whose issuer has placed nothing at risk may become paperwork produced at scale.
The crossing will be governed in any case, whether the instrument is called law, product design, fraud prevention, safety, or risk management. The question is whether the person governed possesses standing to inspect the act while there is still time to do something about it.
The Sequence of Proof
When the Court of Appeal reached Misra's case, it did not need to determine which explanation accounted for every discrepancy in West Byfleet. It had to ask a prior question: what had the Post Office established before its number became a debt and its debt became evidence of crime? There was no corroborating evidence of theft, no proof of an actual loss distinct from a shortage generated by Horizon, and the two sides had not possessed equal access to the records needed to test the system's account. The figure had traveled farther than its provenance. 24
A receipt would not have declared Misra innocent, any more than a properly kept ledger proves that every person disputing it is right. It would have kept the first output in its proper category. Horizon had observed a discrepancy between accounts. The Post Office inferred that money was missing, attributed responsibility to the subpostmaster, and eventually placed the inference before a jury. Each movement required its own authority and its own evidence. The first number could justify investigation. It could not, without more, justify recovery, suspension, dismissal, or prosecution.
The evidence would have to travel with the claim. The branch transactions composing the balance, corrections and remittances, the version of the software in use, known defects capable of affecting the account, remote-access events, and evidence inconsistent with theft would need to remain available to the person asked to answer the number. A system can be too complex to explain in every internal detail while still being required to expose the facts upon which coercion depends. Complexity may justify technical assistance. It cannot justify an evidentiary monopoly.
The distinction between observation and inference would also have to survive each institutional handoff. The audit could report that Horizon displayed a difference. An investigator could propose explanations for it. A prosecutor could decide that the evidence supported a charge. What no office could do was inherit the previous office's conclusion as though it were a fresh observation. The chain would preserve where measurement ended and judgment began, because that boundary is where an apparently neutral record acquires a human author.
Review would begin before irreversible consequences, outside the chain that produced the claim and while the underlying records still existed. The reviewer would need authority to preserve the data, obtain competent technical assistance, suspend recovery or referral where the evidentiary threshold had not been met, and require the institution to answer evidence cutting against its preferred account. An appeal that arrives after imprisonment, insolvency, or the loss of a livelihood may vindicate a principle while leaving most of the life already spent.
The issuer would bear a stake. An institution withholding known-error material, failing to preserve audit data, or representing a provisional discrepancy as a proven loss would face evidentiary and financial consequences specified in advance. That stake would not establish the subpostmaster's innocence. It would make the institution's claim costly enough to require care before the claim crossed into property or liberty.
The five questions remain, but the Horizon record gives them greater precision. The act must distinguish what the system observed from what the institution inferred. Authority must be renewed as the consequence intensifies, since permission to investigate is not permission to punish. Bounds must keep a provisional anomaly from silently becoming a debt. Justification must preserve provenance across institutions rather than offer only the final conclusion. Appeal must interrupt the sequence while interruption can still matter.
This architecture would not make software infallible, eliminate employee theft, or guarantee that every dispute ended correctly. It would change the order of proof. A number could still initiate an investigation. It could no longer become an enforceable fact merely because it appeared on the screen of the institution best positioned to understand its weaknesses. The number could still accuse. It could no longer convict itself.
The Burden at the Crossing
The membrane is neither a single place nor a single technology. It is the institutional passage by which a record becomes a consequence, often through several organizations whose separate acts compose into an authority none would claim alone. Horizon made the passage visible because the number moved from terminal to contract, from contract to audit, from audit to prosecution, gathering force at each step while shedding the uncertainty of its origin.
The existing architecture commonly leaves that passage under private control and governed through contract. Contract can coordinate relations of extraordinary complexity, but it presumes parties able to refuse, negotiate, and carry their standing elsewhere. Those assumptions weaken when an account becomes identity, a payment rail becomes commerce, or an internal record becomes the practical condition of working in one's profession.
Older commercial institutions confronted a related problem: how to make a claim consequential after the parties had gone elsewhere. Milgrom, North, and Weingast modeled a judge’s record whose effect on later trade could make a present sanction credible. Greif identified multilateral reputation as a mechanism of overseas agency. 25 The historical work of carrying such claims also depended on jurisdictions, reachable property, and authorities able to act on what they received. The next chapter asks how those arrangements actually worked, and what their failures permit us to inherit.
Lessig’s formula that code is law names the force an architecture can acquire. Commercial history directs attention to the conditions under which that force becomes answerable. Evidence must reach a forum that can receive it; an obligation must reach a party or property against which a judgment can act. Computation can change the cost of these passages. It inherits none of their legitimacy simply by making them faster.