Chapter 5
The Kind Master Problem
At Another’s Pleasure
Aa
Such a power does not destroy, but it prevents existence; it does not tyrannize, but it compresses, enervates, extinguishes, and stupefies a people, till each nation is reduced to nothing better than a flock of timid and industrious animals, of which the government is the shepherd.
The Balance on the Screen
For most of its life, an account at Celsius looked uneventful. A balance sat on the screen, rewards arrived each week, and withdrawals worked. The relation could therefore be mistaken for possession because the platform had not yet exercised the powers its contract reserved, and because a permission continuously renewed is easy to experience as a right.
On June 12, 2022, Celsius halted withdrawals.
Hundreds of thousands of customers could still open the application and see the assets attributed to them, but they could no longer move those assets out. When the company entered bankruptcy, the court faced a question more elementary than valuation or fraud: who had owned the cryptocurrency in the Earn accounts before the petition was filed? The answer turned on the terms. Customers using the Earn program had agreed to language transferring title and ownership to Celsius. The court held that the remaining assets, approximately $4.2 billion spread across roughly 600,000 accounts, belonged to the bankruptcy estates, subject to defenses that individual creditors might later raise. The account holders were unsecured creditors. The balance had described a claim against an institution, not property held beyond the institution's reach. 1
The ruling applied ordinary contract law to a clickwrap agreement and did not decide the ownership of every asset held through every Celsius program. Its constitutional significance lies in the distance between the ordinary experience of the account and the legal structure beneath it. The interface said your balance. The agreement said title had moved. For as long as Celsius honored withdrawals, the distinction remained dormant. Once it stopped, the structure appeared all at once.
Celsius had marketed itself as an escape from traditional finance, and later proceedings established serious fraud by its founder. Those facts explain why the permission failed in practice, but they are not necessary to the structural point. The same legal relation could have existed under competent and honest management. An institution may administer entrusted assets carefully for years while leaving the user dependent upon an authority the user cannot replace at the moment of crisis. The kind master problem concerns that latent relation, which is why a case involving an unkind master can expose it with unusual clarity. 2
A self-custodied wallet occupies a different position. The application through which its holder views the assets may fail, change its policies, or disappear, but another compatible application can read the same underlying state because the user retains the key required to authorize a transfer. This does not make the user sovereign in every dimension. A stablecoin issuer may blacklist an address, an app store may remove wallet software, a bank may refuse conversion, a network may become congested, and a compromised device may make nominal control worthless. Yet with respect to the underlying authorization, the interface has lost one decisive power. It cannot choose whether to continue recognizing the user's instruction.
Before a crisis, the two arrangements can feel alike. Both display balances, accept instructions, and return confirmations. Interfaces are remarkably good at making a legal relation feel like a physical one.
Their positions differ completely.
The difference is modal: what the intermediary could do, what the user could do in response, and whether continued access depends upon a decision the intermediary remains free to reverse. Republican political theory places that question near the center of freedom. A person may be left entirely alone and still remain unfree if the liberty enjoyed is held only at another's pleasure. The master may be gentle, the administrator competent, the platform solvent, and the service excellent. None of those facts changes the relation if one side retains an uncontrolled capacity to revoke the conditions under which the other acts.
The analogy concerns a form of dependence and implies no equivalence between the injuries of a platform user and the institution of slavery from which the example comes. It asks whether what appears as liberty is possessed as of right or enjoyed by continuing permission. The distinction can remain invisible for years. Then the withdrawal button stops working, and a political question appears inside what had looked like a product decision.
The Kind Master
Isaiah Berlin's 1958 lecture on two concepts of liberty supplied the map against which much later argument proceeded. Negative liberty concerns the area within which a person can act without obstruction. Positive liberty concerns the source of action, whether one governs oneself rather than being ruled by appetite, manipulation, or another will. Berlin feared, with good reason, that the language of positive liberty could authorize coercion by people claiming privileged access to another person's true interests. The state would compel the citizen today in the name of the person the citizen would become once properly liberated. 3
Negative liberty was safer because it asked less. Leave people room. Do not force them toward an officially approved conception of the good. That modesty remains one of liberalism's great achievements, and the republican objection need not deny it. The objection is that absence of present interference cannot exhaust the condition of being free.
The older tradition began from a different contrast. Roman law divided persons into those under another's authority and those recognized as standing in their own right. Cicero's language of libertas opposed the condition of citizens to dominatio, and later writers recovered the distinction whenever they confronted rulers whose restraint remained voluntary. 4 Machiavelli distinguished the security that may exist under a benevolent ruler, vivere sicuro, from the free life of a republic, vivere libero. 5 Seventeenth-century English republicans sharpened the point against monarchical prerogative. Algernon Sidney gave it the sentence that survives him: "To depend upon the Will of a Man is Slavery." 6 James Harrington approached the same problem materially. If political power follows the distribution of property, freedom cannot rest on persuading the owner of concentrated power to behave well. The distribution itself must be arranged so that one will does not become the condition of everyone else's action. 7
Quentin Skinner's recovery of this neo-Roman tradition and Philip Pettit's reconstruction of it as freedom through non-domination restored a third question to political philosophy. Berlin asks whether I am obstructed and whether I govern myself. The republican asks whether I live subject to a power that may interfere at its pleasure. 8 The historical and philosophical projects are not identical, and the republican tradition itself contained disagreements that no modern label can smooth away. Their common claim is narrower than a complete program of government. A person whose basic choices remain at the mercy of another does not act in the free mode even where the choice is permitted. Every permitted act retains the shadow of a second will.
The familiar case is the enslaved person with a kind master. The master may allow work, movement within a broad domain, private speech, and a measure of material comfort. He may never strike, sell, or confine. A life of permission can therefore contain more practical room than the life of a legally free person burdened by poverty or law. The republican answer is that permission is not liberty. Every action occurs under two wills, the person's will to act and the master's continuing decision not to stop it.
Pettit calls the relevant power arbitrary, a word that can mislead if it is taken to mean merely erratic. The deeper meaning is uncontrolled. Power is arbitrary when the person subject to it cannot require that it answer to rules, reasons, and procedures they possess standing to invoke. A harsh rule may be non-arbitrary if it is general, known, contestable, and administered through institutions independent of the person applying it. A polite decision may be arbitrary if it can be revised at will and appealed only to the party that made it. Frank Lovett states the relation more formally: domination exists where one party depends upon a social relationship in which another wields arbitrary power. 9
Domination is therefore a matter of degree as well as kind. Dependence deepens as the interest at stake grows, alternatives narrow, rules become less stable, and remedies return more completely to the original power-holder. A person may be independent in one function and dependent in another. The user who controls an asset may still depend on an identity provider to enter a regulated market. The employee protected by law against dismissal may still depend on a ranking system to find work. Republican analysis identifies the domain in which action remains subject to another's uncontrolled permission without pretending that one relation has swallowed the whole person.
This is why benevolence cannot complete the argument for freedom. Benevolence concerns the expected use of power. Non-domination concerns its distribution and control. A good executive may lower the probability of abuse, just as a well-aligned system may lower the probability of harmful action. The user remains dependent if no rule outside the executive's preference binds the decision, no institution can require an answer, and exit destroys the standing accumulated inside the relationship.
The rule of law supplies part of the liberal reply. Secure legal rights can make feared interference remote and contestable enough that the practical disagreement between liberal and republican traditions narrows considerably. The remaining question is whether the value of those rights lies only in reducing the likelihood of interference or also in changing the person's standing before power. In computational systems the difference is difficult to avoid. A right that cannot be exercised through the interface, an appeal that returns to an unbound operator, or a promise of access the operator can revise unilaterally leaves the user in a relation of permission even if the service has never once behaved badly.
The kind master problem therefore tests structure rather than character. Ask what happens when goodwill ends, management changes, the business fails, a risk model shifts, or a new objective is introduced. If the person then loses access and can do nothing except request restoration from the same authority that removed it, good behavior was concealing rather than curing the constitutional defect.
The Master's Eye
Dependence changes conduct before interference occurs. A person who knows that another holds an uncontrolled power over work, movement, speech, or standing begins to manage the risk of attracting that power. The master need not issue an order. The dependent supplies the restraint.
Roman historians recognized the process in the transition from republic to empire. Tacitus describes a Senate whose members learned the new order quickly, adjusting speech and loyalty around an authority whose preferences did not need to be stated each time. The damage was not confined to particular punishments. Public language itself became unreliable because flattery and belief could no longer be distinguished with confidence. 10
Timur Kuran later gave the informational form a modern name: preference falsification. People publicly express a view different from the one privately held because the social or political cost of honesty is too high. Each concealment is individually rational. Collectively, the concealments make the distribution of belief unknowable, leaving people who privately dissent unable to discover how many others dissent with them. A regime can therefore appear stable until it collapses with a speed that surprises almost everyone, including many of the people who helped maintain the appearance. 11
Digital platforms create a milder but pervasive version of the same anticipatory relation. Sophie Bishop's ethnography of beauty vloggers found creators developing what she calls algorithmic gossip: communal theories about how recommendation systems reward, suppress, or ignore particular forms of content. Creators shared strategies about upload frequency, topics, formats, and presentation in an effort to maintain financial consistency and visibility. The theories did not need to be correct in every detail to govern conduct. Their practical function was to help people adapt to a system whose operative criteria were partly hidden and continuously changing. 12
This is the master's eye in computational form. The platform may never direct a creator to make a particular video. It need only control the route by which the video becomes visible and leave the conditions of visibility uncertain enough that creators orient themselves toward what they believe the system will favor. The platform saves the expense of issuing commands because the dependent population performs the interpretive work.
The ethnographic detail matters. Creators do not simply complain that an algorithm is mysterious. They run informal experiments, compare changes in reach, exchange theories about what the system rewards, and convert those theories into schedules, subjects, and formats. The result is practical knowledge that may be partly accurate and is never authoritative. A person can therefore be governed by a rule they cannot state, learning it through the uneven distribution of reward and disappearance. The platform need not publish a censorship code. It can produce a population continuously revising itself around uncertain visibility.
The resulting conduct often feels like professionalism: upload on this schedule, avoid that topic, change the thumbnail, omit the word likely to trigger a classifier, and speak in forms the system can monetize. Each adjustment may be sensible. The creator is responding to real incentives in a market in which attention matters. The republican question concerns the standing from which a person can inspect, contest, or leave an authority whose uncertain preferences have become conditions of work, not the purity or rationality of adapting to it.
All social life requires anticipation. Writers imagine readers, employees consider colleagues, merchants adapt to customers, and citizens observe norms. Influence alone is not domination. The relevant case joins dependence to uncontrolled power. A creator can refuse an audience's taste and accept the loss of that audience without surrendering a credential held nowhere else. The same creator may be unable to refuse a platform's hidden classification without forfeiting the audience, income history, and reputation accumulated over years. Influence becomes domination when one party controls indispensable conditions of participation while the other lacks voice, portable exit, and an external standard against which the decision can be tested.
This anticipatory effect explains why current good administration is insufficient evidence of freedom. A platform can publish generous policies and cultivate a culture of restraint. Users will still shape conduct around the possibility of future change if the platform retains the power to alter the rule and decide the appeal. The eye may be kind. It remains the master's eye.
Nor does the effect require users to personify the algorithm correctly. The recommender has no mood, and the pattern creators infer may be false. What matters is that an institution controls a consequential but partly hidden relation and the dependent party must act on beliefs about it. Uncertainty becomes a tax paid in advance, before any formal sanction exists to record.
The Only Road
Every constitutional theory of private power encounters a boundary question. A shopkeeper chooses what to sell, a publisher what to print, a homeowner whom to invite. Private freedom would disappear if every consequential refusal were treated as public coercion. Yet some private actors control passages other people cannot practically avoid, and ownership alone does not answer what duties follow from that position.
The common law met the problem in physical infrastructure. Lord Hale distinguished the ordinary wharf from the only wharf in a port. A proprietor surrounded by alternatives could bargain over price. A proprietor controlling the place where everyone had to load and unload could not demand whatever captive trade would bear. The wharf remained privately owned, but its use had acquired a public character because there was no route around it.
The older examples were ferries, mills, inns, carriers, and ports, places at which private property became the passage through which other people's movement or livelihood had to run. The duty followed from the relation between control and dependence rather than from a general hostility to ownership. The point has a Lockean affinity: appropriation is easiest to defend where another path remains open. Once one owner controls the only passage, ordinary bargaining begins to resemble a tax on participation. 13
The Supreme Court carried Lord Hale's reasoning into Munn v. Illinois in 1877. Chicago grain warehouses stood between western harvests and the routes through which grain reached national markets. The owners remained private persons, yet the Court upheld public regulation of rates because the business had become consequential to the community at large. The phrase was that property had become "affected with a public interest." 14
The doctrine later proved too elastic to supply a complete theory. Almost every successful business affects the public, and a test based on social importance alone can turn ordinary commerce into administration by permission. The image of the only wharf is more exact. The duty attaches to control of a passage that those subject to the decision cannot meaningfully go around, regardless of whether the owner is large, disliked, profitable, or technologically sophisticated.
Such a duty need not convert the passage into public property or subject every business judgment to political review. It can attach narrowly to the powers made exceptional by dependence: continuity of service, intelligible grounds for exclusion, nondiscrimination among similarly situated users, portability when service ends, and a forum capable of testing whether the announced rule actually governed the act. The constitutional response should be no broader than the chokepoint, but it cannot be narrower than the dependence the chokepoint creates.
Digital infrastructure rarely presents one literal road. The route becomes unavoidable through composition. An app store controls distribution to a class of devices, a payment network controls settlement accepted by merchants, a cloud provider controls infrastructure on which a service has been built, and an identity provider supplies the credential expected everywhere downstream. Each layer may have competitors in the abstract. The person affected can still lack an alternative lane once accumulated standing, contractual dependency, technical integration, and network effects are counted.
The terms of such a passage need not be hidden to be unilateral. The commission Epic Games challenged in its litigation with Apple was public and uniform. Its constitutional significance did not depend on secrecy but on who controlled the gate, which alternatives were practically available, and what a developer had to abandon in order to refuse the terms. 15 Market share is therefore an incomplete measure. A provider with a modest share may control the only route available to a particular person because the relevant credential, device, jurisdiction, or counterparty recognizes no substitute. Conversely, a large platform may exercise little dominating power over an act users can move elsewhere without losing standing.
The removal of Parler from Google Play, Apple's App Store, and Amazon Web Services shows why the boundary cannot be reduced to sympathy for the excluded party. AWS had repeatedly raised violent content with Parler, and the federal court later denied Parler's request for preliminary relief after finding that it had not shown likely success on its claims. The court did not hold that a private hosting provider was obliged to carry content presenting serious safety concerns. Parler had a legal forum, and the record gave AWS substantial reasons for acting. 16
The case matters because it resists a morality play. A provider can have legitimate grounds to terminate service and still occupy an infrastructural position whose decision is existential for the dependent party. Non-domination permits gatekeeping decisions, including severe ones. It asks that rules, evidence, bounds, and review become more exact as the consequence grows more severe and the passage harder to avoid. The fact that an act is justified does not make the power to perform it constitutionally uninteresting.
The test should therefore be applied to acts rather than entities. A platform choosing the color of an interface acts as a proprietor. The same platform freezing a livelihood, invalidating a professional credential, or extinguishing accumulated standing acts at a passage upon which another person has become dependent. The burden grows with four facts: the severity of the consequence, the unilateral character of the act, the absence of meaningful exit, and the weakness of independent recourse.
This approach avoids declaring every platform a state. It also avoids pretending that private form settles the political question. The ferryman does not become sovereign because there is one crossing. He acquires duties at the crossing because other lives must pass through it.
The Power That Says No
Republican freedom is sometimes presented as if the remedy were simply more law: clearer statutes, stronger regulators, better courts. Those institutions are indispensable, but the diagnosis is broader. Power must be controlled in a manner the affected person can invoke, and control can be supplied through more than one institutional form.
Pettit's account emphasizes contestatory democracy. Those subject to public decisions must be able to demand reasons, challenge applications, and force reconsideration through forums not dependent on the grace of the original decision-maker. The framework is not merely state-centric, because it is concerned with control wherever domination appears, but its paradigmatic mechanisms presume a durable institution with an address. A citizen can petition a court, an ombudsman, a legislature, or an agency and expect the office to continue existing long enough to answer. 17
Computational infrastructure strains that presumption. An act may be assembled across a model, policy engine, data vendor, identity provider, and platform interface. Each participant can truthfully say that it supplied only part of the result. The consequence reaches the person before any office has accepted authorship of the whole. Public law remains available, but it often arrives after the act has hardened and must reconstruct a chain whose components were never required to preserve a common account.
Architecture can narrow the problem by removing powers before anyone decides whether to exercise them. Self-custody is the simplest example. The user does not rely on a promise that the interface will refrain from freezing the underlying asset. The interface lacks the relevant key. A capability can limit an agent to a defined function and period. A time lock can prevent a governance change from taking effect before affected parties have an opportunity to respond. Portability can keep departure from becoming erasure. In each case the constraint changes the feasible act rather than merely increasing the penalty for a wrongful one.
This is Montesquieu's older insight in a new material. Power must encounter power. Separation of powers was never only a plea for virtuous officeholders. It distributed authority so that one institution's will met another institution capable of resistance. Computational systems can sometimes place that resistance in the transaction itself through independent keys, threshold signatures, bounded capabilities, public proofs, and exit paths no single operator can close. 18
Architecture has limits that matter. Code may enforce a bad rule with unusual fidelity, a key may be lost, and a protocol may fall under a concentrated coalition. A technically available fork can be economically useless when users, liquidity, identity, and reputation remain with the incumbent. The same mechanism that prevents arbitrary intervention may also block a necessary response to changed circumstances. Architecture changes which questions politics must answer and which powers remain available while the answer is contested. It never replaces politics.
Law and architecture are therefore complements. Law can require portability, recognize receipts as evidence, define liability for a surviving principal, and prohibit operators from designing around appeal. Architecture can make those duties easier to verify and harder to evade. Courts remain necessary wherever meaning, proportionality, and mercy resist reduction to a state transition. The republican objective is not to replace every official with code. It is to prevent consequential power from remaining under the sole control of the party that benefits from it.
The difference between a right and a permission becomes clearest when the grantor would prefer not to honor it. Permission works while the issuer agrees. A right must remain usable when the issuer regrets granting it, changes management, or discovers that compliance has become expensive. In a computational system, this distinction turns on ordinary-looking details: who holds the key, whether an export format is public, whether the rule version governing an act can be recovered later, whether the appeal route can be disabled by the party being appealed, and whether a successful challenge can restore anything of value. None of these details is the right by itself. Together they decide whether the right survives conflict or collapses back into a request for favor.
Voice remains as important as exit. A person who can leave but cannot help shape the rules under which they wish to remain possesses a market remedy, not complete republican standing. Fork rights discipline an institution only when people can take assets, credentials, relationships, and a viable community with them. Otherwise the formal right favors the technically sophisticated and well capitalized, while everyone else remains bound by network effects. Code may be copied at negligible cost while the social world around it remains stubbornly uncopiable. Liquidity stays on the incumbent chain, employers recognize the incumbent credential, and friends remain in the incumbent graph. The dissenter receives the source code and loses the society.
Non-domination is not a complete theory of justice. A system can avoid arbitrary power while distributing opportunities badly, and it can distribute benefits generously while leaving recipients dependent upon discretionary favor. The republican test asks one continuous question inside the larger field: does any participant live under a power they cannot control, contest, or escape without losing the conditions of participation?
The practical design standard is therefore mixed. Remove harmful powers where possible. Bind those that remain to authority and limits established before the act. Preserve an account the affected person can inspect. Route review outside the chain that produced the decision. Keep exit capable of carrying standing rather than merely data. These elements convert freedom from a favorable prediction about conduct into an institutional position.
No One at the Switch
The kind master is an identifiable person. Many computational systems distribute power so widely that no one participant holds the complete decision in view. A model supplies a score, a policy layer maps the score to a category, a platform applies the category, an institution accepts the platform's output, and the person encounters the result at the end. The chain can dominate without containing one actor who intended or controlled the whole consequence.
It is tempting to call this domination without a dominator. The phrase captures the experience and risks obscuring responsibility. A storm may constrain action severely, but weather does not dominate because it bears no duty and answers to no institutional demand. A computational chain is not weather. People chose the objectives, data relations, delegation rules, interfaces, and conditions under which its outputs would acquire force.
The more exact claim is domination without a unitary dominator. The power has a design history and a distribution of beneficiaries even when authorship of the particular outcome is fragmented. The constitutional problem is that every participant can point to another component and deny control over the whole. The absence of a face does not make the power natural. It makes its bearer of duty harder to locate.
Foucault's account of disciplinary power helps describe how arrangements govern without continuous command. Architecture, classification, and routine can shape conduct while no sovereign issues each order. Yet even the Panopticon operates at a tempo the prisoner can experience. The prisoner forms a belief about surveillance, alters conduct, and lives inside the anticipation. Agent-to-agent systems can complete coordination before an affected person has time to form the question that would begin a challenge. 19
Speed is therefore a constitutional property, not merely an engineering advantage. Paul Virilio's account of rule through speed was developed around war and logistics, but the intuition extends. Tempo determines who can enter a decision. A market may clear, a cascade settle, and a reputation signal propagate across services before the person whose standing changed receives notice. Transparency after the fact does not restore participation in an act that became irreversible before participation was possible. 20
Not every fast transaction is political. A millisecond trade among consenting systems may need no human pause. The constitutional issue begins when speed joins consequential authority and the person affected cannot interrupt, verify, or reverse the chain. A millisecond classification that terminates health coverage or professional standing presents a different object from a millisecond exchange whose parties accepted the tempo.
The response begins by distinguishing the transient runtime from the organizational and evidentiary identities around it. The process may vanish. The principal who deployed it, benefited from it, or placed assets behind it must remain. The delegation, model version, capabilities, material inputs, and path from output to consequence must survive in a form another institution can inspect. Responsibility follows from choosing the authority delegated, the conditions of operation, and the institutional benefit of using a process too fast or complex for continuous review. Delegation can alter how responsibility is discharged without making it evaporate.
A further difficulty appears when an agent acts beyond what its principal explicitly specified. No charter anticipates every circumstance. At some point the system extrapolates, selecting an action from a policy learned or composed under conditions the principal did not enumerate. The action may remain useful and may still be authorized in a broad legal sense. It should not silently borrow the epistemic status of an instruction that was never given. A receipt can mark the boundary, distinguishing the rule supplied by the principal from the inference supplied by the system and identifying the party that accepted responsibility for permitting that class of extrapolation.
Power without a face is governed by preserving a chain in which authority, inference, benefit, and responsibility remain distinguishable, not by finding one engineer to blame. What cannot be permitted is for the chain to end in architecture itself, with every institution able to say that the system decided and none required to answer for having made the system's answer consequential.
The same chain must preserve time enough for a claim to matter. A person cannot contest a decision that has already exhausted the interest at stake. Content restored after an election, wages released after payroll, a license reinstated after the scheduled shift, or a market position explained after liquidation all present the same defect. An appeal may exist in doctrine and arrive only after the world in which it mattered has passed.
Constitutional procedure has always contained a temporal claim. Notice precedes some deprivations. Hearings occur while remedy remains possible. Emergency acts remain provisional and reviewable. Machine coordination makes this principle harder and more necessary. The whole system cannot be slowed to deliberative tempo without destroying the coordination it was built to achieve, and most routine acts require no human pause. The requirement attaches locally where a decision changes standing, livelihood, identity, access to essential assets, or another interest whose loss cannot be repaired by later explanation.
The interval can take different forms. A governance change may wait before execution. A severe adverse act may require notice and an opportunity to seek a stay. An emergency freeze may take effect immediately but expire unless the issuer supplies a full evidentiary account within a defined period. Review may suspend irreversible consequences while allowing a narrowly tailored precaution to remain. The durations will differ by domain. The principle is stable: the more severe and less reversible the consequence, the stronger the duty to preserve time in which the affected person can enter the process.
Exit protects another route. Time protects voice before the present route closes. A system offering departure but no interval for contest gives the person a consumer's remedy. A system offering voice only after the consequence is complete offers an archive.
When Permission Becomes a Right
The Celsius decision supplies a useful warning against treating documentation as freedom. The governing terms transferred ownership, and the bankruptcy court relied upon them. Better disclosure might have made the relation harder to misunderstand, but no receipt describing the transfer would have converted an unsecured claim into self-custody. The master could have issued immaculate paperwork. The decisive power would still have remained with the master.
A receipt therefore occupies a narrower and indispensable place. It gives the affected person an evidentiary object when consequential authority is exercised. The object states what was done, cites the authority, identifies the operative bounds, separates observation from inference, preserves the evidence supporting the act, and names a path through which the act can be challenged. It commits the issuer to one account before later convenience supplies another.
Suppose a payment platform reverses a transfer after classifying the merchant as belonging to a prohibited category. A generic notice invoking risk controls does little. A usable receipt identifies the transaction, the rule in force when the act occurred, the category applied, the evidence on which the classification rested, the scope of the reversal, and the route through which the merchant can contest the classification before the interruption destroys the business it was meant to protect. The difference lies less in the quantity of information than in whether the account can be tested.
Even a complete receipt remains paperwork unless institutions make it effective. The rule cited must predate the act. The bounds must exclude powers rather than restate discretion. The justification must be specific enough to challenge. Review must leave the chain that produced the decision, occur at a cost proportionate to the interest at stake, and possess authority to reverse or compensate. Repeated invalid acts must create consequences for the issuer. A person who wins an appeal after losing the livelihood, audience, or credential receives vindication without remedy.
A usable receipt also preserves an asymmetry between power and person. The institution may need to disclose its authority, evidence, and decision path without demanding an unrelated biography in return. Otherwise contest becomes another occasion for collection. The person proves the standing needed for the dispute and no more, while the issuer bears the heavier burden because it chose to exercise consequential power.
Receipts change what can be known across cases. One disputed act may admit several plausible explanations. A thousand receipts citing the same vague rule, falling disproportionately on one class of user, or repeatedly reversed by independent review reveal a pattern no individual claimant could establish alone. The record can therefore serve both personal recourse and public supervision, provided aggregation protects the people described while preserving scrutiny of the institution that acted.
The requirement should follow consequential interference rather than every influence. A recommendation can shape preference without closing an option, and no serious order should issue a constitutional receipt for every ranking or suggestion. Manipulation, addictive design, and preference formation remain political problems, but their remedies include competition, disclosure, education, and spaces outside optimized environments. Turning every influence into coercion would dissolve the distinction the receipt is meant to make visible.
Some acts occupy the edge. A shadow ban is described as ranking but may remove practical access to an audience. A gradual degradation of service may induce departure while preserving the appearance of choice. A change in terms may leave formal exit intact while making continued work impossible. In such cases the institution should have to state whether it claims to have altered the person's standing. The receipt cannot decide the classification by itself. The duty to produce one makes hidden impairment harder to maintain.
Permission becomes a right only through a sequence. Architecture first removes powers that need not exist. Rules and capabilities bind those that remain. Receipts expose their exercise. Independent institutions test the account while remedy is still possible. Consequences give the test force. Exit preserves standing when the institution itself cannot be repaired. No element alone is constitutional freedom. Together they place the person in a position from which conflict need not collapse into supplication.
The republican ambition is larger than documentation but begins with the difference between a request and a claim. A person able to identify the act, invoke a rule, reach an independent forum, obtain a timely remedy, and leave without becoming nobody is no longer confined to cultivating favor. The institution may retain substantial authority, and the person may still lose. The authority must now meet the governed as someone with standing rather than as a user asking for an exception.
Consequence
Freedom understood as non-domination is not a demand that no one interfere. Law, markets, institutions, and other people continuously limit what can be done. The demand is that consequential power be controlled, that those subject to it possess standing, and that liberty not depend on the continuing goodwill of the party best positioned to revoke it.
The Celsius account made the distinction visible through custody. The balance worked until the institution stopped honoring withdrawals, and the legal relation beneath the interface determined what remained. The creators engaged in algorithmic gossip reveal the anticipatory effect, conduct shaped before any explicit command. The only wharf shows when private ownership acquires duties because another person has no practical route around it. Distributed systems show why responsibility must survive even when no unitary decision-maker does. Each case turns on a different form of the same question: is the person acting under a right, or under a permission another party controls?
Architecture answers part of that question by removing one switch through self-custody, excluding classes of unauthorized action through capability bounds, preserving an interval for response through time locks, and making exercises of power inspectable through receipts. These devices supply no complete political order. They reduce the domain in which freedom depends upon trust in a master's character.
Even a system that reliably tracks human interests would leave a republican question for Chapter 7: whether the person subject to its power can verify the claim of benevolence, contest its application, and reach a party answerable for the consequence.
The chapter's claim is narrower than a program for replacing institutions with cryptography. Public law remains necessary. Human judgment remains necessary. Some powers should be prohibited, some removed by architecture, some bounded by published rules, some exposed through receipts, and some entrusted to institutions capable of interpreting circumstances no protocol can settle. The governing requirement is that no consequential authority become unanswerable merely because it is private, computational, distributed, or usually kind.
The next question is material. What kinds of limits can remain binding after management changes, policy shifts, and virtue fails?
The kind master problem ends only when the liberty in question no longer depends on kindness.