What the System Believes About You Must Be Visible

Priya opens a talk about a consensus algorithm she has not used. The channel shows the algorithm’s steps and a diagram. An introductory section is folded away. When she asks why, it answers: Consensus foundations treated as already known, inferred from earlier architecture reviews.

Priya knows the field. But the folded section states which failures this particular algorithm assumes. Familiarity with consensus does not establish that she knows this talk’s assumptions, and even knowing them would not make their role in the argument dispensable. The inference has changed the communication at the point where its scope mattered most.

In the previous chapter, an adapter could make a similar mistake about her policy: treating a saved setting as proof of enforcement, or a broader control as an implementation of her narrower rule. Beliefs about the person and beliefs about her instructions both have consequences.

These are constructed cases. The question they expose is:

If the system’s beliefs about me or my policies can materially change communication, what must I be able to see and correct?

A belief becomes consequential through its use

A belief that Priya is familiar with consensus is not the same object as the decision to fold an explanation. One is a claim about her knowledge; the other is a use of that claim in this talk. The claim could be well supported while the use is inappropriate.

The distinctions from earlier chapters therefore remain active:

DECLARED   what Priya supplied or accepted
OBSERVED   what happened, under recorded conditions
INFERRED   what the system concluded from that evidence

Priya’s instruction to preserve implementation detail is declared policy. Her expansion of a derivation is an observation. The conclusion that she prefers expanded derivations is an inference. None can substitute for another merely because they point towards the same presentation today.

The observation also carries its conditions. If the derivation was expanded during an explicit deep-study mode, that temporary context remains part of its provenance. The system cannot display it later as unconditional evidence of a standing preference. Chapters 23 and 24’s time and learning boundaries apply inside the belief record as well as in the view it produces.

Nor can an inferred claim appear as you told us. A declaration, an observation and an interpretation need distinct origins even when the interface uses the same short sentence to show them.

Provenance and consequence

A visible belief must expose both its provenance and its consequence.

We think you know consensus is insufficient. Priya needs to know what supports that claim, where it is being applied, and what changes because of it. A small account of the opening failure might read:

Claim:           Consensus foundations treated as already known
Origin:          Inferred
Evidence:        Earlier architecture reviews of another protocol
Supported scope: Familiarity with the previously reviewed protocol
Applied scope:   This talk's introductory explanation
Standing:        Provisional; knowledge of this algorithm unconfirmed
Consequence:     Introductory assumptions initially folded

This is an illustrative account of a mistaken use, not a fixed schema. Evidence links should lead to the relevant records the system is permitted to retain. A confidence label cannot replace those records, and “moderate” must not pretend to be a calibrated probability.

The visible account also needs to distinguish the scope supported by the evidence from the scope used in the current decision. Here, earlier reviews support familiarity with one protocol. The renderer applied a broader conclusion to a different algorithm. Showing only the broad claim would conceal the step Priya needs to correct.

Using a belief outside the scope supported by its evidence is itself a new inference.

scope expansion = new inference

Moving from understands consensus basics in architecture discussions to does not need introductory explanations broadens both the claim and its use. That step needs its own provenance, evidence, scope and standing. It cannot inherit the narrow belief’s support merely because the wording looks similar, or disappear into an update to a scope field. Additional confidence or permission cannot be assumed from the original belief either.

Time matters for the same reason. A claim inferred last month may have been reasonable then and be inapplicable now. Its origin, relevant date, revisions and current standing should be available without turning the display into her entire interaction history. The record’s existence does not establish present applicability or permission to use it.

The explanation must identify the belief actually used. A plausible story generated afterwards is not evidence that the decision followed that story. If the channel cannot establish why an assumption was folded, it should report that limitation rather than invent provenance.

Beliefs about a policy also need inspection

Priya can inspect the words of her portable boundary and still be unable to see how a service interpreted them. Keep recommendations out of the feed may become hide all research content. A service’s acknowledgement may become the mediator’s belief that the requested effect is verified.

The operative claims here concern rule meaning, scope, capability and application. Each should be attached to the consequence it produces: which surface is filtered, which material disappears, or why a receipt reports success. The accepted instruction must remain distinguishable from the adapter’s interpretation of it.

policy ≠ system's interpretation of policy

That gives Priya a specific correction: This rule concerns recommendations, not search results. It corrects the interpretation without changing the boundary she supplied. That service has not confirmed removal corrects a claim about enforcement state without undoing her revocation.

Chapter 26’s distinctions remain intact. A declared rule is not its propagated copy; a confirmed setting is not verified protection. Showing the system’s belief about either must not erase the uncertainty that belongs to the underlying event.

Visible, valid and authorised

Visible means consequence-linked inspectability:

visible / inspectable ≠ continuously displayed

The channel need not constantly display every belief. It must provide a discoverable path from a material effect to the belief actually used, its evidence, supported and applied scope, and permitted use. If an introduction has been folded, Why wasn’t this explained? should reach that account. A settings page listing the belief is insufficient if Priya cannot discover that it affected this view. Inspection must also reach suppression, where the affected content is absent.

Three questions must be answered separately:

VISIBLE       Can Priya inspect the claim and its use?
VALID         Does the evidence support it in this scope now?
AUTHORISED    Is this formation, retention and use permitted?

visible ≠ valid ≠ authorised

A belief can be visible and wrong. It can be accurate and used outside the scope for which it was retained. It can be accurate and applicable yet have no authority to change this communication.

This separation lets Priya say: Yes, that belief is correct. No, you may not use it for this. In the talk, that means: I do know the basics. Keep the assumptions visible anyway. She should not have to deny her expertise to recover information that the system removed on its basis.

Visibility also cannot legitimise a prohibited inference. The exclusions on inferred mood, stress, fatigue, motivation and personality state remain exclusions. Displaying we think you are stressed with an edit button does not supply permission to form that belief or simplify communication because of it.

The same applies to retention. An inspection feature is not a reason to keep an otherwise unauthorised observation. The channel must distinguish permission to form a claim, permission to retain it and permission for each consequential use. Evidence strength answers none of those authority questions by itself.

Visibility is not authority, and editability is not permission.

An editable belief is a remedy for an error. It cannot retroactively authorise the error, and leaving a displayed belief untouched is not acceptance. The system must not make Priya’s failure to inspect a record into consent for its continued use.

Consequence should set the bar

The proposed design principle is:

The greater the consequence of an inferred belief, the stronger the evidence and confirmation required before it changes communication.

Consider a belief that Priya finds tables useful. Offering a table beside the prose preserves another route through the material. Folding an explanation because she supposedly knows it can remove a route she needs. Acting for her because she probably wants something done crosses a further boundary entirely.

These are consequence classes, not earned thresholds. Even an additional table can impose clutter or an accessibility cost. The relevant question is what this particular use changes, what a mistake would cost, and how readily the effect can be reversed.

Stronger evidence does not supply missing authority. Confirmation of familiarity does not waive preservation requirements; no confidence score licenses suppressing a decisive assumption. Accessibility requirements remain constraints on the view. Where applicability is uncertain, preserving access and exposing the uncertainty is a proposed conservative response.

Acting or speaking for Priya requires explicit authority. An inference may support a proposal for her to consider, but even a highly confident prediction cannot become that grant. The later part of the book takes up this stronger boundary.

The design must also work when Priya does not inspect a belief. Important information cannot depend on her finding a hidden record and correcting it first. A consequential assumption should be discoverable where its effect occurs, with access to a fuller account. Making a record available somewhere is not the same as making the effect recognisable in the current interaction.

Correction must name what changes

Priya says: This algorithm is new to me. Show its assumptions in this view. That supplies a current correction and an instruction for this talk. It does not declare that she knows nothing about consensus or revise every future explanation.

She might instead say: Stop using inferred expertise to fold assumptions in architecture reviews. That changes the permitted use within a named scope. Or she might reject a claim outright, narrow the situations in which it applies, or ask for the retained item to be forgotten. Those are different operations:

correct the claim
change its scope
stop a use
revise a standing rule
forget the retained item

The response should state which operation occurred. Restoring this explanation must not silently create a new durable preference. Revising a standing rule must not be reported as merely changing today’s view. Forgetting a retained inference must not be presented as though the historical observations that once supported it never happened, or as proof that every distributed copy has disappeared.

For a forget request, the channel should identify the item removed, any evidence retained under separate authority, and whether re-deriving the item is permitted. It must not quietly recreate the same record from retained evidence and call it forgotten.

A local correction also has dependencies. If the same rejected scope produced a belief that a second explanation was redundant, that current consequence needs reconsideration. Locality means changing the relevant claim and its dependent uses while preserving unrelated policies; it does not mean editing one record and leaving its known effects untouched.

Those repairs have separate completion states:

record corrected
        ≠
future use stopped
        ≠
downstream state repaired
        ≠
past effect reversed

A constructed account of a repair might say:

Belief:                      Corrected
Future use:                  Stopped locally in the named scope
Affected current view:       Recomputed
Cached representation:       Replaced
Derived belief:              Invalidated for current use
Previously delivered output: Past effect not reversible

An earlier summary can be replaced or supplemented with a correction; what Priya already read or acted on cannot thereby be undone. Unknown or unreachable dependent uses must remain unconfirmed. A repair report states what changed and what remains, rather than claiming that correcting the source erased every consequence.

For a portable policy, the same discipline reaches the adapters and receipts. A corrected interpretation may need to replace a broader control already applied. Until removal or replacement is confirmed, the mediator must expose the stale effect. Interpretation corrected centrally is not the service now behaves correctly.

An instruction to stop a use must stop it. Merely lowering confidence while the view continues to be shaped by the same claim is not compliance. Recreating a synonymous inference to restore the rejected effect is not a new basis for permission. If Priya declines a proposed standing rule, that refusal retains the meaning established in Chapters 24 and 25: no promotion or continued learning towards that rejected update.

The inference’s past evidence need not be falsified to make these corrections. Priya really may have expanded earlier derivations. That observation can remain historically true if legitimately retained, while the standing preference inferred from it is rejected. Truth about the earlier interaction, current applicability and authority remain separate.

Why this view, and what would change without the belief?

Inspection needs to reach what is missing as well as what is shown. Priya should be able to ask Why is this folded?, What did this boundary withhold?, or Why does this receipt say enforced? A generic explanation that the content is relevant to her cannot answer those different questions.

The answer should identify the contributions actually used: her declared task, applicable standing policy, temporary overlay, source preservation obligations and particular consequential beliefs. It should distinguish a belief that affected the choice from one that was available but not used. Listing every stored item would obscure the decision rather than explain it.

One proposed aid is a comparison with the same communication produced without a selected belief. For Priya’s talk, it would suspend the expertise inference while leaving her familiarity undecided. Withdrawing the claim of familiarity must not be recorded as evidence of ignorance. Her current request, preservation requirements, accessibility and authorised boundaries still apply. Suspending one inference is not permission to turn those constraints off.

The comparison also needs limits. A freshly generated alternative may differ for reasons other than the removed belief. Unless those influences are controlled, the channel should not attribute every difference to that belief. A comparison is an inspection aid, not automatic proof of causation.

The claim that showing provenance and consequence enables faster, more local repair remains untested here. The proposed standard is whether a wrong claim or use can be found, corrected and prevented from continuing to affect the relevant communication without disturbing unrelated policy. A reassuring explanation or increased trust would not by itself establish that those repairs occurred.

The limit of visibility

The point is an inspectable set of consequential claims and uses. A fluent paragraph describing Priya as an expert who likes detail would discard the distinctions she needs: which part she declared, which part was observed under a temporary condition, which part was inferred, and what each part changes now.

Organising the claims by their uses keeps correction attached to a concrete effect. It does not justify a comprehensive inventory of the person. Nor does the ability to inspect a record remove the burden of forming, retaining and revising it.

The examples establish no measured improvement in repair, no calibrated confidence rule and no successful correction across services. They make the intended requirements explicit. A consequential belief needs provenance, supported and applied scope, standing, permitted uses and a visible effect. Correction must reach that effect, and visibility must not become a substitute for validity or authority.

A final tension remains. Even if every retained belief were individually inspectable, their accumulation could be more extensive or influential than the communication requires. Before adding another defensible item, the system still needs to ask whether the task needs it at all. That leads into the composition of the personal layer, and the question beyond it: how much of a person should the system try to model at all?