Software decides who gets paid, who gets counted and who gets refused. Corrigibility asks
one blunt question of any such system: can the people it decides about make it change its
mind?
Corrigibility is the property of a system in which affected participants can detect,
contest, and structurally override systemic error.
It is not transparency, accountability, openness or auditability in isolation — a system
can publish documentation, provide APIs and maintain oversight boards and remain
incorrigible, because none of those gives the people it misclassifies any binding means of
correction.
An infrastructure is corrigible if and only if it satisfies five jointly necessary
conditions, which together close the feedback loop between what the system does and what
the people inside it can correct:
EXITCan you walk away?Participation is reversible without disproportionate penalty.
CODECan anyone read the rules?The logic that decides is publicly inspectable.
AUDITCan outsiders check without permission?Behaviour is verifiable by parties the operator does not select.
GOVERNCan the governed bind the operator?Rule changes are accessible to the affected and enforceable.
FORKCould somebody else rebuild it?The system can be reproduced by an independent party.
Figure 1 of the paper, in this site’s palette: the conditions close one corrective
loop. CODE and AUDIT are its sensors, EXIT the error signal, GOVERN the actuator, FORK
the selection pressure over the whole loop.
All five, or nonePartial compliance is functionally equivalent to complete failure. Failure of any one
condition opens the loop, and an open-loop system executes without the capacity to sense
deviation or apply correction.
Why it matters
If a computer decides something about your life, can you argue back?
Rations, a bank account, a SIM card, a welfare payment — more of these are decided by
software than by a person you can talk to. Software applies a fixed set of rules to
people, and people do not come in a fixed set. So it will get some of them wrong. That
part is arithmetic, not scandal.
The question worth asking is the next one: when it gets you wrong, is there anything you
can do about it? A system that can be told it is wrong, and made to change, is
corrigible. One that cannot is not — however modern, popular or well-meaning it is.
The tests
Jointly necessary, individually insufficient
Each test opens with the question it actually asks; the formal statement sits one click
behind it. Verification differs for deterministic (DPI) and learned (EPI) infrastructure.
If saying no costs you your rations, your bank account and your phone number, then you never really said yes. Refusal is how a system hears that it is hurting someone. Take away the ability to refuse and you have not removed the complaint — you have removed the microphone.
The formal statement
∀ user state s ∈ S, ∃ transition s → s₀ such that the exit penalty π(s → s₀) < τ_exit
DPI
A non-digital path achieves equivalent outcomes — cash for payments, paper ID for
identification.
EPI
A human fallback is guaranteed and accessible; automated decisions can be opted
out of.
Failure
Aadhaar — opting out cuts off banking, rations, connectivity.
The penalty is existential.
The program is the rule. A law you can read, argue with and take to court; a program that runs on you at the moment of decision leaves no gap to argue in. If nobody outside the operator can read what it does, nobody outside can tell you it is wrong.
The formal statement
For any decision function f: X → Y, ∃ a publicly accessible artifact A_f specifying f(x) ∀ x ∈ X
DPI
Source, schemas and rule definitions are publicly inspectable — executable
artifacts, not open-standards branding.
This is not everyone auditing everything. It is that nobody can stop the one person who wants to. Most people never investigate anything; journalism still works, because permission was never required. The moment checking needs the operator's approval, the check belongs to the operator.
The formal statement
∀ external party P, Access(P, ε_S) = true without Authorize(Operator, P)
DPI
Production endpoints can be probed; logs accessible; error rates publishable by
third parties.
Can the rules be changed by the people they are applied to?
A complaints form is not power. Nor is a consultation, a helpline or an advisory board. Power is when the operator cannot overrule the answer. And it has to be quick: software decides in milliseconds, courts decide in years, and a rule you can only overturn six months later did not govern anything in between.
The formal statement
∃ G: Rules → Rules′ that is (1) accessible to affected parties, (2) binding on the operator, (3) chained in custody
DPI
A binding RFC process with chain of custody — IETF, W3C, Linux kernel
maintainership.
EPI
The Action Boundary Protocol — a deterministic envelope around
stochastic inference.
Failure
GDoS — agentic systems acting faster than governance can review.
Nobody actually wants to split the country's payment system in two. That is the point. Email works not because everyone runs their own version of it, but because anyone could — and that possibility is what keeps whoever runs it honest. It is a threat that works best unused.
The formal statement
∃ S′ instantiable by an independent party, with public artifacts and portable state U_S → U_S′
DPI
Code, schemas, protocols and user state are portable; competition is not legally
prohibited.
EPI
The training pipeline is reproducible — compute, data and pipeline access are not
gated by capital asymmetry alone.
Failure
Compute capture — open weights without affordable retraining
make FORK theoretical.
Derived, not asserted
Where the conditions come from
Each condition is inherited from a tradition that already governs working infrastructure:
requisite variety from cybernetics — Ashby’s law that a controller needs variety matching
the system it regulates; constitutional constraint from Ostrom’s commons — rules that the
people bound by them can modify; and the right to reproduce from free software — the
freedom to fork, which makes replacement more than a threat. The tests in turn derive the
instruments that verify them.
The framework at a glance, from the paper’s §3: traditions above, tests between,
verification instruments below. Determination is evaluated at the least-resourced
stratum, in both the inward and outward exercise of each test.
The rule
Why partial compliance fails
Corrigibility is the minimum across layers, not the average
A system’s corrigibility status equals its weakest layer across any test dimension;
strength at one layer cannot compensate for failure at another. This is what
open-washing exploits — releasing SDKs passes CODE at the interface layer while core
logic stays proprietary, which is not partial corrigibility but total failure at the
layer that determines outcomes.
Grievance is not feedback
Courts and ombudsmen operate on bureaucratic time, measured in months; infrastructure
operates on digital time, measured in milliseconds. A system that wrongly deletes a
beneficiary and relies on a court order six months later was structurally ungoverned
for the duration. Channels that record dissatisfaction without a binding mechanism to
modify execution are not a feedback loop — the paper calls them roach motels for
complaints.
The absence is not peculiar to one system. The paper records that the World Bank’s
digital-wallet policy notes — the series specifying the coming decade’s identity substrate —
contain no subject-corrective vocabulary at all: redress, grievance, appeal, recourse,
contestation and correction appear nowhere in either architectural note, while issuer-side
revocation recurs throughout.
Evidence
The tests return verdicts, not opinions
The paper applies the tests across three categories: government systems promoted as DPI,
platform infrastructure claiming openness, and infrastructure that satisfies all five. The
evaluations assess governance architecture, not operational performance — a system can be
simultaneously useful and incorrigible. Systems promoted globally as model DPI — Aadhaar,
UPI, large parts of the India Stack export agenda — fail one or more conditions when
measured structurally; systems that already run the world pass them. The framework is the
apparatus that makes that comparison falsifiable rather than rhetorical.
Government infrastructure
Systems designated as DPI exhibit a consistent failure mode: partial compliance on the
technical tests — EXIT, CODE, AUDIT — while failing structurally on GOVERN and FORK. By
holding a monopoly on execution, they render the feedback loop inoperable.
Platform infrastructure
Technical openness does not produce accountability. Open weights, open protocols and
open standards can each mask a closed correction loop.
The artifact is open. The correction loop is closed. Seeing the machine does not govern
it.
Eighteen systems pass all five
The paper · Table 6
Linux Kernel
Linux Foundation
Let’s Encrypt
ISRG
Wikipedia
Wikimedia Foundation
Matrix Protocol
Matrix.org Foundation
Bluesky · AT Protocol
Bluesky PBC
PostgreSQL
PGDG
IPFS
Protocol Labs
Bitcoin
Decentralised
Kubernetes
CNCF
Firefox
Mozilla Foundation
Apache HTTP
Apache Foundation
Apache Kafka
Apache Foundation
OpenSearch
Linux Foundation
Valkey
Linux Foundation
Hyperledger
LF Decentralized Trust
LibreOffice
Document Foundation
MariaDB
MariaDB Foundation
Eclipse IDE
Eclipse Foundation
A pattern emerges that the framework does not flatter: these systems are predominantly
non-essential. No individual’s survival depends on reaching Linux or Let’s
Encrypt. The correlation between corrigibility and non-essentiality is structural, and it is
the problem the political economy half of the paper is written to explain.
If you commission, fund or regulate this infrastructure
A definition that can fail
The G20 New Delhi Declaration and the UN and UNDP frameworks describe infrastructure
that should be secure, or that can be built on open standards —
definitions that exclude almost nothing, so a system that traps the people inside it
still qualifies as public infrastructure provided it runs at scale. This framework
gives the same commitments a form that can be checked, and that can come back negative:
five conditions, each verifiable against a system already in production. It is
governance-agnostic — eighteen systems in production pass — and it is
CC0, so adapting the conditions into a procurement standard, an audit or a translation
needs no permission.
How rigorously a claim is being verified
PresenceLaws, bodies and policies exist on paper.
BehaviourControls execute under stress; audits carry consequences.
ProofTrust is continuously testable, authority is scoped and revocable, claims are machine-verifiable, failures are bounded.
Most deployments satisfy Presence. Few reach Behaviour. Almost none achieve Proof. The
conditions define what to verify; the tiers define how hard.
The paper, §1.1
Action research
Adversarial intervention in deployed systems
Each review below ran while the system was live and its operator was defending it. That
yields evidence a cooperative review does not: trust boundaries get stated under pressure,
and every claim meets a counter-claim. Two of these ran as public technical work; the third
continued in a forum that binds the operator, which is the route left when inspection is
refused.
Identity infrastructure2010 – 2018
Aadhaar
Reviewed the authentication path, the federation of consumer portals around it, and
the gap between a voluntary design and the mandates issued downstream. Parts of this
review were prepared for counsel in the Aadhaar proceedings, where I was not a party.
The failure sat at the trust boundary.
Numbers surfaced through federated government portals rather than through the core
registry — an integration-layer exposure that the operator's own denials did not
address. CODE · AUDIT
Enrolment became a precondition of service.
University, school and municipal systems made enrolment a precondition of service,
which is the exit penalty the framework names, and it is visible only in deployment.
EXIT
Reporting indexed on In the Media — 2017, filed under Aadhaar.
Payment infrastructure2017 – 2018
UPI · BHIM
Reviewed the client permission surface, the consent terms, and what an identifier
alone was sufficient to authorise, while the rollout was under way.
An identifier was enough to bind a payment.
A one-rupee transfer demonstrated that a published Aadhaar number resolved to a live
account — the number belonged to the then TRAI chairman, who had published it as a
challenge and was reported to be unaware of the binding.
AUDIT
The permission surface exceeded the stated function.
The permission surface requested capabilities the stated function did not require,
under terms whose obligations could not be read off the document.
CODE · EXIT
Findings that bind the operator, which a design review cannot produce.
Data sharing was restrained.
In January 2021 the Union and NIC were restrained from sharing application data with
other parties without user consent — a constraint the operator is held to.
GOVERN
The mandate was narrowed on the record.
India was the only democracy to make its contact-tracing app mandatory (MIT Technology Review, May 2020); the claim that installation was compulsory for metro travel did not survive the
proceedings. EXIT
A partial release leaves the decision path unobservable.
A client-side publication with the server side withheld leaves the decision path
unobservable — the failure mode CODE names, argued against a live system rather than
in the abstract. CODE · AUDIT
Contemporaneous reporting is indexed on In the Media — 2020–21,
filed under Aarogya Setu.
The paper
Corrigibility is one paper. The second document is not a second framework — it carries the
same invariant to learned and agentic systems, where only the verification machinery
changes. Both are indexed on SSRN.
The paper · DPI54 pp. · rev. 11 Jul 2026
Corrigibility as a Structural Precondition for Digital Public Infrastructure: A Cybernetic Framework
DPI is currently evaluated by aspirational criteria — interoperability, inclusion,
openness, scale — that do not establish whether systemic errors can be corrected by
affected participants. Five jointly necessary conditions form a closed corrective loop,
derived from control theory, commons governance and free software, and formalised by
control-topology mapping.
Corrigibility does not guarantee fairness. It guarantees reversibility.
Epistemic Capture and the Action Boundary: Corrigibility for Learned and Agentic Public Infrastructure
Three structural pressures constrain corrigibility in learned systems: opacity of
inference, requiring LWD-R disclosure — logic, weights, data, representation;
concentration of training resources, or compute capture; and acceleration of automated
action, a governance denial of service. The Action Boundary Protocol separates
probabilistic inference from deterministic execution.
The invariant holds under stochastic verification.
@article{aravind2026corrigibility,
title = {Corrigibility as a Structural Precondition for
Digital Public Infrastructure: A Cybernetic Framework},
author = {Aravind, Anivar A.},
year = {2026},
url = {https://github.com/anivar/corrigibility-framework},
doi = {10.2139/ssrn.6059075},
license = {CC0-1.0},
orcid = {0009-0009-8995-0005}
}
The extension · BibTeX
@article{aravind2026epi,
title = {Epistemic Capture and the Action Boundary:
Corrigibility for Learned and Agentic Public Infrastructure},
author = {Aravind, Anivar A.},
year = {2026},
url = {https://github.com/anivar/corrigibility-framework},
doi = {10.2139/ssrn.6669318},
license = {CC0-1.0},
orcid = {0009-0009-8995-0005}
}
Views expressed are entirely my own and do not represent the views, positions, or
opinions of my employer.
