Software decides who gets paid, who gets counted and who gets refused. Corrigibility asks
one blunt question of any such system: can the people it decides about make it change its
mind?
EXIT, CODE, AUDIT, GOVERN, FORK — and all of them have to pass.
Each closes one part of a single circuit; leave a gap anywhere and the circuit carries no
corrections at all.
If a computer decides something about your life, can you argue back?
Rations, a bank account, a SIM card, a welfare payment — more of these are decided by
software than by a person you can talk to. Software applies a fixed set of rules to
people, and people do not come in a fixed set. So it will get some of them wrong. That
part is arithmetic, not scandal.
The question worth asking is the next one: when it gets you wrong, is there anything you
can do about it? A system that can be told it is wrong, and made to change, is
corrigible. One that cannot is not — however modern, popular or
well-meaning it is.
Corrigibility asks that question in five parts, and a system has to pass every one.
Each closes a different section of the same circuit: you can see what happened, you can
refuse, your refusal binds the operator, and if none of that works the system can be
rebuilt without them.
If you commission, fund or regulate this infrastructure
A definition that can fail
The G20 New Delhi Declaration and the UN and UNDP frameworks describe infrastructure
that should be secure, or that can be built on open standards. Those
definitions exclude almost nothing. They state intent, not condition — so a system that
traps the people inside it still qualifies as public infrastructure, provided it runs at
scale.
This framework gives those same commitments a form that can be checked, and that can
come back negative. Five conditions, each verifiable against a system already in
production, and derived rather than asserted: requisite variety from cybernetics, constitutional
constraint from the commons literature, the right to reproduce from free software. The
appendices carry the control-theoretic model and a machine-readable schema for
assessment; the framework and its application are both CC0, so nothing here needs permission to reuse, translate
or adapt into a procurement standard.
The framework is governance-agnostic and it is not an argument against digital public
infrastructure. eighteen systems already in production pass all five conditions. It is
an argument about which claims survive measurement.
How rigorously a claim is being verified
PresenceLaws, bodies and policies exist on paper.
BehaviourControls execute under stress; audits carry consequences.
ProofTrust is continuously testable, authority is scoped and revocable, claims are machine-verifiable, failures are bounded.
Most deployments satisfy Presence. Few reach Behaviour. Almost none achieve Proof. The
conditions define what to verify; the tiers define how hard.
Paper I, §1.1
Thesis
Digital Public Infrastructure is not merely a collection of software stacks; it is the
encoding of political arrangements into technical artifacts. Because these systems apply
fixed rules to the infinite variety of human life, they will inevitably misclassify,
exclude, or fail specific users. The critical question is not whether errors occur, but
whether the architecture permits those affected to detect, correct, and reverse them
before harm becomes permanent.
The framework is governance-agnostic but politically pointed. Systems promoted globally as
model DPI — Aadhaar, UPI, large parts of the India Stack export agenda — fail one or more of
the five tests when measured structurally. Systems that already run the world — Linux,
Kubernetes, the Web — pass them. The framework is the apparatus that makes that comparison
falsifiable rather than rhetorical.
The invariant
What the invariant guarantees
Corrigibility guarantees the architectural capacity for affected participants to detect
error, signal harm, and trigger correction. Five conditions form a closed corrective
loop; the failure of any one converts the system to open-loop, in which errors
accumulate without bound.
Fatal failurePartial compliance is functionally equivalent to complete failure.
ObservabilitySensorErrors are detectable.CODE·AUDIT
ParticipationError signalThe affected can refuse.EXIT
ReplacementSelectionThe loop can be reproduced.FORK
Figure 1 · Four control layers form a closed feedback loop.
Cybernetics
Ashby’s Law of Requisite Variety (1956): a controller needs variety matching the
system it regulates. Where it does not, regulation has failed.
Commons governance
Ostrom’s constitutional constraint: rules that the people bound by them can modify.
Free software
The right to reproduce — the freedom to fork is what makes replacement more than a
threat.
The five conditions are derived from these three, not asserted. Paper I, §3.
The tests
Jointly necessary, individually insufficient
Each test opens with the question it actually asks, and the formal statement sits one click
behind it. Verification then differs for deterministic (DPI) and learned (EPI)
infrastructure.
If saying no costs you your rations, your bank account and your phone number, then you never really said yes. Refusal is how a system hears that it is hurting someone. Take away the ability to refuse and you have not removed the complaint — you have removed the microphone.
The formal statement
∀ user state s ∈ S, ∃ transition s → s₀ such that the exit penalty π(s → s₀) < τ_exit
Users must possess the capacity to withdraw without disproportionate penalty.
Irrevocable consent functions structurally as mandatory lock-in — when a system
becomes a prerequisite for existence, refusal stops being feedback and becomes a
survival penalty.
DPI
A non-digital path achieves equivalent outcomes — cash for payments, paper ID for
identification.
EPI
A human fallback is guaranteed and accessible; automated decisions can be opted
out of.
Failure
Aadhaar — opting out cuts off banking, rations, connectivity.
The penalty is existential.
The program is the rule. A law you can read, argue with and take to court; a program that runs on you at the moment of decision leaves no gap to argue in. If nobody outside the operator can read what it does, nobody outside can tell you it is wrong.
The formal statement
For any decision function f: X → Y, ∃ a publicly accessible artifact A_f specifying f(x) ∀ x ∈ X
Power in a digital system resides in execution. If the execution path is hidden, that
power is not merely unaccountable; it is structurally unobservable to those it
governs.
DPI
Source, schemas and rule definitions are publicly inspectable — executable
artifacts, not open-standards branding.
This is not everyone auditing everything. It is that nobody can stop the one person who wants to. Most people never investigate anything; journalism still works, because permission was never required. The moment checking needs the operator's approval, the check belongs to the operator.
The formal statement
∀ external party P, Access(P, ε_S) = true without Authorize(Operator, P)
Inspection enables understanding; verification enables truth. A system is verifiable
only if external, permissionless actors can test its behaviour and measure error
rates in production — without asking the operator first.
DPI
Production endpoints can be probed; logs accessible; error rates publishable by
third parties.
Can the rules be changed by the people they are applied to?
A complaints form is not power. Nor is a consultation, a helpline or an advisory board. Power is when the operator cannot overrule the answer. And it has to be quick: software decides in milliseconds, courts decide in years, and a rule you can only overturn six months later did not govern anything in between.
The formal statement
∃ G: Rules → Rules′ that is (1) accessible to affected parties, (2) binding on the operator, (3) chained in custody
Verification identifies error; constitutive constraint enforces correction.
Consultations, multi-stakeholder forums and feedback portals do not satisfy GOVERN
unless their output binds the operator.
DPI
A binding RFC process with chain of custody — IETF, W3C, Linux kernel
maintainership.
EPI
The Action Boundary Protocol — a deterministic envelope around
stochastic inference.
Failure
GDoS — agentic systems acting faster than governance can review.
Nobody actually wants to split the country's payment system in two. That is the point. Email works not because everyone runs their own version of it, but because anyone could — and that possibility is what keeps whoever runs it honest. It is a threat that works best unused.
The formal statement
∃ S′ instantiable by an independent party, with public artifacts and portable state U_S → U_S′
The ultimate check on power is the ability to recreate it. LibreOffice, MariaDB,
OpenSearch and Valkey all emerged when governance variety collapsed. Natural barriers
do not disqualify; only constructed barriers do.
DPI
Code, schemas, protocols and user state are portable; competition is not legally
prohibited.
EPI
The training pipeline is reproducible — compute, data and pipeline access are not
gated by capital asymmetry alone.
Failure
Compute capture — open weights without affordable retraining
make FORK theoretical.
Why partial compliance fails
Two results in Paper I do the structural work. They are why a system can satisfy four tests
and still operate open-loop, and why publishing an artifact is not the same as opening a
loop.
Weakest-layer principle
Corrigibility is the minimum across layers, not the average
A system’s corrigibility status equals its weakest layer across any test dimension.
Strength at one layer cannot compensate for failure at another.
This is what open-washing exploits. Releasing SDKs passes CODE at the interface layer
while core logic stays proprietary — failing CODE at the execution layer. That is not
partial corrigibility; it is total failure at the layer that determines outcomes, and it
propagates to the system verdict.
Post-execution fallacy
Grievance is not feedback
Courts, ombudsmen and grievance officers operate on bureaucratic time, measured in
months. Infrastructure operates on digital time, measured in milliseconds. A system that
wrongly deletes a beneficiary and relies on a court order six months later is
structurally ungoverned for that duration.
Channels that record dissatisfaction without a binding mechanism to modify execution are
not a feedback loop — the paper calls them roach motels for complaints. Governance has to
function inside the execution loop, blocking prohibited states before they manifest, and
its claims must be evidentiary rather than declarative.
The absence is not peculiar to one system. Paper I records that the World Bank’s
digital-wallet policy notes — the series specifying the coming decade’s identity substrate —
contain no subject-corrective vocabulary at all: redress, grievance, appeal, recourse,
contestation and correction appear nowhere in either architectural note, while issuer-side
revocation recurs throughout.
Evidence
The tests return verdicts, not opinions
Paper I applies the five tests across three categories: government systems promoted as DPI,
platform infrastructure claiming openness, and infrastructure that satisfies all five. The
evaluations assess governance architecture, not operational performance — a system can be
simultaneously useful and incorrigible.
Government infrastructure
Systems designated as DPI exhibit a consistent failure mode: partial compliance on the
technical tests — EXIT, CODE, AUDIT — while failing structurally on GOVERN and FORK. By
holding a monopoly on execution, they render the feedback loop inoperable.
Platform infrastructure
Technical openness does not produce accountability. Open weights, open protocols and
open standards can each mask a closed correction loop.
The artifact is open. The correction loop is closed. Seeing the machine does not govern
it.
Eighteen systems pass all five
Paper I · Table 6
Linux Kernel
Linux Foundation
Let’s Encrypt
ISRG
Wikipedia
Wikimedia Foundation
Matrix Protocol
Matrix.org Foundation
Bluesky · AT Protocol
Bluesky PBC
PostgreSQL
PGDG
IPFS
Protocol Labs
Bitcoin
Decentralised
Kubernetes
CNCF
Firefox
Mozilla Foundation
Apache HTTP
Apache Foundation
Apache Kafka
Apache Foundation
OpenSearch
Linux Foundation
Valkey
Linux Foundation
Hyperledger
LF Decentralized Trust
LibreOffice
Document Foundation
MariaDB
MariaDB Foundation
Eclipse IDE
Eclipse Foundation
A pattern emerges that the framework does not flatter: these systems are predominantly
non-essential. No individual’s survival depends on reaching Linux or Let’s
Encrypt. The correlation between corrigibility and non-essentiality is structural, and it is
the problem the political economy half of the paper is written to explain.
Action research
Adversarial intervention in deployed systems
The method is action research: the review proceeds through an intervention in the system
being studied. Conducted while an operator is defending that system, it yields different
evidence from a cooperative review — trust boundaries are stated under pressure, and every
claim meets a counter-claim. Two of these were reviewed through public technical work; the
third continued in a forum that binds the operator, which is the route left when inspection
is refused.
Identity infrastructure2010 – 2018
Aadhaar
Reviewed the authentication path, the federation of consumer portals around it, and
the gap between a voluntary design and the mandates issued downstream. Parts of this
review were prepared for counsel in the Aadhaar proceedings, where I was not a party.
The failure sat at the trust boundary.
Numbers surfaced through federated government portals rather than through the core
registry — an integration-layer exposure that the operator's own denials did not
address. CODE · AUDIT
Enrolment became a precondition of service.
University, school and municipal systems made enrolment a precondition of service,
which is the exit penalty the framework names, and it is visible only in deployment.
EXIT
Reporting indexed on In the Media — 2017, filed under Aadhaar.
Payment infrastructure2017 – 2018
UPI · BHIM
Reviewed the client permission surface, the consent terms, and what an identifier
alone was sufficient to authorise, while the rollout was under way.
An identifier was enough to bind a payment.
A one-rupee transfer demonstrated that a published Aadhaar number resolved to a live
account — the number belonged to the then TRAI chairman, who had published it as a
challenge and was reported to be unaware of the binding.
AUDIT
The permission surface exceeded the stated function.
The permission surface requested capabilities the stated function did not require,
under terms whose obligations could not be read off the document.
CODE · EXIT
Findings that bind the operator, which a design review cannot produce.
Data sharing was restrained.
In January 2021 the Union and NIC were restrained from sharing application data with
other parties without user consent — a constraint the operator is held to.
GOVERN
The mandate was narrowed on the record.
India was the only democracy to make its contact-tracing app mandatory (MIT Technology Review, May 2020); the claim that installation was compulsory for metro travel did not survive the
proceedings. EXIT
A partial release leaves the decision path unobservable.
A client-side publication with the server side withheld leaves the decision path
unobservable — the failure mode CODE names, argued against a live system rather than
in the abstract. CODE · AUDIT
Contemporaneous reporting is indexed on In the Media — 2020–21,
filed under Aarogya Setu.
History
What changed, and when
A definition people are asked to apply to real systems has to be citable at a version. Each
entry says what moved and why, so a claim made against an earlier reading can be checked
against the reading that was current when it was made. The framework paper carries its own revision
dates; the assessment schema carries its own semantic version.
Both, rev. 11 Jul 2026
EXIT gains a second discharge path: for systems no one can leave, verified Functional
Exit Equivalence can supply the error signal literal exit would have. Data Capture joins
Compute Capture as an independent barrier to reproducing a learned system. Assessment is
read at the least-resourced stratum rather than the mean user.
Schema 3.1, Jul 2026
Aligned to that revision. fork_viability separates reproducing the artifact
from reproducing its governance. Every field added was optional, so documents written
against 3.0 stayed valid.
The framework, 29 Apr 2026
The framework stated and derived — requisite variety from cybernetics,
constitutional constraint from the commons, the right to reproduce from free software —
with the control-theoretic result that partial compliance is open-loop operation.
Both are CC0. Cite the paper and its revision date rather than this page, and if you
are adapting the conditions into a procurement standard or an audit, nothing here needs
asking.
Papers
Paper I establishes the invariant for deterministic infrastructure. Paper II extends it to
learned and agentic systems. Both are now indexed on SSRN.
Paper I · DPI54 pp. · rev. 11 Jul 2026
Corrigibility as a Structural Precondition for Digital Public Infrastructure: A Cybernetic Framework
DPI is currently evaluated by aspirational criteria — interoperability, inclusion,
openness, scale — that do not establish whether systemic errors can be corrected by
affected participants. Five jointly necessary conditions form a closed corrective loop,
derived from control theory, commons governance and free software, and formalised by
control-topology mapping.
Corrigibility does not guarantee fairness. It guarantees reversibility.
Epistemic Capture and the Action Boundary: Corrigibility for Learned and Agentic Public Infrastructure
Three structural pressures constrain corrigibility in learned systems: opacity of
inference, requiring LWD-R disclosure — logic, weights, data, representation;
concentration of training resources, or compute capture; and acceleration of automated
action, a governance denial of service. The Action Boundary Protocol separates
probabilistic inference from deterministic execution.
The invariant holds under stochastic verification.
@article{aravind2026corrigibility,
title = {Corrigibility as a Structural Precondition for
Digital Public Infrastructure: A Cybernetic Framework},
author = {Aravind, Anivar A.},
year = {2026},
url = {https://github.com/anivar/corrigibility-framework},
doi = {10.2139/ssrn.6059075},
license = {CC0-1.0},
orcid = {0009-0009-8995-0005}
}
Applied to learned systems · BibTeX
@article{aravind2026epi,
title = {Epistemic Capture and the Action Boundary:
Corrigibility for Learned and Agentic Public Infrastructure},
author = {Aravind, Anivar A.},
year = {2026},
url = {https://github.com/anivar/corrigibility-framework},
doi = {10.2139/ssrn.6669318},
license = {CC0-1.0},
orcid = {0009-0009-8995-0005}
}