Mechanism Before Discretion

A payment that leaves an account at four in the morning is cleared by the same rule that cleared one at ten the night before. The rule has not slept, has not read the news, does not know the sender’s surname, and will give the same answer to the same instruction for as long as it is left in force. A person asked to approve the same payment at four in the morning is a different instrument from the one who approved it at ten: tired, if awake at all; aware, perhaps, of something read an hour earlier; and in possession of a surname, a sum and a destination that will move the decision without appearing anywhere in it. Neither instrument is wrong to use. The question this piece is concerned with is which should be consulted first, and the answer it defends is in its title: the rule looks first, and the person is given what the rule could not decide. Not instead of; before.

The argument rests on a distinction that is usually blurred. A mechanism is a decision made once, in advance, in writing, by someone who can be identified, and then applied to every case that meets its terms. Discretion is the same decision made again on each occasion, by whoever is present, in a form that leaves no trace unless someone chooses to write one. Both are ways of deciding. They differ in when the deciding is done, who does it, and whether it can afterwards be found. Everything that follows turns on those three differences.

Where discretion belongs

It would be easy to write this as an argument against judgement, and it is not one. There are three conditions under which a person should decide, and the piece will be clearer for naming them before it names anything else.

The first is the unmeasured variable. A rule can only act on what is given to it, and there are determinations in which the deciding factor has not yet been reduced to something that can be given: the credibility of a counterparty one has met, the state of a market in the minutes after an event that has no precedent, the character of a person who is being considered for a seat. Where the factor is real and unmeasured, a rule applied to the measured remainder will be confidently wrong, and a person should decide. This condition is a limit of the instruments, and it is temporary by nature. Every variable that is now measured was once this one.

The second is the signature. There are acts a counterparty will not accept from a mechanism, and they are right not to: the opening of an account, the release of a settlement, the appointment of an officer. The reason is not that a person’s judgement is better at that moment. It is that a system cannot be sued, fined, struck off or imprisoned, and a legal person can, so a legal person is placed behind the act in order that there is someone to hold. The signature is not evidence that judgement was applied. It is evidence that liability has somewhere to land, and the piece will return to it, because the thing being signed for is changing.

The third is the asymmetry of error. Where a wrong rule would do more damage than a slow judgement, the judgement should be kept, deliberately, as a design decision and not as a failure to design. An action that cannot be reversed belongs here. So does the admission of a person to something they will be hard to remove from. The test is not whether a rule could be written but whether its errors, applied at scale and without pause, would cost more than the delay of asking someone.

These three are different in kind, and treating them as one, under the general heading of “cases requiring judgement”, is how discretion spreads. The first shrinks as measurement improves. The second is a legal fact about who can be held and will change when the law changes. Only the third is a permanent reason, and it is a reason about error, not about the superiority of a person’s view.

Reliability and responsibility

It is often said in favour of systems that they are more responsible than people, and the sentence is wrong in a way worth getting right, because the correct version is stronger.

A system is more reliable. It does not tire, it does not drift between Tuesday and Thursday, it gives the same answer to the same input whether or not a market has fallen that morning, and it is available at every hour at which someone might need the decision. These are large advantages and they are not in dispute. But reliability is a property of behaviour, and responsibility is a property of persons; a rule cannot answer for an outcome, and only someone who can answer is responsible for it. What a mechanism does is not remove responsibility but relocate it. The decision that used to be made by whoever was present, at the moment it was needed, is now made by whoever wrote the rule, at the moment it was written, with their name on the version and the text available to anyone who asks. Responsibility moves upstream, to a smaller number of people, at a time when they are not tired and have no case in front of them to be moved by, and it becomes findable. The author of a payout rule that pays without a human in the loop answers for every payment it makes, knows it when writing, and writes accordingly. The clerk who approved payments one by one answered, in practice, for none of them, because no one could later say which of a thousand approvals was the careless one.

This is the first reason to put the rule before the person. Not that the rule is wiser, but that the rule makes the responsible person identifiable, and a person who knows they will be identifiable decides differently.

Discrimination

The second reason is the one that should weigh most with anyone who holds other people’s money or prospects. Define the term before using it: discrimination is unequal treatment on a variable that is irrelevant to the determination. On that definition, discretion is where discrimination lives, because discretion is where irrelevant variables enter without being seen.

The evidence is not subtle. In 2004 two economists sent nearly five thousand fictitious résumés to employers in Boston and Chicago, identical in every respect except the name at the top, and found that the applications bearing names associated with white Americans received about fifty per cent more calls for interview than the same applications bearing names associated with black Americans. No employer who returned one call and not the other would have described themselves as having decided on the name, and in the sense that matters they had not decided at all; the name had decided, below the level at which deciding is noticed. Two years later a study of newly listed shares found that companies whose ticker symbols could be pronounced as words outperformed those whose tickers could not in the first days of trading, by a margin that had nothing to do with the companies and everything to do with the ease of reading four letters. A surname, a ticker, the typeface of a bank statement, the accent in which a reason is given: each of these is an input to a human decision and absent from any record of it. The same person decides differently on the same facts on two days, and no one, including the person, can say why.

A rule discriminates too, and the argument must concede this, because the concession is where the argument is won. A rule that uses a postcode as a proxy for creditworthiness discriminates on everything the postcode correlates with, every time, at scale, without fatigue. That is worse in volume than any one person’s bias and it is the standard objection to mechanism. But the rule’s discrimination is legible. The variable is in the text; it can be found by reading; its effect can be measured on a population; and when it is found to be irrelevant it can be removed, once, and the removal applies to every future case and can be shown to have applied. A mood cannot be audited. The honest claim is therefore not that mechanism is unbiased. It is that mechanism is correctable, that its corrections propagate, and that discretion is neither. For anyone whose systems decide who is admitted, paid, served or declined, that is the whole of the case: the choice is not between a biased person and an unbiased rule, but between a bias no one can find and a bias everyone can.

The record

If discretion is to be used only where a rule cannot be written, then the occasions on which it is used are the most informative events in an organisation, because each is a place where a rule is missing. They should be recorded as such: the inputs that were available, the variable that was not, the decision, the person, the date and the reasoning in a paragraph. Not as a formality, and not for the file. The record is the mechanism by which discretion becomes something else.

Law has worked this way for as long as there has been law. Cases are decided one at a time by judges exercising judgement; the decisions are written down; later judges are bound by earlier ones, stare decisis, and over decades a body of decisions acquires enough shape that a legislature can read the doctrine out of it and write it as a statute. The judgement was never the end state. It was the draft of the rule. An organisation that keeps a record of its discretionary decisions will find, after a year, that some of them recur, that the recurring ones have stable outcomes, and that a recurring judgement with a stable outcome is a rule that has not yet been written. The three appeals decided the same way are the next clause. The one decided differently is either an error or a variable that has just become visible, and the record is the only way to tell which.

But a record of judgements is only half of the object, and the lesser half. The other half is the rules themselves, written where they can be read. Most organisations hold their rules in three places at once: in the heads of the people who apply them, in documents that describe an earlier version of them, and in the code that actually enforces them, and the three disagree in ways no one has measured. The remedy is a single governed record in which everything the organisation has decided is written once, in plain language, with its status: what is done and what is not, the legal and compliance positions and their reasons, the principles and the mechanisms each has produced, every decision with its date and the reasoning that carried it, and a changelog that shows what was altered, by whom and when. Each sentence in such a record carries its standing with it, draft or stated or in use or approved, so that a reader knows how much weight a line will bear before leaning on it; a sentence does not acquire authority by appearing in a file.

The property that makes this more than a well-kept handbook is that the record is queryable, and queryable by the same interface for a person and for a system. An engineer about to build a control asks the record what the rule is and receives the rule, its status, its date and the decision that produced it. A drafting tool asks the same question in the same form before it writes a clause. A model that is about to act on the organisation’s behalf consults the record for the mandate it is acting under, and the mandate it finds is the one the people wrote, not a summary of it. The code uses the vocabulary the record defines, so that a term means one thing in the agreement, in the discussion and in the system that enforces it. When a rule changes, it changes in the record, and everything that reads the record changes with it.

Two consequences follow, and they are the reason to describe the thing at length. The first is that the guard this piece needs is built in. A mechanism deserves to come before discretion only if it can be read; a rule no one can inspect is discretion wearing a uniform, and the preference for mechanism would, without this condition, become a licence for opaque automation. A record of this kind is the condition. Every rule the systems enforce can be found, with the date it was adopted, the reasoning behind it and the decision that would have to be revisited to change it. The second consequence is a working environment of an unusual kind. Anyone in it can ask why a thing is done the way it is done and receive the answer the organisation actually holds, rather than the answer the nearest senior person recalls; disagreement becomes a proposal to amend a specific sentence rather than an argument about what was meant; and a new colleague can read in a day what would otherwise take a year of overheard corrections to absorb. This is transparency in the sense the first essay gave the word: not exposure, but governance. The record is not public. It is inspectable by everyone with a right to inspect it, which inside the organisation is everyone, and visible to no one else.

The systems I am responsible for are built around a record of this kind, a little over a hundred pages at the time of writing, which the people and the tools consult through one interface. Determinations that must not depend on judgement are executed by rules with no discretionary step, and the rules are in the record; a number is not displayed unless it has been measured; a person’s recorded authorisation is required for any action that cannot be reversed; and the decisions that people do make are written into the same record with their reasons, so that the next rule can be read out of them.

Discretion, in this light, is mechanism in draft, and the record is the pipeline between the two. An organisation without the record is not exercising judgement; it is leaking it.

Ceteris paribus

Economists say ceteris paribus, all else being equal, when they wish to study one variable and must set the rest aside. It is an honest phrase in a model, where the setting aside is declared. It is a dishonest premise in a decision, and it is the premise of every discretionary one. The person who decides a case on the three facts in front of them has held all the other facts equal by the simple expedient of not holding them at all: the forty similar cases decided last year, the one that went wrong, the pattern across the whole book that no single case reveals. A mechanism that decides on the record holds nothing equal. It holds everything, and it holds it with the same weight today as it did on the day the fact was entered.

This is where memory enters the argument, and where it must be stated carefully. Human recall is partial, weighted toward what is recent and what is vivid, and it declines with hours awake and with years lived; this has been measured since the nineteenth century, when a psychologist spent years memorising nonsense syllables to show that most of what is learned is lost within a day. A retrieval system over the record described above forgets nothing and weights nothing by vividness; it recalls the quiet case from six years ago as readily as the loud one from last week, and it does so the same way on every query. Wherever a decision depends on what is known, the instrument that knows all of it should be the one consulted first, and the person’s comparative advantage lies only in what is not yet in the record. The first section of this piece called that the unmeasured variable, and described it as temporary. The territory in which a person decides better than the record is real, and it is shrinking, and the honest position is to say so rather than to defend it as though it were a principle.

Two cautions keep this from becoming a different and worse argument. Retrieval is not judgement: a system that knows every fact in the record has not thereby decided correctly, and the slide from “remembers everything” to “decides rightly” is the error that gives mechanism a bad name. And the record is not the world: what is unmeasured is, by definition, not in it, which is why the first condition stands.

The signatory

The third condition, the signature, is the one now changing under us, and the change is further along than the forms that govern it.

Software agents are transacting. They commit code under their own keys, call paid services, place orders and, within limits set for them, move money. In the spring of 2025 the two largest card networks each announced a programme for payments initiated by agents rather than people, and by the autumn one of them was reporting live purchases on its network; the credential an agent now receives is a token scoped to a stated intent, a merchant, an amount and a window, rather than the card itself, and one network has begun scoring each transaction for the probability that an agent rather than a person began it, so that the bank on the other side can decide how to treat it. Over the same eighteen months a different rail grew up beside the cards, and it grew because the cards could not serve it. A protocol built on a status code the web reserved in the 1990s and never used, 402 Payment Required, lets a server answer a request with a price, lets the requesting agent sign a transfer of a dollar-denominated stablecoin, and lets the retried request go through with the receipt attached. On one network alone the count of such payments rose from about fifteen hundred in the middle of 2025 to more than 138 million by the third quarter of 2026; nearly nine in ten were for sums between a hundredth of a cent and ten cents, and the median time between a new wallet receiving funds and making its first payment fell over the same period from seventy-three days to eighteen minutes. The reasons agents settle this way are not ideological. A piece of software cannot open a bank account, because the account-opening process is built to identify a natural person; a card payment carries a fixed cost that makes a tenth of a cent uneconomic and a dispute mechanism designed for people who change their minds; and a stablecoin moves at every hour, in any amount, to any address, with no one asked to approve the individual transfer. The machine economy is settling in a currency that the compliance apparatus was built to keep at arm’s length, for the exact reason that the apparatus has no door a machine can walk through.

The conflict this produces has already reached the courts, and the first ruling is instructive. In late 2025 a large retailer sued the maker of a browsing agent that could log into a customer’s account with the customer’s credentials and complete a purchase on their instruction, arguing that the agent accessed the retailer’s systems without the retailer’s authorisation whatever the customer had authorised. In March 2026 a federal judge agreed and barred the agent; in August the appeals court vacated the order, holding that under the statute in question it is the user who accesses the system, with the agent as the instrument, and that the retailer’s remedy lay in its terms of service rather than in the law against unauthorised access. The retailer had meanwhile amended those terms to require any agent to identify itself. Both sides of that dispute were asking the same question in different words: when software acts on a person’s instruction, who is the party, and to whom does the counterparty’s consent have to run.

The concept in the way is the authorised signatory, which every onboarding form assumes is a named human with a specimen signature on file. That concept bundles three things that are now coming apart. Authority: a mandate to act. Attribution: proof of who, or what, acted. Accountability: someone who answers if it goes wrong. An agent satisfies the first two better than a person does. A mandate can be stated as a policy with hard limits, in the form of a scoped token or a spending rule, and will be observed exactly; a cryptographic signature with a log attributes an action more reliably than a mark on a page that any clerk may have made. What the agent cannot supply is the third, and the third is the one the law cares about.

The law, as it happens, was ahead of the form. The United States has recognised since 2000 that a contract may not be denied effect solely because its formation involved the action of an electronic agent, and the appeals court’s reasoning in 2026 is the same thought applied to access: the agent is a tool, the person is the party. What has not caught up is practice: the assumption that accountability must be located in the person who performs each act, rather than in the person who authorised the class of acts. The signatory concept does not die. It splits. A person authorises the mandate, once, in writing, with its limits stated; the agent executes within the mandate; the person answers for the mandate and not for each execution. This is how a bank already treats a standing order, and how a fund already treats an execution algorithm. The novelty is only in how much can now be delegated, and the boundary should be drawn where this piece drew it earlier: at reversibility. An action that can be unwound belongs inside the mandate. An action that cannot keeps, for now, a recorded human authorisation, not because a person decides it better but because someone must be able to be held, and the day a system can be held is the day that boundary moves too. It is not an accident that the first act agents were widely permitted to sign was the commit to a repository, which is reversible by design, or that the first payments they were permitted to make were for fractions of a cent, which are reversible by being too small to matter.

What follows from this is a change in what compliance should ask for. The question “who is the authorised signatory” will be replaced, for a growing class of acts, by three narrower ones: what is the mandate, in terms a machine can check; how is each act attributed, in a form a third party can verify; and which legal person stands behind the mandate. An institution that can answer those three for an agent has more assurance than it has ever had from a specimen signature, and an institution that insists on the signature will find, as the retailer did, that the acts happen anyway, through the person’s own credentials, with less visibility rather than more. The rails that are being built now, the scoped token, the signed transfer, the probability score, are mechanisms for the first two questions. The third remains a question about persons, and it will remain so until a system can be held; that is the one part of the signatory that the agent does not take.

Ex ante, ex post

The piece can now be stated in two Latin words and one correction. A mechanism decides ex ante: once, in public, before the case. Discretion decides ex post: each time, in private, with the case in view. Of the two, the first is the better place for most decisions to live, for the three reasons given: it makes the responsible person findable, it makes bias correctable, and it holds the whole record rather than the part a tired person can recall. The correction is that ex post has one proper home. Review after the event, of decisions a rule has already made, inspects without delaying; it catches the rule’s errors at the only moment they can be seen, and it is the source of the next version of the rule. Discretion placed there, after the mechanism rather than before it, is not a concession to the old way of deciding. It is the part of the mechanism that keeps the mechanism honest.

The labyrinth

Galileo wrote that the book of the universe stands open before us but cannot be read by anyone who has not learned the characters in which it is written, and that without them one wanders in vain through a dark labyrinth. He was writing about mathematics and nature. The sentence holds for an organisation and its decisions. A rule is a character that can be read; a judgement, unrecorded, is a turn taken in the dark, correct or not, that no one can retrace. The case for mechanism before discretion is, in the end, the case for legibility: for an organisation that can be read by the people inside it, by the counterparties who deal with it, and by the person who will one day have to answer for it and would like to know what they are answering for. Where the rule can be stated, the rule. Where it cannot, judgement, recorded, so that one day it can.

Sources

Marianne Bertrand and Sendhil Mullainathan, "Are Emily and Greg More Employable than Lakisha and Jamal? A Field Experiment on Labor Market Discrimination", American Economic Review, vol. 94, no. 4, September 2004.
Adam L. Alter and Daniel M. Oppenheimer, "Predicting short-term stock fluctuations by using processing fluency", Proceedings of the National Academy of Sciences, vol. 103, no. 24, June 2006.
Hermann Ebbinghaus, Über das Gedächtnis, Leipzig, 1885.
Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001(h), United States, 2000.
Mastercard, announcement of Agent Pay, 29 April 2025, and of agent-initiated transaction scoring, September 2026; Visa, announcement of Intelligent Commerce, 30 April 2025, and of Intelligent Commerce Connect, April 2026.
Chainalysis, count of x402 payments on the Base network to the third quarter of 2026, as reported 14 October 2026; x402 protocol launched by Coinbase, May 2025; x402 Foundation, Linux Foundation, 14 July 2026.
Amazon.com Services LLC v. Perplexity AI, Inc., N.D. Cal., complaint November 2025, preliminary injunction 9 March 2026; Ninth Circuit, order vacating the injunction, 4 August 2026.
Galileo Galilei, Il Saggiatore, 6, 1623 · /commonplace/galileo

Version: 1
Date: 2026-10-15
sha256: ffae8f4c744b5e577064e73c3a7738bc006971229dbab4112560e488a5deba35
Text: /essays/mechanism-before-discretion.txt