The Safeguards Worth Keeping

The lift is closed for repair. A resident looks at the notice, then at the stairs. She cannot use them.

The building manager wants the lift restored quickly. The repair team wants to finish the required checks before returning it to service. Both concerns are real. So is the resident’s immediate problem of getting in and out of her home.

Calling the checks red tape will not tell us which can safely be changed. Calling the resident impatient will not solve her loss of access.

This is where a serious argument about rules has to grow up. Some delays protect us. Some delays harm us. A single delay can do both, which means we need a way to examine its purpose, its design and the support available while it lasts.

Friction can protect the person facing power

Much of this book has examined work imposed on the less powerful person. There is another kind of work worth defending: the work a powerful organization must do before it can impose a serious consequence.

It may have to explain a proposed decision, check evidence, give notice or allow a response. These steps take time. They can prevent a mistake from becoming an immediate fact that the affected person must somehow undo.

The location of the burden matters. Requiring an applicant to submit the same information repeatedly is different from requiring an authority to explain why it intends to reject the application. Both involve paperwork. Their purposes and effects can be very different.

In Goldberg v. Kelly in 1970, the US Supreme Court required a hearing before terminating the New York public-assistance benefits at issue. Recipients needed timely reasons, an opportunity to answer orally and an impartial decision-maker. The hearing did not need to be a full judicial trial. This was a particular historical holding, not a universal rule for every service.¹

We should resist an efficiency measure that counts both kinds of work as equally disposable. A short process can be excellent when it reaches an accurate, fair result. It can be brutal when it moves quickly because the affected person has no chance to speak.

The person with authority often has more ability to create an immediate consequence than the person affected has to reverse it. A procedure can reduce that imbalance by making the decision wait for information that would otherwise arrive too late.

This is one reason a rule’s value cannot be judged only by the time it adds. Ask what error or abuse the time helps prevent, and whether the safeguard reaches that purpose in a proportionate way.

The decision that cannot be easily undone

Imagine a digital service about to erase a user’s records permanently. A second confirmation creates friction. If it clearly describes the consequence and the records involved, that friction can protect the person’s own intention.

Now imagine a service asking for five confirmations before a user turns off promotional messages. The additional steps serve a much weaker protective purpose. The user can usually turn the messages on again if they wish. The inconvenience may mainly preserve an outcome the provider prefers.

The two cases illustrate a useful test: how serious is the consequence, how reversible is it, and how likely is a clear pause to prevent a mistake?

A warning should be tied to the actual decision. A generic message asking whether the user is sure can become meaningless if it appears everywhere. A better warning names what will happen and gives an intelligible choice.

WCAG 2.2 includes safeguards for certain consequential submissions: reversal, checking and correction, or review and confirmation. This shows how accessibility and error prevention can be built together, rather than treating every extra step as an obstacle.²

The principle extends beyond screens. A person signing an important instruction needs a chance to see what is being authorized. Someone acting on another person’s behalf needs an appropriate check of authority. The exact requirements depend on the setting, but the design question is consistent: what would help prevent the wrong action before its consequences become difficult to repair?

More steps are not always safer. A poorly designed check may confuse the user, shift attention from the real risk or make people rely on someone else to complete the task. The safeguard has to be tested for the protection it provides.

Protect the next person too

A rule may frustrate one person because it protects another.

A queue limits how quickly a person can receive service so that others keep their place. A quiet-hours rule can limit a resident’s convenience so that neighbors can rest. A requirement to document a decision can slow a manager while protecting someone who may later need to understand or challenge it.

These examples do not make every queue, closing time or record requirement fair. They remind us to identify everyone affected before treating the removal of a rule as a pure gain.

Imagine a staff member allowing one customer to bypass a waiting list after a forceful complaint. The immediate problem appears solved. Someone else has been moved back without being present to object. The exception may be justified by an urgent need, but the institution should use a defensible principle rather than reward the strongest pressure.

A good exception policy protects people who are absent from the conversation. It asks what distinguishes this case, whether that distinction would apply to someone else and how the decision will be recorded.

This is a demanding form of fairness. It asks us to care about the person in front of us without forgetting the person whose turn has not arrived.

Ask what the safeguard is preventing

A review of a rule should begin with a specific account of the risk.

If a document is required to prevent mistaken identity, does it reliably do that? If a waiting period is meant to allow reflection, does the person receive the information needed to reflect? If a second approval is meant to prevent misuse of funds, does the second approver actually inspect the decision or simply click through a queue?

The name of the safeguard is not evidence that it works.

An organization can accumulate checks after each error without removing checks that have become redundant. Staff may then spend so much time completing the list that they have less attention for the unusual problem the list misses. That is a possible failure to investigate, not a reason to discard checklists as a class.

A useful review would examine actual errors, the contribution of each check and the cost imposed on different people. It would ask whether a simpler safeguard can provide the same or better protection. It would also look for failures prevented, which may be less visible than failures that occurred.

This last point is difficult. A protection can look unnecessary precisely because the bad event has not happened. Removing it on that basis alone would be poor reasoning. The review needs an account of the mechanism and the risk, along with the available evidence.

The goal is a justified safeguard, not a stack of procedures nobody can explain.

Urgency changes the design problem

Some decisions cannot wait for a long process. A building may need an urgent repair. A service may need to contain a security problem. A person may need help before the ordinary appointment cycle can reach them.

Urgency can justify a different route. It should not become a word that erases every duty to explain and review.

A sound emergency process would define who may act, what immediate steps are allowed, what must be recorded and when the decision will be examined afterward. The details belong to the relevant field and law. The general concern is that temporary authority should remain connected to a specific problem.

There may also be room to separate decisions. An institution could provide a limited temporary service while completing a check, where that is safe and authorized. It could take a reversible protective step rather than an irreversible one. It could make a rapid initial decision and provide prompt review by someone with the power to correct it.

These options will not be appropriate everywhere. They are questions worth asking before declaring that the only choices are full delay or no safeguard.

The person carrying the cost of the wait should be part of the design. In the lift example, safety checks may be necessary. The building still has a responsibility to consider how residents will manage while access is interrupted. A necessary delay does not make every consequence of the delay someone else’s problem.

Appeals need a different pair of eyes

A process can be careful and still reach a wrong decision. That is why correction must be more than an invitation to repeat the same request.

If a person asks for review, the reviewer should be able to see the relevant evidence and the reason for the earlier result. They should have enough independence and authority to reconsider it. A response that merely repeats the original message may leave the central question untouched.

The route should explain what can be reviewed. Is the dispute about a fact, the application of a rule or the rule itself? An official may be able to correct a fact but unable to change the law. A manager may be able to revise a policy but not ignore a contractual duty. The person should know which kind of argument the process can hear.

A review can properly uphold the original decision. Fairness does not mean that every complaint succeeds. It means that the reasons and evidence are considered through a process capable of reaching a different result when one is warranted.

Time matters here too. A correction that arrives after the relevant opportunity has passed may offer little practical relief. Institutions should consider whether a decision needs to be paused, whether temporary arrangements are possible and how urgent cases can be identified without making people compete through increasingly dramatic stories.

These are institutional responsibilities. A general book cannot tell a reader which appeal rights or deadlines apply to a particular dispute. For a consequential case, the actual notice, official rules and qualified advice matter.

A safeguard should not be sold back to the user

There is an uncomfortable possibility in service design: an organization creates a slow or confusing route, then offers a paid way around it.

Some faster services are legitimate. Additional staff time costs money, and optional convenience can be a reasonable product. The concern is sharper when the ordinary route fails to provide a basic, fair level of service or when the paid route buys protection against a problem the organization could reasonably prevent for everyone.

A person should not have to pay extra simply to receive a clear explanation of a consequential decision or a reliable way to correct an institutional error. That is my proposed standard of fair dealing. It may demand changes beyond what a particular legal minimum currently requires.

The same concern applies to informal privilege. A well-connected person may know whom to call when a process stalls. That can solve the case while leaving the official route broken. Leaders should treat the successful intervention as evidence that the ordinary route needs examination, rather than proof that the organization is responsive enough.

Good safeguards should be available through the system, not reserved for people who can buy expertise or attract attention. Some disputes will always require specialist help. The basic route should still be understandable and usable by an ordinary person.

What should happen when a protection fails?

When harm occurs despite a safeguard, investigate how it happened and whether the protection needs to change. An effective safeguard can reduce risk without eliminating it. A safeguard may also impose unreasonable costs while providing little protection. Both the outcome and the burden deserve review.

The first response should address the immediate consequence where possible. The next should examine how the protection performed. Was the rule unclear? Was the information wrong? Did staff lack time? Was an important warning buried among routine messages? Did the process depend on a resource the person did not have?

Blaming the final person in the chain may be appropriate in a case of misconduct. It is a weak substitute for investigating the chain itself.

A repair should be checked after it is made. If the organization adds another warning, can users understand it? If it creates a new review step, can the reviewer actually correct the result? If it changes a form, do later systems preserve the corrected information?

The evidence may show that the safeguard needs strengthening, simplification or replacement. The institution should be able to accept any of those findings. Otherwise the review is only a defense of the existing process.

Keep the protection and take responsibility for the wait

The lift returns to service after the necessary checks. During the interruption, the residents received a clear account of the expected work, updates when the timing changed and practical help with the access problem. The process was still inconvenient. The inconvenience was neither denied nor used as an excuse to skip safety.

That is the kind of competence we should expect from institutions: preserve a justified protection while taking responsibility for how it affects people.

A society with fewer arbitrary obstacles and stronger safeguards is possible. We can remove repetition while keeping evidence. We can shorten a delay while preserving a chance to respond. We can make a decision easier to understand without making it easier for the powerful to avoid scrutiny.

The question is where the friction belongs. Put enough of it in the path of serious error and arbitrary power. Stop treating the time of the person seeking a fair decision as the cheapest place to put the rest.

Sources and limits