Distinguish permission to object from authority to change a decision.
About 45 minutes, including the exercise.
Learning objectives
Distinguish permission to object from authority to change a decision.
Map who controls each consequential part of an automated workflow.
Companion reading in Better Answers, Worse Decisions: Chapters 8 and 12. The book is for separate purchase. This course does not provide the manuscript or chapter downloads.
The lesson
A warning needs standing
An organisation can permit dissent and still make dissent ineffective. An objection may arrive after the decision, be judged by the team whose work it challenges, or require evidence that the objector cannot access. Examine the sequence: when can a concern be raised, what happens while it is investigated, and what would make the decision change? A listening process is not automatically a correction process.
Separate technical disagreement from a dispute about purposes. Two analysts may agree on a predicted outcome while disagreeing about whether that outcome is acceptable. Do not ask a model-performance test to resolve an ethical or institutional choice. Record who is entitled to decide each question and what obligations constrain that choice.
Map control, not just titles
A formal manager may not control the default, data pipeline, threshold or appeal interface. Vendors, procurement teams, operational staff and regulators may each control a different part. Map the ability to command, induce, set defaults and veto. These are analytical distinctions, not a claim that every influential actor has the same legal duty.
For each control point, ask what the actor can actually change, what information they possess and who can require them to respond. A contract can assign a responsibility that is impossible to discharge without access. Conversely, a technically powerful actor may not be authorised to alter a consequential decision. The design must connect capability and legitimate authority without pretending they are identical.
Make accountability operational
Identify an owner for investigation, a decision-maker for suspension, a route for reversal and a bearer of the remedy. These roles can be separate, but the handoffs must be explicit. A case number is not a remedy. A changed model does not repair a decision already taken against someone.
Test the process with an objection that the production team initially rejects. Who can obtain an independent view? Who pays for the delay? Is there an escalation outside the original chain? A stronger answer also considers the cost of frivolous or repeated challenges. A correction system should be accessible and proportionate, not paralysed by an unlimited veto.
Invented for this course
An appeal with no power
A fictional scholarship platform allows applicants to appeal. The appeal team can correct spelling errors but cannot inspect the ranking inputs or reverse an award decision. The website calls this human review.
State the gap precisely: the appeal exists, but its remit does not reach the consequential decision.
Separate data correction from review of the ranking and from authority to alter an award.
Assign a route for material disputes, including access to relevant evidence, a decision deadline and a means of remedying an erroneous result.
What follows: The existence of a person or an appeal form does not establish answerability. Its effective scope matters.
Attempt before opening feedback
Create a control-and-duty map
For a fictional automated decision, identify five control points. For each, name who can change it, who is authorised to do so, who can challenge it and what happens after a successful challenge.
Review criteria
Technical control and authorised responsibility are not conflated.
At least one path reaches a reversal or remedy, not just a review meeting.
The design considers delay, misuse and the burden on the person affected.
Worked feedback
A good map may place data correction with an operations team, threshold changes with an authorised policy owner and contested individual decisions with a separate reviewer. It should expose any handoff where everyone can acknowledge a problem but no one can change the outcome.
Optional extension · about 12 minutes, additional to core course time
Can the stop take effect before release?
This optional, no-cost tabletop exercise uses a fictional warehouse and invented times. An AI-assisted dispatch list is scheduled for release at 15:05. A suspected material error is reported at 15:00. A hold must be applied and its effect verified strictly before 15:05; a message requesting a hold does not stop release. All times use the same clock.
The lead and deputy have documented authority and working access to place a hold. The operator can inspect and report but cannot authorise or apply one. The table gives the earliest time each person can start after receiving the report and the complete time needed to apply and verify a hold, where permitted. Assume immediate report delivery, no competing work and the stated durations for this exercise only.
Invented response routes for the same 15:05 release
Role
May apply hold?
Earliest start
Apply and verify
Lead
Yes
15:08
1 minute
Operator
No
15:00
Not permitted
Deputy
Yes
15:01
2 minutes
Attempt first
For every permitted route, calculate the earliest verified-hold time and the time remaining before release. Which route meets the stated deadline? Explain why the operator’s availability does not solve the authority problem.
Write a short handoff record naming the suspected error, affected dispatch version, authorised recipient, deadline and evidence needed to confirm that release is actually held. Distinguish receipt of the report from completion of the hold.
Repeat the exercise with the deputy unavailable. What failure does this expose? Propose a bounded process change for approval and testing; do not assume that anyone acquires authority merely because the deadline is close.
Worked timing and authority check
The lead could complete verification at 15:09, four minutes after release. The deputy could complete it at 15:03, leaving two minutes before release. Only the deputy meets the stated deadline under these assumptions. The operator cannot apply a hold, however quickly the operator reads the report.
A useful handoff record identifies the dispatch version, the suspected discrepancy, when it was detected, the deputy as the authorised recipient and the requirement for a verified hold before 15:05. A receipt at 15:01 confirms communication, not that release is blocked. The completion evidence should identify the held version, effective time and observed release status.
With the deputy unavailable, neither remaining route can deliver a timely authorised hold. Record that gap rather than marking the escalation complete. Possible changes include an explicitly approved alternate duty holder or an approved release rule that requires a current clearance. Either change needs defined scope, access, response times, testing and an owner; this exercise grants no new authority.
A hold only prevents the specified release. It does not establish that the suspected error is real, repair the dispatch list or remedy any earlier shipment. Name who will investigate, who can approve a corrected version and what evidence permits resumption. Consider the cost of delay and a proportionate fallback rather than assuming an indefinite stop is harmless.
The schedule is a teaching assumption, not a measured response guarantee. A real test should include delayed messages, absent personnel, failed access and the possibility that the hold does not take effect. Retain the attempted and observed times, including failures, rather than recording only that a policy exists.
Sources and scope
NIST AI RMF 1.0 (2023), GOVERN 2.1, addresses clear roles, responsibilities and communication lines; GOVERN 3.2 addresses differentiated human-AI oversight roles. This original exercise turns those governance questions into a bounded timing test. NIST did not supply the warehouse, times or hold rule. The cited page notes that the framework is being revised; no revised requirements are claimed.
This is an open self-check, not a secure examination or certificate. Answers and explanations are available below. Nothing you enter is sent to a server.
Keep your working notes
These notes remain only in this tab. They are not submitted or saved automatically. Download a copy before leaving. Use fictional or public information, not confidential personal or client details.