Skip to content
Software Behaviorby Joost van der Zwan
Index

Framework · Layered stack · from Chapter 7

The Trust Stack

Names the structural materials of trust in intelligent systems, from expressive at the top to foundational at the bottom.
Read the chapter

The framework

Fig. · The Trust Stack
  1. Legibility: The system makes its actions, reasoning, state, and assumptions visible enough to be understood, questioned, and corrected by the people it acts on behalf of.
  2. Reversibility: Reversible actions can be undone cheaply. Irreversible external actions require an explicit compensating path and named owner.
  3. Controllability: The user can constrain what the system is allowed to do, both in advance through configuration and in the moment through override.
  4. Recoverability: When something breaks, there is a clear path back to a known good state without losing the context the user needs to continue.
  5. Consistency: The same input, in the same context, produces the same behavior — or the difference is named, not hidden.
  6. Restraint: The system declines to act when evidence, measured reliability, authorization, consequence, or recovery does not support action.

Builds from the bottom up

Trust reads from the floor up: restraint carries every layer above it.

  1. 01

    Legibility

    The system makes its actions, reasoning, state, and assumptions visible enough to be understood, questioned, and corrected by the people it acts on behalf of.

  2. 02

    Reversibility

    Reversible actions can be undone cheaply. Irreversible external actions require an explicit compensating path and named owner.

  3. 03

    Controllability

    The user can constrain what the system is allowed to do, both in advance through configuration and in the moment through override.

  4. 04

    Recoverability

    When something breaks, there is a clear path back to a known good state without losing the context the user needs to continue.

  5. 05

    Consistency

    The same input, in the same context, produces the same behavior — or the difference is named, not hidden.

  6. 06

    Restraint

    The system declines to act when evidence, measured reliability, authorization, consequence, or recovery does not support action.

4 · Do

How to use it · Trust audit

Audit a product against each layer. The output is a trust audit that names the weakest layer, the user-visible risk, and the product artifact required to repair it.

5 · Save

The Product Architect · The Trust Stack

Framework · Layered stack