1. The schema as policy

Consider a deceptively boring field: the risk_level enum in a municipal AI procurement form. It admits three values — minimal, limited, high — and one of them is preselected. The default, of course, is limited. Most procurement officers report never having changed it.

The default is not a setting. It is a policy decision deferred until the moment of friction makes it permanent.

We can read this two ways. The charitable reading: defaults are guardrails, useful in volume. The less charitable: defaults are the residue of an argument someone had at a working group, transcribed into permanent shape and shipped to thirty thousand offices.

2. EXIF, or, the camera that wrote the law

EXIF — the metadata appended to every photograph your camera takes — was, for most of its life, a curiosity. Until the day a court admitted it as evidence and the day after that, when an evidentiary standard quietly attached itself to a 1995 specification authored by a Japanese trade group. The trade group was not consulted.

This is the quiet politics of file formats: they accrete authority by being adjacent to other things that already have it. A camera ships with a schema; the schema attends a trial; the trial cites the schema; the schema returns to the camera, now slightly more sovereign than it was the day before.

3. A small example

{
  "system_type": "decision_support",
  "risk_level": "limited",     // <- the default
  "human_in_the_loop": true,   // <- always true; nobody checks
  "data_sources": ["internal"],
  "model_card_uri": null
}

Each of these fields is a hinge. human_in_the_loop is the most consequential of them, and the least audited: in a 2024 study of 412 procurement filings across six U.S. cities, the boolean was set to true in every single one.

A version of this essay appears in the Spring 2026 issue of an academic journal whose title I will add when the embargo lifts.

What audit reports actually do

In the absence of that machinery, an audit report does three things. It records. It performs. It defers. It very rarely binds.

Compliance is a performance, and the report is its script.

This is not new. The accounting scandals of the early 2000s ran on the same substrate: an industry full of careful professionals, producing competent reports, with no consequences attached to the reports themselves. The remedy, eventually, was Sarbanes‑Oxley — not a better template for audits, but a redistribution of legal exposure.

The shape of an alternative

I have written elsewhere about procurement as a more promising site for binding accountability. The short version: contracts have teeth that reports do not. A clause is enforceable; a finding is not.

More to come.