Chapter 53 — When Reasonable People Disagree

Test Two — When Reasonable People Disagree ↑

Chapter 52 began with what should have been the easy case.

There was an error. The evidence was good enough to establish the error. We could therefore concentrate on what happened after the error was discovered: whether the correction travelled, whether its consequences were repaired, whether uncertainty was preserved honestly, and whether the correction remained effective over time.

Even that became considerably more complicated than I expected.

Now I want to remove one of the protections that made the first test possible.

What happens when the evidence no longer gives us one uncontested answer?

This is not yet the test of institutional power. I am not assuming bad faith. I am not assuming that somebody is lying. I am not assuming that an institution has a reason to protect itself.

I want the disagreement itself to be the difficulty.

Two people may have experienced the same event differently. A professional may have formed an opinion that another person reasonably disputes. A record may preserve what somebody believed without establishing that the underlying belief was true.

If our developing model works only when the evidence gives us an obvious answer, it is not yet much of a model.

So we increase the complexity and see how the model behaves.

The First disagreement ↑

Begin with a simple institutional record:

The person declined the service.

The person challenges it.

“I did not decline the service. I said that I could not attend the appointment offered and asked whether another time was available.”

Suppose the staff record made at the time says:

“Declined appointment.”

And suppose the person's contemporaneous email says:

“I can't attend Tuesday. Is there another time available?”

At first this looks like the disagreement we need.

But it is not.

The two original pieces of information can both be true. The person may have declined that particular appointment while continuing to seek the service.

The problem appears to have occurred later:

“Declined appointment” has become “declined service.”

That takes us back toward Classification drift. The original observation has acquired a broader meaning as it moved through the system.

We have not yet produced genuine disagreement.

Make the test harder

Change the hypothetical.

A service is offered during a telephone conversation. Immediately afterwards the staff member records:

“Service explained. Patient declined further assistance.”

The person remembers the same conversation differently:

“I said I needed time to think about it and wanted to discuss it with my family before deciding. I did not decline the service.”

There is no recording. There is no independent witness. Both accounts were produced reasonably close to the event.

For this experiment we will not assume dishonesty, incompetence or bad faith by either person.

Now we have the problem we were looking for.

Run the Chapter 52 model

Can the person see the information? Yes.

Can the person challenge it? Yes.

Can the challenge be acknowledged and preserved? Yes.

Can both accounts be examined? Yes.

Then we reach the step that was comparatively straightforward in the easy case:

Correction.

What exactly should be corrected?

If the institution changes the record to:

“The person did not decline the service.”

it may be asserting more than the evidence establishes.

If it leaves:

“The person declined the service.”

as the authoritative account, it may also be asserting more than the evidence establishes.

And if it simply adds:

“The person disputes this.”

we still need to ask whether the record adequately communicates the nature and evidentiary status of the disagreement.

Perhaps the most accurate record we can presently make is something like this:

“The staff member recorded that the person declined further assistance. The person states that they asked for time to consider the service and did not decline it. The available evidence does not establish which account is correct.”

That does something different from choosing a winner.

It makes the certainty of the record no greater than the certainty of the evidence.

But institutions still have to make decisions ↑

Preserving both accounts does not solve everything.

Suppose another decision actually depends upon whether the person declined the service. An eligibility decision, a clinical assessment, a complaint determination or some other administrative process may require somebody to act.

The institution cannot always respond:

“We are uncertain, so we will make no decision.”

A decision-maker may examine the available evidence and conclude that one account deserves greater weight.

That is not necessarily a failure of corrigibility.

The new difficulty is what happens to the status of that decision afterwards.

Suppose the decision-maker writes:

“On balance, I give greater weight to the contemporaneous staff note.”

That statement preserves something important. It tells the next reader that there was a disagreement and that a decision was made by weighing evidence.

But suppose the next system records only:

“Person declined service.”

Something has changed.

disputed evidence ? assessment of evidence ? decision under uncertainty ? apparent fact

The final reader may never see the uncertainty from which the statement arose.

Worse, the later record may then be treated as additional evidence.

If the derived decision is counted alongside the original staff note, one disputed event can begin to look like several independent confirmations.

The record starts generating the next record.

This is why Provenance matters. We need to know not merely what a later record says, but where the statement came from and what kind of conclusion it originally was.

A decision made under uncertainty should not acquire greater evidentiary certainty merely because the institution had to make it.

Take the question into the real world ↑

Cowen and Queensland Building and Construction Commission

The first documented case puts pressure on an assumption hidden inside our hypothetical: that a disputed statement is necessarily a disputed fact.

In Cowen and Queensland Building and Construction Commission [2016] QICmr 43, the applicant sought amendment of information associated with a Queensland Building and Construction Commission inspection of his residential property.

The Queensland Office of the Information Commissioner considered whether the information was inaccurate, incomplete or misleading and whether amendment could be refused.

Source: Queensland Office of the Information Commissioner, Cowen and Queensland Building and Construction Commission [2016] QICmr 43, 14 October 2016. View source

The important point for our experiment is not that one side of the underlying dispute was declared universally correct.

It is that a record may have a different character depending upon what it claims to preserve.

There is a substantial difference between:

X happened.

and:

The inspector formed the view that X happened.

The second statement can accurately preserve the existence of an opinion even when another person disputes the proposition contained within that opinion.

That means our first hypothetical was still too simple.

Before asking whether information is correct, we may need to ask:

What exactly is this record claiming to record?

Is it recording an event? An observation? A person's recollection? An interpretation? A professional opinion? A decision made after weighing competing material?

Those are not interchangeable evidentiary states.

A system can preserve an opinion accurately while still needing to preserve the fact that the proposition underlying that opinion remains disputed.

Read the original case: Cowen and Queensland Building and Construction Commission [2016] QICmr 43

An opinion can be accurately recorded and still create a problem ↑

AG4 and Melbourne Health

A Victorian case makes the problem more difficult again.

In 'AG4' and Melbourne Health (Freedom of Information) [2019] VICmr 58, the applicant sought amendment of material in a medical record, including an alert. Melbourne Health had originally refused the requested amendment.

On review, the Victorian Information Commissioner decided to amend the document. The decision considered information in the nature of opinion as well as whether particular wording created a misleading impression.

Source: Office of the Victorian Information Commissioner, 'AG4' and Melbourne Health (Freedom of Information) [2019] VICmr 58, 28 June 2019. View source

This exposes something that our first real case could not settle by itself.

Calling something an opinion does not make every way of recording that opinion harmless.

An opinion may be genuinely held and nevertheless be incomplete, outdated or misleading in the form in which it is later presented.

The record can also mix several layers together:

event ? observation ? interpretation ? opinion ? recorded characterisation

A later reader may encounter only the final characterisation.

If the earlier stages disappear, the reader may be unable to tell which part was observed and which part was inferred.

That is not merely a dispute over whose account should prevail.

It is a problem of Dissent fidelity and Provenance.

Can the system preserve the evidentiary character of information as that information moves through the institution?

Read the original case: 'AG4' and Melbourne Health (Freedom of Information) [2019] VICmr 58

A correct record of an interpretation is not the same as proof of the event ↑

A4STL6K and Queensland Health

A second Queensland decision gives us another way to test the distinction.

In A4STL6K and Queensland Health (311438), decided on 6 September 2013, the applicant sought amendment of part of a Queensland Health letter summarising an investigation report.

The Office of the Information Commissioner concluded that the relevant part of the letter was generally consistent with the investigation report and that there was no objective evidence showing that it failed to reflect accurately the author's interpretation of that report. The refusal to amend was affirmed.

Source: Queensland Office of the Information Commissioner, A4STL6K and Queensland Health (311438), 6 September 2013. View source

Again, the distinction matters.

A record may accurately communicate:

This was the author's interpretation of the material.

That does not automatically transform the interpretation into:

This is an independently established account of what happened.

The historical record of the interpretation can be accurate. The underlying proposition can still have a different evidentiary status.

If a later system forgets that distinction, the meaning of the information changes without anybody necessarily changing the words.

The information can remain textually unchanged while its institutional meaning drifts.

That is another form of Classification drift.

Read the original case: A4STL6K and Queensland Health (311438)

The distinction is visible in current correction guidance ↑

An opinion can be accurately recorded and still create a problem — AG4 and Melbourne Health

The Australian Information Commissioner's current guidance on amendment and annotation of personal records makes a similar distinction between factual information and opinion.

The guidance explains that disagreement with a third party's opinion does not, by itself, make the opinion incorrect. Among the matters relevant to assessing the record are whether it is presented as opinion rather than objective fact, whether it accurately records the third party's view, and whether the assessment was informed by competing facts and views.

The same guidance separately requires attention to whether information is incomplete, out of date or misleading.

Source: Office of the Australian Information Commissioner, FOI Guidelines — Part 7: Amendment and annotation of personal records, updated 5 March 2026. View source

That is useful for our experiment because it prevents an easy but misleading rule:

If somebody disputes an opinion, correct the opinion.

That cannot be our model.

But neither can the opposite rule:

If it was genuinely somebody's opinion, leave the record alone.

A genuinely held opinion can still be presented in a way that obscures its character, omits relevant context or misleads a later reader.

The OAIC guidance also recognises annotation as a mechanism for associating a person's statement with information an agency has declined to amend. It encourages agencies to make the existence of such annotation visible to future users of relevant records.

That brings us back to something Chapter 52 already taught us.

Preserving information is not enough. Its present status must remain intelligible to the next reader.

Read the guidance: OAIC — Part 7: Amendment and annotation of personal records

We need more than true and false ↑

Test One already forced us to preserve uncertainty.

Test Two shows why that was not a minor qualification.

An institutional record may need to distinguish between statements such as:

This is established as wrong.

This is supported by the available evidence.

This remains unresolved.

This was the opinion recorded at the time.

This was a decision made after weighing disputed evidence.

Those statements do different work.

Flattening all of them into true or false destroys information.

But simply keeping every statement without showing its status creates another problem: the later reader may treat historical assertions, opinions and decisions as though they all carry the same evidentiary authority.

Preserved uncertainty therefore has to do more than keep a question open.

It has to remain visible enough that later use does not silently manufacture certainty.

Now make the institution act ↑

We can return to our hypothetical.

The staff member says the person declined the service. The person says they asked for time to consider it. The available evidence does not establish exactly what was said.

A later decision-maker nevertheless has to decide whether, for a particular administrative purpose, the service should be treated as having been declined.

Suppose the decision-maker gives greater weight to the staff record.

Our model should permit that possibility.

But the model should also require the system to preserve the difference between:

“I decided to give greater weight to this account.”

and:

“This account has now been established as fact.”

Those are not equivalent.

Now reverse the outcome

To test whether the rule is genuinely symmetrical, give the person greater weight instead.

Suppose the decision-maker accepts the person's account.

The system should not automatically rewrite the history as:

“The staff member falsely recorded that the person declined assistance.”

unless the evidence actually establishes falsification.

A finding that one account should be preferred for a particular decision does not necessarily establish why the other account came to exist.

Our model cannot preserve evidentiary restraint only when it benefits the person challenging an institution. If it is to be useful, the same discipline must apply to every account.

A corrigible system may sometimes have to make a decision without being able to establish exactly what happened.

The decision should not acquire greater evidentiary certainty merely because the institution had to make it.

The disagreement can reproduce itself ↑

Now we can see how an unresolved disagreement can become recursive.

1. A staff member records an interpretation of an event.
2. The person disputes that interpretation.
3. A decision-maker weighs the competing accounts.
4. The decision-maker prefers one account for the purpose of making a decision.
5. A later record stores only the outcome.
6. The outcome is subsequently treated as independent evidence of the original event.

At step six, the system may appear to contain several pieces of confirming information.

But some of those records may simply be descendants of the first disputed account.

The quantity of records has increased. The quantity of independent evidence has not.

Repetition inside a record system does not necessarily create corroboration.

This is where Provenance becomes more than a technical record-keeping concern.

Without provenance, a system may count its own repetitions as evidence that it was right.

And without Dissent fidelity, the person's original challenge may become progressively shorter:

“I did not decline the service” ? “disagrees with record” ? “complaint made” ? “complaint not substantiated.”

The institution's account can become more definite while the dissent becomes less specific.

The system has preserved both sides in a technical sense while preserving them at very different levels of fidelity.

Has our model survived? ↑

Partly.

The sequence developed in Test One still matters:

visibility ? detection ? challenge ? acknowledgement ? preservation ? examination ? correction ? propagation ? remedy ? verification ? learning

But Test Two has shown that correction cannot always mean replacing one statement with another.

Sometimes the evidence establishes an error. Sometimes it establishes that one account is better supported. Sometimes it establishes only that there are competing accounts. Sometimes the historical fact we can establish is that a particular person genuinely held a particular opinion.

And sometimes a decision still has to be made while the underlying event remains uncertain.

The model therefore needs to preserve not only information, but the evidentiary character of information.

Observation is not necessarily interpretation.
Interpretation is not necessarily established fact.
Opinion is not necessarily objective fact.
A decision under uncertainty is not necessarily proof of the event that required the decision.

If those distinctions disappear as information moves through a system, the system can manufacture certainty without acquiring any new evidence.

A provisional result from Test Two ↑

We began with a question:

Can a system remain corrigible when the available evidence supports genuine disagreement?

We do not yet have a complete answer.

But the investigation has produced several conditions worth carrying forward.

For the moment, a system dealing with genuine disagreement appears to need the capacity to:

1. preserve the competing accounts with enough fidelity to understand what each person actually said;
2. preserve the provenance of observations, interpretations, opinions and later decisions;
3. distinguish an accurately recorded opinion from proof that the opinion's underlying proposition is true;
4. distinguish a decision made under uncertainty from an established historical fact;
5. avoid converting the mere repetition of derived records into apparent independent corroboration;
6. make uncertainty visible to later users where that uncertainty remains material;
7. allow decisions to be made where decisions are necessary without silently increasing the certainty of the underlying evidence; and
8. apply the same evidentiary discipline whichever account a decision-maker ultimately prefers.

This is not yet a standard.

It is what the second test has produced so far.

The question has changed

At the beginning I thought the difficult question would be:

Which account should the institution believe?

That now looks too narrow.

A more useful question is:

Can the system act under uncertainty without converting its necessary decision into manufactured certainty?

And beneath that is another question:

Can the system preserve the evidentiary character of information as that information moves through the institution?

That is where the increased complexity has taken us.

The test has not collapsed. But it has had to become more precise.

That is what we wanted.

A model of corrigibility should become more accurate when reality exposes something the model failed to distinguish.

And we are not finished with disagreement yet.

So far I have deliberately kept power out of the experiment. I have assumed that the participants can be heard, that evidence can be examined, and that the institution is capable of preserving uncertainty.

Later tests will remove those protections.

For now, Test Two has given us something more fundamental:

When reasonable people disagree, successful correction may not require the system to declare one account absolutely true. It may require the system to become more accurate about what it actually knows.