Graduated Reliance and Bounded-Exposure Trial¶
Test or assessment — instantiates Evidence-Bounded Trust Governance
Grants the smallest recoverable slice of reliance first and enlarges the tier only after representative performance under conditions that matter.
The Graduated Reliance and Bounded-Exposure Trial is a prospective, live experiment in reliance. Rather than deciding how much to trust from evidence already in hand, it manufactures the missing evidence by granting a deliberately small, recoverable slice of reliance and watching what happens — then enlarging the tier one step at a time, and only after performance under conditions that resemble the eventual high-stakes use. Its two joined ideas are bounded exposure (every step is sized so the worst plausible loss is recoverable, with a fallback held in reserve) and the tiered envelope (reliance moves through named states — observe, then limited reliance, then expanded — each with its own entry evidence, maximum exposure, checkpoint, and expiry). The trial's discipline is that a courtesy-sized success never auto-promotes to high-stakes authority: the trial that unlocks the next tier must exercise that tier's actual conditions, or the promotion is unearned.
Example¶
An open-source project has a promising new contributor. The maintainers could hand over the keys — but instead they run a graduated trial. Tier 0 (observe): she opens pull requests that a maintainer reviews and merges; her exposure to the project is zero and the project's exposure to her is a few minutes of review. Over a month her diffs are clean, well-tested, and she takes feedback gracefully. Tier 1 (limited reliance): she gets merge rights on documentation and non-critical modules — a bounded slice, because a bad merge there is trivially revertible from git history (the fallback). She uses it for six weeks without incident, and once triages a regression correctly under time pressure.
Only then does the tier expand. Tier 2 (expanded reliance): she joins the release rotation and gets signing authority — but the trial that justified it was the representative one, the time she handled a real regression, not the volume of typo fixes. The envelope still bounds her: no force-pushes to main, a co-signer on releases for the first two cycles, and the whole tier expires for review in ninety days. Exposure grew only as fast as evidence of performance at each level accumulated, and at no point was the project exposed to a loss it could not roll back.
How it works¶
- Set the tier ladder. Define the reliance states (observe → limited → expanded → full) and, for each, its entry evidence, allowed actions, maximum exposure, checkpoint cadence, and expiry.
- Size each step to recoverability. The exposure at every tier is capped so the worst plausible outcome is reversible, and a concrete fallback (a revert path, a second signer, a backup supplier) is held ready before the step is granted.
- Make the trial representative. The performance that unlocks tier n+1 must exercise tier n+1's real conditions — stress, ambiguity, time pressure — not a low-stakes proxy for them.
- Promote, hold, or contract on the evidence. Advance only on relevant success; hold when evidence is thin; contract or revert the step on failure, before loss propagates.
Tuning parameters¶
- Step size — how much new reliance each promotion grants. Small steps buy more evidence per unit of exposure but slow the ramp; large steps reach useful reliance faster at greater risk.
- Representativeness bar — how closely the unlocking trial must match the next tier's real conditions. A high bar prevents courtesy-task inflation; too high and no ordinary work ever qualifies.
- Recoverability floor — the maximum non-reversible loss permitted at any step. Lowering it protects the trustor but rules out reliance whose value is inherently irreversible.
- Checkpoint cadence and expiry — how often a tier is re-examined and when it lapses. Frequent, short-lived tiers catch drift early but impose review overhead.
- Fallback readiness — whether an alternative must be live before a step, or merely nameable. Insisting on a live fallback costs duplication but keeps exit real.
When it helps, and when it misleads¶
Its strength is that it produces the most credible evidence there is — direct representative performance — while capping downside, and it embodies the principle of least privilege: grant only the reliance the current evidence supports, and no more.[n1] It converts an untestable "are they trustworthy?" into a sequence of small answerable bets, and it keeps exit cheap because every tier was sized to be recoverable.
Its failure mode is that a trial only tests the conditions it actually recreates, so a smooth ramp through easy tiers can breed false confidence about a hard tier that was never genuinely rehearsed — and promotions can quietly become automatic, with each success treated as license for the next regardless of representativeness. The classic misuse is the courtesy-task ratchet: a trustee nails a string of trivial tasks and is waved up to high-stakes authority the trials never exercised. The guarding discipline is to tie each promotion to a trial that bites — real stress, real ambiguity — to keep a live fallback at every tier, and to let a tier expire rather than roll forward by inertia.
How it implements the components¶
trustor_exposure_recoverability_power_and_alternative_profile— every tier is sized against the worst recoverable loss, with a fallback and preserved alternative held ready, so exposure never outruns what can be undone.domain_specific_trust_tier_and_reliance_envelope— the ladder of named reliance states, each with entry evidence, allowed actions, maximum exposure, checkpoint, and expiry, is the envelope in operation.
It does not decompose and grade the trustee's dimensions on paper before acting (trustee_ability_reliability_honesty_care_and_constraint_profile and trust_purpose_relationship_domain_and_stakes_frame — the Domain-Specific Trust Evidence and Exposure Matrix), nor independently verify outside claims (proportional_evidence_signal_verification_and_privacy_plan — the verification sibling). Its nearest twin is the retrospective audit: the trial expands tiers prospectively through live recoverable steps, whereas the Trust-Calibration and Dependency Audit reviews existing tiers after the fact and does not itself grant reliance (trust_calibration_outcome_dependency_and_drift_review).
Related¶
- Instantiates: Evidence-Bounded Trust Governance — the trial is how reliance actually expands and contracts inside the envelope.
- Consumes: Domain-Specific Trust Evidence and Exposure Matrix — its blank high-stakes cells set which tier the trial should try to unlock next.
- Sibling mechanisms: Domain-Specific Trust Evidence and Exposure Matrix · Independent Reference, Claim, and Conflict Verification · Commitment, Disclosure, Exception, and Outcome Log · Trust-Breach Triage, Containment, and Repair Protocol · Trust-Calibration and Dependency Audit
Editorial Notes¶
Form Classification¶
Form family: Experiment, Test & Rehearsal
Rationale: Graduated Reliance and Bounded-Exposure Trial operates as a bounded trial, probe, simulation, or rehearsal that generates evidence from performance because it grants the smallest recoverable slice of reliance first and enlarges the tier only after representative performance under conditions that matter.
Independent corroboration: The frozen evidence defines Graduated Reliance and Bounded-Exposure Trial as 'Grants the smallest recoverable slice of reliance first and enlarges the tier only after representative performance under conditions that matter', so its operative form is Experiment, Test & Rehearsal.
Nearest alternative: Decision, Gate & Allocation — Representative bounded reliance is deliberately trialed to generate promotion evidence; each tier decision controls exposure.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Security assurance grants limited trust and increases privileges only after evidence under bounded exposure.
Related originating lineages:
- Computer Science & Software Engineering — Least-privilege and staged deployment practices materially supply access tiers and recoverability.
- Engineering & Design — Qualification testing contributes evidence-gated expansion under representative conditions.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Independent reviewer agreement; medium confidence.
Notes¶
[n1] The principle of least privilege, a foundational rule in security engineering, holds that any actor should be granted only the minimum access needed for its current task, and no more. A graduated trial is that principle turned into a schedule: privilege is enlarged only as evidence of safe use at the prior level accumulates. ↩