Skip to content

Privileged Access Log

Transparency register — instantiates Capture-Resistant Institutional Design

Keeps a standing, disclosable record of every meeting, contact, and informal channel between the institution and the actors it governs, so privileged access can be seen and counted rather than accumulating in the dark.

Capture rarely arrives as a single event; it accretes through a hundred quiet contacts nobody wrote down. Privileged Access Log is the standing artifact that refuses that darkness: it records who from the regulated class met or contacted the institution, when, about what, and who else was in the room, and it publishes that record on a fixed cadence. Its defining trait is that it is passive and continuous — not a rule that forbids contact and not a diagnostic that judges it, but a ledger that simply makes access visible and countable. Kept over time, the same ledger becomes a running tally of which outside actors have accumulated how much access, which is exactly the pattern that would otherwise stay invisible until it was already the culture.

Example

A national medicines agency interacts constantly with the drug companies whose products it approves — and most of that contact is legitimate. The Privileged Access Log is where it stops being invisible. Every meeting request, advisory contact, and informal call with an industry party is entered: date, company, attendees, topic, and whether the agency also met anyone on the other side of the question. Each quarter the register is published.

Read as a single entry, nothing looks amiss. Read as a year of entries, a pattern emerges: one manufacturer accounts for four times the contact hours of any patient group, clustered in the weeks before a class review. The log doesn't decide whether that is a problem — it just makes the asymmetry a number someone now has to explain. That count is what turns "they seem awfully cozy" into a fact the rest of the design can act on.

How it works

What distinguishes the log from its siblings is that it aggregates, not adjudicates:

  • Complete capture, not judgment. Every qualifying contact is recorded on the same template regardless of how innocent it looks; the log takes no view, which is what keeps it usable as evidence.
  • Attribution by actor over time. Because entries are tagged to the outside party, the register silently compiles a per-actor access inventory — the standing count of who has how much of the institution's ear.
  • Symmetry made visible. A good log shows not just that industry was met but whether countervailing voices were met too, so lopsidedness reads off the page.
  • Disclosure on a cadence. The record is published, which is what converts a private diary into an accountability instrument.

Tuning parameters

  • Coverage threshold — what counts as a loggable contact: formal meetings only, or calls, texts, and conference encounters too. Wider coverage is more complete but heavier to maintain and more intrusive.
  • Disclosure latency — real-time publication versus a quarterly release. Faster disclosure deters more but burdens staff and can chill routine fact-finding.
  • Granularity — bare meeting counts, or attendees plus topics plus positions taken. Finer detail reveals content but raises confidentiality and candor concerns.
  • Symmetry requirement — whether the log must also show countervailing contacts, turning it from a list into a balance sheet of access.
  • Retention and queryability — how long entries persist and how searchable they are; this is what enables the longitudinal influence tally rather than a snapshot.

When it helps, and when it misleads

Its strength is that it makes the accumulation of access a countable quantity and deters the quiet build-up simply by threatening to show it — and it supplies the raw material every downstream check depends on. It is cheap, legible, and hard to argue with once the pattern is on the page.

Its central failure mode is mistaking logging for limiting. A meticulous record of lopsided access that no one ever acts on documents capture without slowing it — transparency as theater. Worse, a log can push influence into the channels it doesn't cover (the unminuted dinner, the deniable text), so completeness is always partly gamed, and a flood of trivial entries can bury the few that matter. The discipline that keeps it honest is to treat the log as an input — paired with a rule that forces off-record contact back onto it and an audit that actually acts on the asymmetries it reveals — and to measure balance, not just volume.[1]

How it implements the components

Privileged Access Log fills the transparency-and-inventory slice of the archetype — the parts a standing register can produce:

  • access_and_exception_transparency_record — the log is this record: the durable, disclosable account of contacts, access granted, and exceptions made.
  • regulated_actor_influence_inventory — aggregated by actor over time, the same entries become the running inventory of who holds how much access.

It does not map the full set of capture channels or score them against a threshold — that is Capture Risk Audit — and it does not create the disclosure obligation that forces private contact onto the record, which is the Ex Parte Contact Disclosure Rule.

Notes

The log constrains nothing by itself — it is deliberately a record, not a control. Its value is entirely contingent on something upstream feeding it honestly (the ex parte rule) and something downstream acting on what it shows (the capture-risk audit). A team that stands up the register and stops there has bought visibility, not resistance.

References

[1] Brandeis's aphorism that "sunlight is said to be the best of disinfectants" is the honest case for a log like this — and its limit. Disclosure exposes; it does not, on its own, constrain. The log documents access precisely so that a mechanism with teeth can act on it. ↩