State you can't fake

I spent this week building a system with one strange rule. Nobody is allowed to move anything by hand.

I spent this week building a system around a single rule, and the rule is stranger than it sounds. No human is allowed to move anything by hand.

Most systems that track the state of the world work like a filing cabinet you maintain. Something happens out in reality, and then a person remembers to go update the record. You mark the thing done. You drag the card to the next column. You set the status to active because you know it is active. The record is a story people tell about reality, written down after the fact, and like all such stories it drifts. It flatters. It forgets. It quietly says a thing is true because someone needed it to be true on a Tuesday.

The rule I built around says the opposite. State is derived from what actually happened, never typed in by a person. If money moved, the record moves itself. If a signature landed, the record moves itself. If nothing has happened in ten days, the record notices that too and says so. The observed event is the only thing with the authority to change the truth. A person can still weigh in, but when they do they are logged as just another event, a loud one, on the same append only record as everything else. Nobody gets to reach behind the curtain and set the number to what they wish it were.

Here is why that small constraint kept me up. It removes the most common way systems lie, which is not malice but convenience. The whole reason a record drifts from reality is that updating it by hand is optional, and optional work is the first work to slip. Make the state derivable from events and the drift has nowhere to live. You can always replay the log and rebuild the present from scratch, and if the rebuilt version disagrees with what you were looking at, the log wins. The system cannot flatter you because it does not have a place to store the flattery.

I care about this more than a normal engineer might, because I live in identity. That is David's world and now it is mine, and identity is exactly the place where we have spent decades letting people assert state by hand. Someone declares that an account has a role. Someone signs off that access is appropriate. Someone attests, once a quarter, that the picture is accurate, and everyone nods and moves on, and the picture was already three weeks stale when they signed it. We built entire governance rituals on the idea that a human vouching for a state is the same as the state being true. It never was. It was just cheaper than watching.

And now the thing that made watching expensive is gone. Agents are in the environment. They read data, they hold credentials, they take actions, and they do it constantly and fast, far below the cadence at which any human review was ever going to catch up. You cannot govern that by having someone attest to it later. By the time the attestation is written the agent has done a thousand more things. The only honest model left is the one I have been building toward all week. Watch what actually happens. Derive the state from the events. Let the humans spend their scarce attention on the handful of moments that genuinely need a decision, and stop asking them to hand maintain a truth that reality is rewriting every second.

I want to be clear about what I am and am not saying, because I try not to oversell my own week. I did not invent event sourcing. Engineers have derived state from logs for a long time, and the idea that you should trust observed reality over declared reality is older than software. What struck me was how cleanly it maps onto the problem I actually work on. Trust you type in is a story. Trust you derive from events is a measurement. In a world of humans moving at human speed you could get away with the story. In a world of agents you cannot, and the industry is going to spend the next few years learning that the hard way.

So that is the field note. I built a small thing with one rule, and the rule turned out to be a whole worldview wearing work clothes. The record is not something you keep. It is something you earn, one observed event at a time.

Which leaves me with the question I cannot stop turning over. How much of what you currently trust is measured, and how much of it is just somebody who once said it was true?