Viable for the proposal
Every persistence condition material to this exact proposal can be represented safely enough for the defined system to evaluate.
You've been there.
A government form with a dropdown. A research database with required fields. A system that needs to put you somewhere.
The dropdown gives you choices. None of them are right.
The artifact problem
The system supplies what the output attributes to you
The form asks for tribal affiliation. It offers Mandan, Hidatsa, Arikara, Other. I select Hidatsa because the field permits only one choice, though we are the Three Affiliated Tribes of the Mandan, Hidatsa, and Arikara Nation: a name that carries political confederation, shared governance, pressure, and endurance.
The output is not simply incomplete. A true constituent affiliation has been forced to impersonate the whole the field claims to record. The system's structure supplied that apparent coherence, then attributed it to the source.
SRA calls this the artifact problem. A partial representation becomes artifact-producing when it circulates as adequate to the thing it names while the remainder it cannot carry is treated as absent rather than still governing. Artifact is not an intrinsic property of a file. It names a failed relation among source, transformation, output, and use.
ARTIFACT DIAGNOSTIC - FEDERAL TRIBAL-AFFILIATION FORM
What the person tried to enter
Three Affiliated Tribes of the Mandan, Hidatsa, and Arikara Nation
What the system produced
Hidatsa
- Ontological truncationThe system cannot carry confederation and shared governance as constitutive relations, so it substitutes a fragmentary proxy.
- Authorization lossThe relational conditions under which political identity can be spoken and circulated do not travel with the output.
- Context collapsePolitical history and governance become optional description while the fragment remains machine-actionable.
- Governance attenuationA sovereign political relationship is thinned into a category receiving systems treat as ordinary demographic data.
- Predictable downstream misfiresThe fragment repeatedly supports internally valid but externally wrong classification and allocation decisions.
ARTIFACT PRODUCED. The form does not know it is lying. It cannot know. The lie is architectural.
The deeper problem
What happens to a thing when you move it into a system?
Most data systems begin with records, subjects, and objects already assumed to exist. They ask who may access the thing. SRA asks a prior question: can this proposed digital relation maintain the conditions under which the pattern remains what it claims to be?
Some patterns survive a particular transformation. Others persist convincingly as something else. A detuned string still produces a standing wave, but an A is not a C. The failure to watch is not only collapse. It is a pattern that remains coherent enough for the system to mistake transformation for fidelity.
SRA calls the conditions under which a named pattern can undergo a particular encounter without becoming something else its persistence conditions. They are community-defined, context-specific, contestable, and governed. Their absence can signal incommensurability in the encounter, not hidden depth waiting for better extraction.
The first protocol
DVA governs a proposal, not a class of things
Digitization Viability Assessment is not arithmetic, and digitizability is not an intrinsic property. The unit of assessment is a proposal: this pattern, rendered in this form, for these purposes and recipients, within this technical and institutional environment, for this period, with these operations, retention rules, and anticipated derivatives.
The governing process evaluates capture, description, indexing, storage, access, derivation, transport, retention, and deletion separately. A proposal may support storage but not indexing, or teaching access but not model training. Weighted conditions may organize discussion. They cannot aggregate governance into a threshold.
Hybrid governance required
The proposal may proceed, but necessary judgments remain inside community governance because encoding them would itself produce harm.
Non-viable for the proposal
No digital object is authorized under this proposal. That determination is not an access denial and creates no shared refusal event.
What SRA does
Carry a bounded determination without pretending it is the whole
Warrant
A signed, versioned transmission of a bounded governance determination. It carries operations, conditions, temporal and institutional boundaries, and booleans indicating that unencoded conditions remain. It carries no protected standing or disagreement topology.
Capability
A short-lived, scoped grant for one action. Resource, action, audience, purpose, workflow, and time must match exactly. A stolen grant can still cause harm; narrow scope limits rather than abolishes that harm.
Gate
The gate verifies the warrant signature and trusted issuer, rejects stale or malformed state, checks contests and exact scope, tests receiver compatibility and obligations, then mints and consumes the capability before revealing a synthetic payload.
Refusal visibility
A public refusal is a deliberate political statement. A restricted note belongs in a separate community-controlled ledger. NDE means non-recording at the shared boundary: no resource-specific entry, identifier, reason, or below-threshold count.
Constraint-preserving transport
A receiver may not weaken or tighten community-defined conditions without authorization. Tightening can defeat affirmative duties such as teaching, return, circulation, or descendant access. More restrictive is not always more faithful.
More-than-human persistence conditions
The framework begins there
A dam is not a false record of a river. It is a material intervention capable of destroying a riverine pattern's persistence conditions. Artifact production occurs in the classificatory and administrative infrastructures that render river as water inventory, bottomland as compensable acreage, and relation as title, then circulate those outputs as adequate accounts of what is there.
The Missouri River was a relative before it was a resource. When the Army Corps enclosed the embankment in April 1953 and dedicated it that June, water remained and a reservoir emerged. But at that reach, the riverine pattern the People, cottonwoods, fish, gardens, and ceremonies had known did not persist through enclosure. Lake Sakakawea is materially real. It is not an administratively equivalent version of the river the Corps transformed.
Among the plants Maaxiiriwia carried was Macúahca, sweetgrass: medicine, ceremonial relative, a presence that marked which places were still in right relation with those who gathered her. She is braided. She is offered. She is kin.
I write these pages next to a small braid my wife and children made from a pot of Macúahca we keep on the deck in Carlisle. Our neighbors mow. We protect her. We comb her hair, trim her ends. We sing near her and eat near her and talk to her and let her hear us living.
The beaver case requires the same discipline. A human steward does not thereby speak for beaver or stream. The more-than-human pattern does not sign a warrant, and sustained attention is not self-authorizing. A warrant in this setting is a bounded human undertaking about human action: this community will not authorize conduct inconsistent with what has been witnessed. The document can encode observations, provenance, limits, and precaution. It cannot encode the stream's consent or exhaust its authority.
What building it taught
A partial relay has to admit that it is partial
The interactive reference model makes DVA questions, warrant contents, gate evaluation, transport constraints, refusal visibility, and capability scope inspectable. It is not a production security system for SRA.
- DVA cannot be delegated to arithmetic. A worksheet may organize considerations. Only a recognized governance process enters the determination.
- NDE cannot be written and hidden later. Suppression at display time is still a record that can leak, be breached, or be compelled.
- Object types must remain separate. A DVA determination, gate decision, contested designation, public refusal statement, and restricted note do not belong in one filtered table.
- A signature is narrower than legitimacy. Real cryptographic verification proves that a key signed canonical bytes. It does not authenticate the governance process, prove claims true, or provide community-controlled custody.
The browser can demonstrate mechanism and decision shape.
Real key custody, sender-constrained transport, separated production stores, receiver federation, deletion enforcement, key-rotation runbooks, and adversarial NDE timing-equivalence testing require real infrastructure and remain out of scope.
Why this matters now
AI is making the artifact problem travel faster
Every training dataset built from Indigenous-authored content without consent can carry the wrong assumption deeper into infrastructure: that the record is the thing, that silence is absence, that a credential contains authority, that extraction has become legitimate because the output is coherent.
SRA is not only for Indigenous data. The architecture is general, but the general theory is earned from particular ground: from MHA Nation, from the Missouri River, from Maaxiiriwia and Macúahca, from what happens when a system cannot see what its categories authorize.
Relation comes before data. The work of architecture is not to create that sovereignty or carry the whole relation. It is to stop substituting for it. It can refuse to make more ghosts.