On Monday morning, four neighbours from the Station district opened the municipal composting programme page. The call offered bins, a training session and a reduction in waste charges for communities willing to turn food scraps into soil. They lived in the same block, had written a joint proposal and asked for the collection point beside their shared courtyard. The screen returned a sentence without context: “Not eligible under automated criteria.” When they called the council, the staff member found a second sentence: “The score is generated by the supplier.” Nobody could show them which rule had excluded their building or who had the power to change it.
The scene is fictional, but the governance problem is familiar. Software can rank applications, calculate distances, match forms and suggest priorities. Those operations do not make the company maintaining it the owner of a public decision. The composting scheme remains municipal: the council set its purpose, chose the tool, bought the service and communicates the consequences to residents. If the explanation ends at a support desk, the institution has outsourced the one part it cannot hand away: responsibility for an exclusion from a collective opportunity.
A label is not an explanation#
“The system did not select you” sounds explanatory, yet it conceals several choices. Perhaps the tool penalised a shared courtyard, read outdated density data, treated a cadastral reference as a disqualifier or confused two addresses. Each possibility calls for a different response. The neighbours do not need the programme’s source code. They do need to know which condition counted, where the relevant data came from, when the rule was applied and how they can challenge an error. A public outcome does not become beyond question simply because a screen performed the first calculation.
“The system did not select you” sounds explanatory, yet it conceals several choices.
The first safeguard is to separate a signal from a conclusion. A system may reasonably flag missing information or an unusual property record. That flag can prompt a check. It should not close the route to participation when no one can verify it, when the criterion has never been approved, or when the cost of a mistaken exclusion is larger than the time saved by a review. Automation can organise work; where access to public resources is at stake, it must not replace the judgement and accountability that make a decision legitimate.
The council should therefore give a plain response: this is the rule that was triggered, this is the source that fed it, and this is how you can submit a correction or request a review. Residents should not have to coordinate conversations between waste services, a technology vendor and a procurement office. It can be sensible for the supplier to investigate how its application behaved. It is not sensible to make the public discover which party is capable of deciding the matter.
Buying the ability to inspect a decision#
Auditability is not a fashionable word to add to a tender after the main design is settled. It is the practical ability to reconstruct a particular outcome. Before signing, public teams should ask clear questions. Will we be able to obtain the rules configured for this scheme? Can we see when a threshold changed and who requested it? Can we test edge cases before applications open? Will sufficient logs exist for an independent review without exposing unrelated people’s records? A supplier’s assurance that its product is responsible is not, on its own, an answer to any of these questions.
Full source-code access will not always be necessary. Often, documentation of variables, active thresholds, software versions, execution logs, data-correction routes and response duties will be more useful. But those materials must help answer a real complaint. A slide deck describing an ethical model will not explain why the Station block was assigned zero points. A trace connecting a relevant input, a rule, a version and an outcome can.
Change control matters as much as initial documentation. A modest update can alter who is eligible without any elected representative noticing. Every change affecting eligibility, priority or value should carry a recorded purpose, a test result, a date and the name of the person who approved it. This is not procedural clutter. It is institutional memory. It allows a council to distinguish a configuration mistake from a policy choice and prevents sensitive decisions from dissolving into the impersonal language of “what the platform does.”
A named owner with real authority#
The public body also needs a named decision owner. This cannot be a generic mailbox that forwards incidents. It should be a person or team empowered to obtain relevant records, require a technical response within a deadline, pause a doubtful rule, correct data and order a human assessment. Oversight that cannot alter an outcome is a ceremony. People affected by a municipal process need to know who accepts responsibility, even when the technology was built elsewhere.
The division of work can be simple without becoming a maze for residents. The supplier maintains the system and explains its behaviour. The municipal service decides which criteria fit the purpose of the scheme and remains in contact with applicants. The procedural owner weighs the evidence and communicates the decision. Neighbours get one entry point, a comprehensible reference number and a credible timeframe. They should not have to repeat their story across three portals or infer that a technical query has become an administrative appeal.
That arrangement needs a stopping rule. If an exclusion cannot be explained adequately, it should not keep producing effects while it is investigated. This does not require shutting down an entire programme whenever a minor anomaly appears. It requires deciding in advance what kind of uncertainty calls for intervention. If the same rule may have excluded hundreds of buildings, pausing it, checking the scope and notifying people may be necessary. If a single record was loaded incorrectly, correction and reassessment may be enough. In both cases, someone answerable to the public must make that judgement.
Testing assumptions before asking for trust#
The best time to discover an absurd exclusion is before the application window opens. Pre-launch testing should do more than confirm that a form loads in a browser. It should include cases that stretch the assumptions: two communities at the same address but with separate governance; a building without historic waste data; an application submitted from a mediator’s phone; a courtyard whose usable space is absent from a map. The point is not to trick the system. It is to discover what it treats as normal and whether those assumptions are acceptable for a public scheme.
Testing improves when people who might actually use the service take part and their time is recognised. An environmental officer understands waste targets; a building representative, older resident or carer may see that a seemingly neutral question creates a practical barrier. Each trial should leave a record: what case was used, what result appeared, what changed and what risk remains. Then a future complaint starts from evidence rather than institutional amnesia.
Assessment must continue after launch. Counting distributed bins is not enough. The council should look at which applications are excluded, for what reasons, in which areas, how long reviews take and how often outcomes change. Aggregate measures can reveal a pattern without turning people into permanent risk profiles. Conversations with people who abandon the process can reveal what a dashboard cannot: an explanation too technical to act on, a supposedly available in-person route that is inaccessible, or a deadline incompatible with caring responsibilities.
Repairing consequences, not only settings#
Assume the investigation confirms that the tool unjustifiably penalised a class of property references. Fixing the rule is necessary, but it does not repair applications already rejected. The council must identify them, notify people in clear language, reopen a fair opportunity for assessment and decide how to address delay if resources have already been allocated. “The system has been updated” describes a technical action. It does not answer those who lost an opportunity because of the previous error.
Repair will not look identical in every case. It may mean reassessment, a supplementary list, an additional call or a transparent priority in the next round. The aim is neither improvised favour nor the fiction that every circumstance is the same. It is a stated repair criterion, limited use of personal information and an appeal route for people whose situation remains unresolved. Acknowledging an error’s reach does not weaken an institution; it shows that it has the means to carry its consequences.
Responsibility survives the end of a contract as well. A vendor can merge, replace a product or stop supporting it; the council retains its relationship with residents. Contract exit plans should therefore include usable exports, access to necessary histories and the ability to answer questions about past decisions. Buying a platform is not buying permission to forget what was done through it.
Before procurement, the central question is not whether the programme will move faster. It is whether, when a neighbour says, “This left me out and I do not know why,” someone with a name, relevant information and the authority to act will answer. If that answer exists, technology can support a more attentive public service. If the only answer is “ask the supplier,” the problem is not merely algorithmic. It is an institution that has left its responsibility on the other side of the screen.
The contract should begin with purpose#
Careful public procurement begins by describing the problem, not by choosing an interface. The aim may be to reduce waste, make local composting possible and allocate limited resources fairly across neighbourhoods. None of those aims requires an opaque score. Before comparing bids, the public team should write down which tasks may be automated, which need human verification and which may never be settled by a rule alone. That distinction stops an attractive interface from quietly imposing a policy that no one has openly considered.
The tender can turn purpose into observable commitments. It should require documented eligibility criteria, intelligible messages for excluded applicants, retained records for a stated period and timed responses to challenges. It should also prevent a technical update from changing the programme in practice without approval. These are not hostile demands on a capable supplier. They clarify what must be delivered and reduce ambiguity when something goes wrong. Opacity usually protects an overbroad sales promise, not a service that can be defended to the people using it.
Cost comparison belongs here too. A cheap-looking product may leave out the cost of complaints, review, correction and repair. That cost does not vanish; it is shifted to neighbours, front-line staff and community groups trying to understand a refusal. Scoring bids only on licence price and deployment speed rewards systems that conceal later human work. A credible budget includes training, accessibility testing, audit capacity, transition support and review time. Public efficiency is not the disappearance of work needed to treat people fairly.
An appeal needs a visible route#
When someone challenges an outcome, the process should not begin with a search for an old email address. The page can provide a clear route beside the decision, a free phone line and an in-person alternative. Each route should record the date, explain what happens next and allow a simple correction to be attached. A photograph of the courtyard, a community note or an amended property record should connect to the existing application rather than forcing a person to start a new administrative race.
First contact need not resolve every dispute. It must distinguish a request for information from a possible injustice. For the latter, the institution should give a timeframe, freeze any irreversible effect and assign review to someone able to act. The timeframe must be measured and escalated when it expires. An explanation delivered after bins have been allocated or annual funding has closed can be the same as no explanation at all.
Traceability protects both the person complaining and the staff handling the case. Each stage should record what was claimed, which data were checked, what the supplier said, who made the decision and what repair was offered. This is not a device for monitoring every worker. It prevents a case from dissolving into ownerless conversations. A short, readable history also exposes patterns: when many complaints point to the same rule, the institution cannot continue treating them as unrelated accidents.
Necessary data, not a new intrusion#
Reviewing an exclusion does not authorise unlimited data collection. To check a courtyard’s usable area, plans, an agreed visit or a statement from the community may be enough. There is no need to collect full resident lists, other households’ consumption histories or documents irrelevant to the scheme. Data minimisation makes repair safer and clearer: every requested document should have a stated purpose and a deletion date.
The same restraint should govern information moving between the council and the supplier. The company may need an application identifier and the variables that triggered a rule; it does not need every personal detail connected to the request. The contract should define who can access information, for how long, under what controls and what happens when an incident closes. If several municipal services need to compare records, the purpose must be justified and the scope limited. Answering one neighbour must not create an unjustified exposure for everyone else.
Learning without concealing the harm#
An institution can learn from a failure without turning its communication into public relations. After review, it should publish a proportionate note: what criterion failed, how many applications might be affected, what has been paused, how cases will be reviewed and where people can ask for help. It need not disclose files or blame named individuals. It does need to let other affected people recognise the issue and see dates, owners and follow-up.
The note should distinguish confirmed facts from questions still under investigation. Saying that a platform now works while the council has not decided how to repair past exclusions confuses a technical fix with a public response. Honest language can say that the rule is suspended, cases will be reviewed by a stated date and a results report will go to the appropriate public body. Uncertainty acknowledged with a plan earns more trust than certainty that collapses during the next phone call.
The Station neighbours are not asking for a perfect machine or an endless meeting before every decision. They are asking that a technical signal cannot become an exclusion from their neighbourhood without a reason and a remedy. Auditable contracts, empowered owners, realistic tests and meaningful repair make that request an ordinary practice. Technology may help coordinate composting. The obligation to treat the people participating in it fairly remains entirely public.
