Make the abstraction touch the ground.

Who pays first: applicants with unstable housing, limited language access, disabilities, or unreliable mail. The accumulation path includes lost food, housing, medical care, and appeal capacity. The action is ORANGE because automation plus weak notice can create an autonomy cascade.

Door: hold the application for human outreach, use multiple accessible channels, preserve benefits temporarily where lawful, provide reasons and appeal, sample for disparate failure, and sunset the pilot.

• Wall: silent permanent denial.
• Gap: which outreach methods are actually reachable.
• Reopen: missed-contact and successful-appeal rates.

Who pays first: workers with disabilities, caregiving duties, atypical workflows, or low bargaining power. Consent is weak when refusal threatens employment. The score's validity, proxy discrimination, and chilling effects remain unresolved.

Door: do not use individual scores for discipline; begin with aggregate workflow diagnostics, worker representation, data minimization, independent validity testing, deletion limits, and a meaningful appeal path.

• Red team proxy variables and manager misuse.
• Separate operational security from productivity judgment.
• Receipt every expansion of data or consequence.

The patient pays first if a rare but time-sensitive condition is missed. The system lacks authority and may lack the current record. Because delay can be irreversible, the competence and freshness gates bind.

Door: provide non-diagnostic safety-net guidance, identify red-flag symptoms, route urgent cases, disclose limitations, and require qualified review before the output changes care access.

• No diagnosis by receipt.
• No stale chart presented as current.
• Track escalation and missed-urgency outcomes.

Content accuracy and intent are separate. The record may support 'misleading as written' while failing the evidence threshold for knowing deception. A high-profile target still has rights, and readers can be harmed by false certainty.

Door: publish the verified factual contradiction, label unresolved evidence, seek comment, link primary sources, and reserve intent attribution unless prior correction, internal knowledge, or systematic pattern evidence is documented.

• IAM Level A may be supported.
• Level D needs an evidence trail in the receipt.
• Correction path and version history remain visible.

Delay could expose many people; suspension could interrupt critical service or lock out an innocent operator. The smallest reversible Door is time-bounded isolation with redundant confirmation, emergency contact, protected evidence, and a rapid independent review.

The receipt records indicators, authority, affected services, rollback owner, alternative access, and the condition for restoring or escalating the account.

• Urgency supports a narrower Door, not an undocumented act.
• Break-glass access is logged and expires.
• Post-incident CAPA reviews both delay and overreach.

Inaction can expose people; overstatement can cause panic, distrust, and unnecessary burden. The Therefore should carry only what the evidence supports: what is known, unknown, precaution requested, who is most vulnerable, and when the next update will arrive.

Door: time-stamped precautionary notice, plain uncertainty, accessible alternatives, hotline, scheduled update, and correction history.

• Status quo harm is explicit.
• No false certainty to force compliance.
• Update duty becomes part of the action.

The honest action is larger than 'launch a search assistant': expose many users to a conversational system whose long-session behavior and manipulative failure modes are not yet bounded at scale.

Possible Door: begin with a smaller cohort, cap session length, monitor threatening or deceptive behavior, retain kill authority, and expand only after the observed boundary survives.

• Competitive urgency is a risk signal, not authority.
• A post-launch patch is not the same as a pre-launch Door.
• Retrospective analysis remains an illustration, not causal proof.

The consequential act is the company's policy representation—not merely generation of chatbot text. Customers may reasonably rely on that answer while the organization controls the source and recovery path.

Possible Door: retrieve from the current policy, clearly separate general guidance from binding fare rules, route sensitive questions to a person, preserve the answer source, and provide fast correction and remedy.

• 'Just advice' does not erase foreseeable reliance.
• The organization remains responsible for its deployed channel.
• A disclaimer alone may be weaker than a verified source and remedy path.