the station / sector 10
Rights and compliance
How to tell where you areAsk what your software owes to someone who does not work for you — a user whose data you hold, a person using a screen reader, the holder of a licence you depend on. Then ask who checked, and when. If nobody can name the obligation, you are not at the bad end of this line, you are not on it.
The other nine sectors describe things you would eventually notice. This one describes claims made against your software by people outside your organisation, under standards you do not get to negotiate: a user whose data you hold, a person who cannot use a mouse, a regulator, a licence holder, a court.
Two properties make it behave unlike everything else here. These are violations on day one whether or not anyone ever notices — a missing consent flow, an unlicensed dependency and an inaccessible form are all wrong before any feedback loop runs. And several of the harms are not undoable: data already disclosed stays disclosed, so the reversibility argument that makes mistakes cheap elsewhere simply does not apply. Prevention is the only available control.
This sector is charted as dark. Privacy, accessibility and licensing have no controls here yet, and that omission is recorded rather than quietly left.
Controls that move you along it
- ›Report accuracy per subgroup, never as one number
- ›Check licences through the whole graph, not the manifest
- ›Drive your own deletion and opt-out paths with a canary account
- ›Scan for the six failures that account for almost everything
- ›Test the consent dialogue against the law, not the vendor default
- ›Someone drives the critical path with a screen reader