Justification as a revisable state: a behavioral risk–friction fit framework for digital public services

1 Introduction

Digital public services operate under competing obligations. Authorities must deliver entitlements accessibly while verifying identity and eligibility, preventing erroneous payments, protecting accounts, and interrupting consequential mistakes. Each objective can motivate a document request, interview, authentication factor, warning, or delay. Removing a step may expose users or public funds to harm; retaining it can impose time, monetary, cognitive, and psychological costs, including abandonment by eligible users. These costs are consequential and unevenly distributed (Christensen et al., 2020; Halling and Baekgaard, 2024; Moynihan et al., 2015). Digital provision may reduce some burdens, while creating others through technological, organizational, and individual configurations (Hegemann and Ritz, 2026; Peeters, 2023).

Administrative friction operates through two analytically distinct but potentially interacting behavioral pathways. In the claimed-mechanism pathway, the design is hypothesized to verify information, induce deliberation, deter misuse, or otherwise reduce a specified risk. In the experienced-burden pathway, the same design produces subjective effort, delay, anxiety, assistance seeking, or failed recovery conditional on users' cognitive, administrative, physical, linguistic, and digital resources. The claimed mechanism does not mediate experienced burden, and neither pathway by itself determines normative status. A verification step may therefore block impersonation or mainly block legitimate users without the required device. A mandatory interview may elicit eligibility information, while rigid scheduling generates procedural denials without adding information. Observed dropout remains behaviorally ambiguous: it may indicate deterrence, confusion, inability to comply, low expected benefit, or failed recovery. Treating everyone screened out as an erroneous applicant converts an outcome into an unsupported program-integrity claim.

Established traditions supply most evaluative ingredients. Reasonableness and proportionality connect legitimate purpose to alternatives and balance (Doughty and Baehler, 2020; Möller, 2012). Sludge audits foreground process costs, benefits, alternatives, and review (Sunstein, 2022). Screening models connect complexity to participation and targeting, while empirical studies show that application costs can exclude eligible people rather than improve selection (Deshpande and Li, 2019; Kleven and Kopczuk, 2011; Shepard and Wagner, 2025). Digital-burden research explains technological, organizational, and individual interactions (Hegemann and Ritz, 2026) and identity standards incorporating risk-sensitive controls, customer-experience metrics, redress, and reassessment (Temoshok et al., 2025). These approaches do not jointly encode gate evidence as pass, fail, or unknown and link those results to four time-indexed justificatory statuses, actions, and expiry conditions.

This article asks when a specific friction in a digital public service is justified and what evidence should trigger retention, redesign, targeting, suspension, removal, or reclassification as Sludge. Behavioral risk–friction fit (BRFF) extends rather than replaces reasonableness and proportionality. It treats justificatory status as J(f, r, s, g, t | E, A): one friction, risk, stage, group, and period, conditional on evidence and feasible alternatives. Unknown is not converted into approval or failure, each completed-result pattern entails an action, and positive status expires. Section 3 separates design, mechanism, burden, outcome, and status. Section 4 defines Gate 0 and three behavioral criteria in a conditionally iterative procedure, together with life cycle transitions; Section 5 states decision rules, empirical implications, and review tiers. Section 6 applies the procedure; Section 7 examines implementation and limits. The argument is operational and behavioral and not a new foundation of administrative justice or a universal welfare formula.

2 Analytical approach and scope conditions

The article uses structured conceptual synthesis rather than a systematic review or meta-analysis. Targeted searches and backward and forward citation chaining were updated through 13 July 2026, using Crossref-indexed publisher records and official regulatory or standards repositories. Search clusters combined “administrative burden,” “sludge,” “ordeal,” “friction,” and “digital public service” with “fraud,” “program integrity,” “identity,” “authentication,” “screening,” “exclusion,” “redress,” and “proportionality.” Peer-reviewed sources with verified DOI metadata were prioritized for conceptual and empirical claims; current standards and regulatory documents were retained only as institutional precedents. Candidate antecedents were retained when they supplied a multicriterion test for administrative burden, a legal or behavioral comparison with alternatives, an error-sensitive screening model, or a digital risk-governance process. Table 1 compares the closest retained approaches on unit of analysis, evidence, alternatives, distribution, and revision. Concepts are then tested through disaggregation, counterexample, and decision consequence: whether a term describes design, mechanism, experienced cost, outcome, or evaluation; whether an apparently protective step can fail its mechanism; and what evidence should warrant retention, redesign, or removal. This strategy acknowledges established normative foundations, while isolating the operational relationship that BRFF is designed to supply.

Table 1. Nearest antecedents and the operational gap addressed by BRFF.

The table states acknowledged intellectual debts. BRFF claims no priority for an individual criterion. Its proposed contribution is a friction-level transition architecture in which completed Pass, Fail, and Unknown behavioral results feed four time-indexed justificatory statuses, actions, and expiry conditions. Candidate Found—Pending G3(a|f) is an intermediate routing state rather than a fourth result.

Here, a digital public service is a legally or administratively authorized service in which a public authority, or an organization acting under public mandate, uses a materially digital journey to determine, deliver, protect, or contest an entitlement, obligation, identity credential, authorization, or payment. Analog assistance and appeal remain within scope because a workable fallback changes the digital step's effective burden. Private commerce, employee workflows, non-transactional government websites, and inconvenience caused solely by substantive eligibility rules or service scarcity are excluded. The unit is one friction f, risk r, stage s, group g, and review period t, conditional on evidence E and feasible alternatives A. BRFF does not classify “multifactor authentication” or an entire program in the abstract.

The digital restriction is substantive rather than cosmetic. Digital journeys can propagate one erroneous record across linked services, make access depend on devices, credentials, connectivity, and data quality, and turn a failed authentication or automated match into an immediate lockout. They also create distinctive lower-burden alternatives—authorized data reuse, event-triggered checks, trusted-device recognition, asynchronous assistance, and rapid recovery—while generating adaptive threats, warning habituation, and displacement between channels. Their telemetry can support continuous evaluation, but opaque automated decisions can make causal diagnosis and contestation harder (Hegemann and Ritz, 2026; Peeters, 2023; Peeters and Widlak, 2018). These features make a fit unusually dynamic, group-dependent, and sensitive to the interaction between front-end steps, back-office data, and fallback channels. BRFF can inform non-digital procedures, but its time index, recovery metrics, and alternative set are designed around these digital properties.

Cases are selected for conceptual leverage and not for representativeness. The SNAP experiment supplies an evidence-gap application; two explicitly hypothetical records illustrate completed positive and negative statuses. Commonwealth Care, digital-identity standards, and payment controls remain boundary or governance analogues rather than sources of transferable thresholds or legal conclusions (European Commission, 2018; Payment Systems Regulator, 2021, 2022; Shepard and Wagner, 2025; Temoshok et al., 2025).

3 From administrative friction to justificatory status

Administrative friction is a descriptive starting point and not a normative conclusion. Here, it refers to a requirement, step, or delay in a public service that can impose time, cognitive, compliance, financial, psychological, or recovery costs. Some steps may collect decision-relevant information, deter misuse, interrupt an impulsive action, or reduce error; others may be redundant or poorly targeted. The evaluative question is therefore not whether a service contains friction but whether a particular friction is justified for a specified risk, service stage, population, and period.

This starting point builds on established administrative-burden and sludge frameworks. Administrative-burden research distinguishes learning, compliance, and psychological costs (Moynihan et al., 2015), while later work separates what an administration requires from what citizens experience as onerous (Baekgaard and Tankink, 2022; Daigneault, 2024). Administrative burden, ordeal, red tape, and sludge are overlapping but non-interchangeable categories (Madsen et al., 2022). Transaction-cost and institutional accounts also caution against assuming that sludge scholarship ignores potential benefits (Frolov, 2026; Shahab and Lades, 2024). BRFF does not claim priority for purpose, alternatives, distribution, or review. It models how evidence concerning those elements changes a friction's status over time. Table 1 identifies that narrower originality boundary. The architectural claim would be defeated by an antecedent that already maps friction-specific pass, fail, and unknown evidence to default actions, time-indexed status, and expiry conditions.

The added decision consequence is developed through the SNAP scheduling application in Section 6. BRFF prevents a measured access gain from becoming an unmeasured integrity claim. It converts the missing protection comparison into evidence-uncertain status, a specified test, safeguards, and an expiry condition.

3.1 A five-layer ontology

Conceptual ambiguity arises when a procedure's physical form, intended function, experienced burden, behavioral effects, and normative status are placed in a single classification. “Verification friction” may describe both an observable request and the mechanism through which it is expected to reduce risk. “Legacy friction” describes persistence, while “strategic friction” concerns organizational purpose. “Sludge” is evaluative: it denotes a failure of current justification under the framework and not a judgment about a policymaker's motive or character. A flat typology mixes different attributes and encourages circular reasoning. Labeling a step “protective” before evaluating its effects converts a claimed mechanism into a favorable conclusion.

The BRFF framework separates five analytical layers (Figure 1). The first is design form: what, exactly, must a user do or endure? The object should be granular enough to change independently. “Multifactor authentication” is too broad; “entering a one-time code for every low-value interaction from a trusted device” is evaluable. Likewise, “eligibility verification” names a function, whereas “attending a fixed-time appointment after submitting information already held by the agency” identifies separable requirements. Granularity prevents a legitimate objective from immunizing every attached delivery feature. Design form then enters two analytically distinct but potentially interacting pathways rather than a linear sequence; separation of outcomes does not imply physical independence of the underlying action.

The second layer is the claimed mechanism: how the design form is expected to change the target risk through verification, information elicitation, deliberation, deterrence, or screening. Risk-control friction is neutral shorthand for such a claim; it does not imply effectiveness. An ordeal mechanism treats willingness or ability to bear a cost as informative about eligibility, need, or risk. Screening models explain why this mechanism can affect take-up and targeting, but the people most able to endure an ordeal need not be those whom a program intends to select (Kleven and Kopczuk, 2011).

The third layer is experienced burden: costs as experienced by users and not the nominal length of a requirement. Design form affects this pathway directly, conditional on group and context; the claimed protective mechanism does not mediate it. A 3-min task for one user may entail device replacement, document retrieval, travel, translation, or repeated recovery for another. Cognitive resources, health, administrative capital, and literacy shape navigation (Christensen et al., 2020; Döring, 2021; Masood and Nisar, 2021). Institutions should therefore test task-by-resource interactions rather than rely on average completion time.

The fourth layer is behavioral outcome. Protection-side outcomes include residual target harm and protection failure, such as undetected fraud or unprevented error. User-side outcomes include access or autonomy error: legitimate access blocked, eligible users abandoning an application, decisions delayed beyond a meaningful deadline, or failed recovery. False acceptance and false rejection are useful where a defensible ground truth exists, as in screening or authentication, but should not be imposed on every setting. A payment warning may instead be assessed through residual loss, correctly interrupted errors, unnecessary abandonment, delay, comprehension, and recovery.

The fifth layer is normative status: justified for the current review period, evidence-uncertain, a correctable misfit, or sludge. Status follows from evidence across the prior layers and comparison with alternatives. A procedure can possess a protective core while retaining a sludge shell: an eligibility interview may elicit relevant information, while a fixed appointment window or repeated submission of existing records adds avoidable burden. Shepard and Wagner (2025), for example, estimated that replacing automatic enrollment with required active plan choice reduced new enrollment by approximately 33% relative to the prior flow in the studied health-insurance setting and disproportionately excluded economically disadvantaged eligible adults. The study did not measure fraud or establish a general effect of small steps; it showed why attrition is not evidence of accurate selection.

These layers produce an explicitly conditional object of evaluation:where f is a specific friction, r is the target risk, s is the service and process stage, g is the relevant user group, t is the time of assessment, E is the available evidence, and A is the feasible set of alternatives. The notation is not intended to produce a universal scalar score. It disciplines the claim being made. A high-value payment warning for a new payee may be justified, while repeated confirmation for routine low-value payments is not. An authentication challenge may be justified for one risk class and inaccessible for a group without the required device. The same friction can accordingly receive different statuses across service stages, groups, or review periods. When one design is claimed to address several materially distinct risks, BRFF uses linked risk-specific records rather than aggregating protection into one score. Each risk receives its own mechanism, counterfactual, outcomes, and Gate 1 result, and the retention decision identifies the independently supported risk claim on which it relies.

J(f,r,s,g,t|E,A),

4 The behavioral risk–friction fit framework

BRFF is organized around a legal precondition, three behavioral-evidence criteria arranged in an ordered but conditionally iterative procedure, and a four-status life cycle loop (Figure 2). Gate 1 precedes comparative testing, but Gate 2 may invoke G3(a|f) and then resume candidate search. Gate 0 lies outside the trivalent completed-result structure. Each completed behavioral assessment returns Pass, Fail, or Unknown; Candidate Found—Pending G3(a|f) is an intermediate routing state and not a fourth Gate 2 result. Layers describe the object and pathways; Grades A–D apply only to Gate 1 protection evidence; completed results map asymmetrically to statuses and actions; and review tiers change evidentiary depth and not the meaning of Pass.

Gate 0 is portable as a procedural question and not a universal legal answer. For each evaluation unit, the responsible authority records the governing jurisdiction, legal basis, competent decision maker, legitimate purpose, and binding equality, accessibility, notice, review, and remedy constraints. Where jurisdictions overlap, the record identifies the controlling rule and non-compensable floor. Authority or a pass cannot be transferred from a standard, another jurisdiction, or a related service. Absent authority, or when an applicable right cannot be secured by redesign or safeguard, the sequence stops. A Gate 0 pass opens behavioral assessment; it does not establish justification. An inherited step with no current legally cognizable purpose or authority stops at Gate 0. If a legitimate purpose and authority can be stated but incremental-effect evidence is absent, Gate 1 is Unknown and the unit is Evidence-Uncertain; institutional age or lost records count as evidence neither for nor against functional fit.

The criteria answer distinct questions. Gate 1 asks whether the current friction reduces a specified risk relative to an explicit counterfactual. Gate 2 asks whether a proportionate search identifies a lower-burden alternative that preserves every material protection outcome. To distinguish the two applications of distributional and rights-sensitive fit, G3(f) denotes assessment of the current design for status assignment, whereas G3(a|f) denotes assessment of a candidate within the Gate 2 comparison against f. The substantive constraints are the same, but the consequences differ: a Fail at G3(a|f) rejects only the candidate and returns the search to Gate 2; an Unknown leaves the candidate unresolved; and a Pass, together with a prespecified burden reduction, finalizes Gate 2 as Fail because the candidate dominates f. Unknown at any decision-valid behavioral assessment maps only to Evidence-Uncertain. Gate 1 Fail maps directly to Sludge. A Gate 2 final Fail or G3(f) Fail enters a separate repairability decision and maps to Correctable Misfit only when a Gate 1-passing core remains independently testable and a feasible repair can be retested within the review period; otherwise, it maps to Sludge. Repairable therefore means more than technically editable: the record must identify the retained mechanism, the replaceable delivery feature, a feasible redesign, and a time-bounded retest. A change that replaces the protective mechanism creates a new evaluation unit and cannot inherit Correctable-Misfit status. Passing an earlier assessment cannot offset a later Fail.

4.1 Gate 1: functional fit

Functional fit requires a legitimate and measurable target risk, a causally plausible control mechanism, and evidence of incremental protection against an explicit counterfactual. A public authority should first identify whose harm is being prevented, the baseline incidence and severity of that harm, and whether the harm is reversible. It should then state the behavioral, informational, or verification pathway through which the friction is expected to act. A password reset delay may reduce unauthorized account recovery by allowing time for detection; an eligibility interview may uncover inconsistent information; a payment warning may redirect attention to a mismatch. Each claim implies observable outcomes and conditions under which the mechanism would be weakened or rejected.

The key distinction is between purpose and performance. “Fraud prevention,” “budget protection,” and “fairness” can identify legitimate evaluative aims, but they do not estimate an effect. Research shows that reasons and deservingness judgments can shape policymakers' tolerance for administrative burdens (Bækgaard et al., 2021; Halling and Van de Walle, 2026). The latter evidence concerns attitudes toward burdens and not whether the burdens reduce fraud or expenditure. Gate 1 therefore requires evidence comparing the friction with a relevant alternative state, such as the pre-intervention process, a no-friction condition, a different control, or a credible threshold comparison.

The A–D labels are BRFF's proposed outcome-level descriptors and not a borrowed or validated scale and not grades for whole studies. Grade A estimates incremental protection with a credible randomized, quasi-experimental, or equivalently strong design. Grade B uses a well-controlled operational, interrupted time series, threshold or comparative observational evidence that bounds material rival explanations, displacement, rare-event uncertainty, and denominator change. Grade C supports only mechanism plausibility through simulation, threat analysis, expert judgment, standards, or descriptive association. Grade D is an asserted purpose or inherited practice without performance evidence. Each material protection outcome is graded separately and its rationale disclosed. Missing user-side evidence does not lower a protection grade; it can leave G3(f) Unknown. A Gate 1 Pass ordinarily requires Grade A or strong, independently scrutinized Grade B evidence. Grade C can support only narrow provisional use under the precautionary rule below and never a Pass. Grade D supports neither a Pass nor provisional use. Severe or difficult-to-reverse harm does not upgrade Grade D or override this priority. A proposed Grade D control should not be introduced; an existing Grade D control should enter safe suspension, removal, or replacement. If independently scrutinized evidence establishes at least Grade C mechanism plausibility for every material protection outcome required for temporary use, the control may enter the precautionary rule, but Gate 1 remains Unknown and the status remains Evidence-Uncertain. Proportionality governs how evidence is generated and not what a Pass means. Authorities may reuse valid outcome-specific evidence, batch or sample materially similar low-risk units, or use the least costly credible design capable of resolving the stated failure condition; a lighter review does not convert Grade C or D evidence into functional fit.

At minimum, a Gate 1 assessment reports the target-risk definition, baseline rate, causal pathway, protection outcome, residual target harm, observation window, effect estimate, uncertainty, and plausible rival explanations. Where ground truth is defensible, it also reports false acceptance. It should state a failure condition in advance. A verification step fails functional fit if it does not materially prevent, detect, or deter the specified harm relative to the comparator; a deliberative prompt fails if it does not reduce the target error or harm; an ordeal fails if the inconvenience does not improve decision-relevant selection. Normative or technical standards may help define prudent governance, but they are not themselves intervention-effect studies. The National Institute of Standards and Technology Digital Identity Guidelines, for example, provide an important precedent for evaluating both risks mitigated by identity controls and risks introduced by those controls, with continuous monitoring and redress (Temoshok et al., 2025). Compliance with that standard does not, by itself, demonstrate the causal effect of a particular authentication step.

If evidence is insufficient for a Pass but every material protection outcome required for temporary use has at least Grade C support, Gate 1 is Unknown and the friction is Evidence-Uncertain and not justified. Narrow provisional use is defensible only when target harm is severe or difficult to reverse, safe suspension would create a specifically documented protection gap, and no evaluated lower-burden control or safer fallback is immediately available. This interim action requires Gate 0 satisfaction, accessibility and procedural safeguards, active evidence collection, a prespecified milestone, independent written approval, and the shortest feasible expiry date. Severity changes the interim action; it does not change the evidence grade or result. Renewal does not improve status and may not rest on the original risk assertion. Acceptable evidentiary progress requires a completed, verifiable milestone in the prespecified plan and a credible path to resolving a named decision within the shortened renewal period. Repeating the risk assertion, resetting the deadline, or reporting expenditure or activity that cannot change a result does not count. A missed milestone activates the prespecified suspension, replacement, external authorization, or fallback rule. Each subsequent renewal requires a shorter duration and independent written approval, and the initial record specifies a cumulative escalation point beyond which continued uncertainty requires external authorization, replacement, safe suspension, or a new fallback evaluation. A manual fallback is a distinct design form and evaluation unit that begins at Gate 0 and receives no inherited status. It must be time-limited, independently reviewed, and measured for both protection and access. A fallback with only Grade D support cannot be deployed provisionally; it must first reach at least Grade C mechanism plausibility and then satisfy the same severe-risk, safeguard, evidence-generation, and expiry conditions. Security urgency cannot convert it into indefinite retention.

4.2 Gate 2: comparative fit

Functional effectiveness is necessary but insufficient. A friction that reduces risk can still be unjustified if another feasible design achieves materially similar protection with less burden. This requirement translates the least-restrictive-means logic of proportionality and the less-burdensome alternatives component of administrative-burden reasonableness into a comparative evidence test (Doughty and Baehler, 2020; Möller, 2012). It also extends sludge-audit reasoning from identifying costs to evaluating a specific control against plausible substitutes (Sunstein, 2022).

Potential alternatives include back-office data matching, event-triggered verification, risk-tiered authentication, exemptions for trusted devices or established payees, flexible interview scheduling, assisted digital channels, human review, and a more informative but less repetitive check. The relevant alternative set is constrained by legal authority, technical feasibility, administrative capacity, privacy, and the severity of the target risk. That a “A simpler process exists” is not enough. The institution must test whether that process preserves the protection that justified the friction in Gate 1.

The search is proportionate only when the institution has examined the principal feasible substitution classes suggested by the mechanism and service context: back-office or data substitution, targeting or exemptions, temporal or channel flexibility, assistance and recovery redesign, and human or hybrid review. The record must name the classes searched, identify candidates, and provide reasoned legal, privacy, technical, cost, or implementation grounds for excluding plausible but untested candidates. A minimum review may rely on reusable evidence, batching, or sampling for materially similar low-risk controls. Enhanced and full reviews require an independent reviewer to confirm that no untested candidate is sufficiently plausible to warrant comparison during the current review period. This stopping rule limits open-ended search without allowing a weak candidate set to prove its own adequacy.

BRFF operationalizes the comparison through a prespecified protection-loss margin rule structurally analogous to non-inferiority reasoning (Piaggio et al., 2012). Before results are observed, the institution identifies a primary protection outcome and every material secondary protection outcome suggested by the mechanism, including plausible displacement across channels, periods, or harm types. Let P_k(f) and P_k(a) denote directionally aligned, higher-is-better values for outcome k under the current friction and alternative a. Alternative a meets the protection screen only when P_k(a) − P_k(f) ≥ −ε_k for every prespecified material outcome under its uncertainty rule. A failed outcome rejects that candidate, while unresolved evidence on any material outcome leaves that candidate unknown. A favorable primary outcome cannot compensate for material deterioration in a secondary protection outcome. Each protection-loss margin ε_k is set before results are observed. Its basis includes harm severity and reversibility, historical variation, applicable legal or regulatory thresholds, the minimum policy-relevant difference, and measurement precision. Greater harm severity ordinarily tightens rather than enlarges the corresponding ε_k. Independent scrutiny must approve the complete outcome set, directions, windows, uncertainty rules, and margins before comparison. These protection constraints remain within Gate 2; access, recovery, and rights floors remain non-compensable Gate 3 constraints. Each margin record must distinguish normative tolerance from statistical convenience, explain why the proposed loss is acceptable given severity and reversibility, disclose material uncertainty, and identify the tier-appropriate reviewer. Where consultation is lawful and proportionate, the record states whose input was considered; full review retains its separate requirements of affected-user participation and formal external margin approval. Uncertainty that could conceal irreversible harm requires a sensitivity analysis or a tighter margin before comparison becomes decision-valid.

BRFF borrows only the prospective bounded-loss comparison, explicit margin, and uncertainty logic; it does not import clinical-trial assumptions or license the statistical label “non-inferior” unless the design supports that inference. Rare or adaptive harms may require aligned interrupted time series, phased rollout, threshold comparisons, calibrated simulation, and confidential operational evidence. The record must identify the counterfactual, use comparable denominators and windows, quantify uncertainty, and evaluate prespecified displacement outcomes. Strong Grade B evidence can close the gate when multiple independent operational or quasi-experimental sources converge. One exceptionally informative design may also suffice when it credibly bounds material rival explanations, displacement, and denominator change. Source count alone is neither necessary nor sufficient.

Gate 2 has three completed results—Pass, Fail, and Unknown—and one intermediate routing state: Candidate Found—Pending G3(a|f). It reaches Pass only when a proportionate search finds no qualifying candidate and no materially plausible unresolved candidate. A candidate who misses any material protection margin is rejected at the protection screen; this is not a Gate 2 Fail for the current friction. A materially plausible candidate with missing decisive protection evidence leaves the comparison Unknown. A candidate meeting every protection margin enters the intermediate state and proceeds to G3(a|f). If G3(a|f) Passes and the candidate demonstrably lowers the prespecified burden outcome, Gate 2 is finalized as Fail because the candidate dominates the current friction. If G3(a|f) Fails, only that candidate is rejected and the search returns to Gate 2. If G3(a|f) is Unknown, the candidate remains unresolved; if no other candidate qualifies, Gate 2 is Unknown. Evidence measuring only take-up or convenience warrants a protection-effect test and not an equivalence claim.

This evidentiary boundary is important in interpreting burden-reduction studies. Simplified information and increased salience raised benefit take-up in a large field experiment, and application assistance also increased participation in other benefit settings (Bhargava and Manoli, 2015; Finkelstein and Notowidigdo, 2019). A randomized experiment with approximately 65,000 SNAP applicants found that flexible interview scheduling increased approval and longer-term participation (Giannella et al., 2024). These studies establish that delivery features can change access. They do not all measure fraud, false acceptance, or program integrity. They thus identify serious candidate alternatives and reveal avoidable access costs, while leaving the full comparative-fit test incomplete where protection outcomes were not observed.

4.3 Gate 3: distributional and rights-sensitive fit

Gate 3 applies one set of distributional and rights-sensitive criteria to two explicitly labeled objects. G3(f) assesses the current design for status assignment, whereas G3(a|f) assesses a protection-screened candidate within Gate 2. Both applications ask whether protection benefits, user-side errors, experienced burdens, safeguards, and remedies are acceptable for every materially affected group, but their failures have different consequences. It is a constrained multiobjective comparison and not a conversion of fraud and exclusion into one utility score. The outcome-specific protection margins belong to the protection metrics in Gate 2. Gate 3 separately applies prespecified access, recovery, and rights floors to every materially affected group. A modest fraud reduction can therefore coexist with a Gate 3 failure when essential income or medical access is delayed without effective remedy. Resource-dependent burdens and data-error propagation are not secondary implementation concerns; they change the realized error cost of a control (Christensen et al., 2020; Halling and Baekgaard, 2024; Nisar, 2018; Peeters and Widlak, 2018).

The assessment should measure protection-side and user-side outcomes under the same counterfactual and window. Protection-side measures are residual target harm and protection failure. User-side measures are access or autonomy error, including improper blocking, abandonment, delay, constrained choice, and failed recovery. In screening and authentication settings with defensible ground truth, false acceptance and false rejection should be reported jointly. A decline in successful applicants cannot be assumed to indicate improved targeting. Screening scholarship recognizes that ineligible awards and eligible denials are competing errors (Deshpande and Li, 2019; Kleven and Kopczuk, 2011). BRFF extends this logic through group-indexed reporting and the cost and effectiveness of correction.

Institutions should stratify access error, abandonment, delay, and recovery by relevant dimensions such as age, disability, income, language, digital access, administrative literacy, and prior service experience, provided that measurement is lawful and ethically governed. The choice of groups should follow a plausible burden mechanism rather than a generic demographic checklist. Measures of burden should include not only task duration but also learning effort, financial and travel costs, psychological costs, assistance seeking, repeated attempts, and recovery time. The institution should also report whether explanations are understood, whether a human or assisted channel is discoverable and reachable, the waiting time for that channel, appeal initiation and success, time to correction, and whether the remedy restores the foregone benefit or opportunity. Experiments on artificial intelligence (AI) decisions in welfare services further show that claimants and non-claimants can value speed–false-rejection trade-offs differently and that non-claimants may misestimate claimants' preferences (Dong et al., 2025). These are stated preferences rather than realized service errors or a normative welfare threshold, but they reinforce the need to measure the groups directly affected. Inclusive automation research likewise treats meaningful human access as a design strategy rather than a decorative fallback (Peeters et al., 2025).

For services tied to subsistence, legal status, health, or core civic participation, minimum access, notice, meaningful human review, and effective remedy operate as floors. A large aggregate protection benefit does not license a procedure that predictably blocks a protected group without recourse. This position gives proportionality a behavioral implementation: a formally available appeal is ineffective if a user cannot find, reach, or complete it before harm becomes irreversible. Remedy counts only when people can obtain a timely decision and recover what was lost.

Before results are examined, the accountable service owner proposes the materially affected groups and policy thresholds; a tier-appropriate independent reviewer approves the reasons, with input from affected-user representatives where lawful. The jurisdiction supplies binding equality standards and rights floors, which neither actor may relax. A rights floor is not created by BRFF or supplied as a universal threshold. It is a binding constitutional, statutory, regulatory, or other jurisdiction-specific minimum applicable to the evaluation unit, including requirements of access, notice, meaningful review, or effective remedy. Where regimes overlap or disagree, Gate 0 records the controlling rule, the reason for its selection, and every concurrently binding minimum; G3(f) and G3(a|f) operationalize each floor through service-specific measures of reach, use, timeliness, success, and restoration. The record states the metric, denominator, baseline disparity, minimum policy-relevant difference, severity and reversibility of harm, consultation, and revision route. G3(f) Passes only if every materially affected group satisfies every rights floor and no prespecified disparity threshold is breached; it Fails on a demonstrated breach and is Unknown when decisive data are missing. The same thresholds apply to a candidate, but the consequence attaches to the following: a Fail at G3(a|f) rejects the candidate, an Unknown leaves it unresolved, and a Pass establishes dominance only when every Gate 2 margin is met and the candidate lowers the prespecified burden outcome. Benefits to one group cannot offset another group's failure. A safeguard must show practical parity in reach, use, success, resolution time, and restoration; a change to the protection mechanism requires a reassessment of Gate 1 and Gate 2. If several candidates meet every protection margin and all Gate 3 constraints but distribute residual burdens differently, BRFF identifies a permissible set rather than a unique optimum. The authority applies a prospectively stated, legally permissible choice rule and discloses group-specific effects; aggregate burden reduction cannot excuse a floor or disparity breach.

4.4 The life cycle loop: temporal fit

Justification is time-indexed because risks, attacker behavior, data infrastructure, service channels, user capacities, and feasible alternatives change. A friction that initially reduces harm may become routine and ignored; a fixed security rule may be circumvented; a new data-sharing capability may make repeated document submission unnecessary; or an assisted channel may deteriorate until it is inaccessible in practice. Recent digital administrative-burden research similarly describes burdens as products of technological, organizational, and individual configurations rather than stable attributes of a digital interface (Hegemann and Ritz, 2026). Temporal fit converts this insight into a governance requirement.

Every friction classified as justified should have a review date, monitoring indicators, and explicit triggers for reassessment. Monitoring should cover protection effect, residual harm, access or autonomy error, abandonment, delay, recovery, and group disparities, adding false acceptance and false rejection where appropriate. It should also examine habituation, strategic circumvention, risk displacement, changes in user support, and the emergence of lower-burden alternatives. Threshold breaches should trigger redesign, narrower targeting, suspension, or removal. What expires automatically is the positive justificatory status, not necessarily the control itself. The prespecified expiry rule should distinguish safe removal, suspension, safeguarded continuation pending urgent review, formal reauthorization, and an alternative high-scrutiny manual fallback when abrupt withdrawal would create a credible catastrophic gap. Upon deployment, such a fallback becomes a distinct evaluation unit and re-enters the framework at Gate 0, followed by every relevant behavioral gate. It receives no status by inheritance. It must minimize user burden and receives its own short deadline and monitoring record. This distinction protects high-consequence systems without allowing emergency language to suspend the transition rules.

The life cycle yields four formal statuses. Justified for the Current Review Period means that Gate 0 and all decision-valid behavioral results—Gate 1, Gate 2, and G3(f)—Pass and monitoring, review, and remedy are operational for the stated evaluation unit. Evidence-Uncertain means that at least one decision-valid result is Unknown; any provisional use remains narrow, safeguarded, evidence-generating, time-limited, and subject to the Grade C minimum. Correctable Misfit means that Gate 1 has Passed and either Gate 2 is finalized as Fail or G3(f) Fails, while a specified feasible repair preserves an independently testable Gate 1-passing core and can be retested within the review period. Sludge means that Gate 1 Fails, the friction is dominated without such a retainable core, or exclusion is unacceptable and lacks a credible time-bounded repair. A Fail at G3(a|f) rejects only the candidate and has no direct status consequence for the current design. “Sludge shell” is shorthand for a separable avoidable design feature, not a fifth status. Table 2 states the transition logic and return paths.

Table 2. Completed behavioral results and four BRFF status transitions.

Gate 0 is a precondition and not a fifth status and lies outside the trivalent behavioral completed-result structure. If Gate 0 Fails or remains unresolved, do not impose the friction, or suspend it and cure the legal or rights defect before behavioral assessment. Pass, Fail, and Unknown are completed results; Candidate Found—Pending G3(a|f) is an intermediate routing state. Unknown is a result, Evidence-Uncertain is its status, and provisional use is an action. Fail and Unknown never share a default status. A G3(a|f) Fail rejects only candidate a, whereas a G3(f) Fail affects the status of f. A repair is credible only when a feasible design change and time-bounded retest are specified. Materially new evidence is evidence capable of changing at least one completed result.

5 Normative decision rules, empirical implications, and operationalization

BRFF distinguishes normative decision rules from empirical implications. The rules specify how evidence should bear on justification and cannot be confirmed by a single dataset. The implications identify behavioral relationships that can test inputs to the state-transition model. BRFF does not claim that task–resource mismatch, screening selection, or risk tiering was first discovered here; its claim is that these relationships must be estimated before a justificatory state can change.

5.1 Normative decision rules

R1: Purpose–effect separation. A legitimate risk-control purpose is necessary to begin evaluation but is insufficient to justify a friction. The responsible institution must present evidence of incremental protection against an explicit counterfactual. If only the purpose is established, the friction is evidence-uncertain. This rule places the evidentiary burden on the actor imposing a known cost and prevents the vocabulary of security, fairness, or program integrity from functioning as a substitute for performance measurement.

R2: Protection-preserving lower-burden alternative. When a feasible alternative remains within every prespecified protection-loss margin, demonstrably lowers the prespecified burden outcome, and Passes G3(a|f), Gate 2 Fails because the existing friction is dominated. This rule does not equate simpler with better. It requires comparable primary and material secondary protection outcomes, including displacement, and rejects post hoc outcome selection or margins. It also allows partial redesign: an agency may retain the informative core of a verification procedure, while removing an unnecessary appointment constraint, repeated request, or inaccessible channel.

R3: Dual irreversibility. The severity and irreversibility of the target harm determine how much precautionary friction may be considered, but the severity and irreversibility of access or autonomy harm simultaneously determine the minimum safeguards required. A high-risk, irreversible transaction may warrant an additional check. An irreversible loss of essential benefits, legal status, or treatment access requires correspondingly rapid human review and substantive restoration. Protection-side urgency cannot erase user-side irreversibility; both sides constrain design. Severity and irreversibility may alter the interim action only after at least Grade C mechanism plausibility has been established for every relevant material protection outcome; they never upgrade the evidence grade or convert Unknown into Pass.

R4: Explanation is not justification. A clear explanation may improve comprehension, perceived legitimacy, or compliance, but it cannot make an ineffective or avoidable friction justified. Transparency is valuable because it makes a requirement contestable and may help users act. It does not supply missing causal evidence or cure an inaccessible process. Only reachable alternatives, review, correction, and restoration can reduce the realized cost of an erroneous decision.

5.2 Empirically testable implications derived from BRFF

I1: Task–resource interaction. Holding the formal requirement constant, greater mismatch between prespecified task demands and users' cognitive, administrative, physical, linguistic, or digital resources should increase experienced burden, which, in turn, increases access error, abandonment, delay, and failed recovery. Accessible assistance should attenuate this mediated interaction. The implication is weakened when independently measured mismatch does not predict burden or when effective assistance does not reduce the disparity (Christensen et al., 2020; Döring, 2021; Masood and Nisar, 2021).

I2: Ordeal informativeness. Increasing ordeal cost improves screening only when capacity or willingness to endure the cost predicts ineligibility or target risk more strongly than genuine need or low administrative capacity. The test jointly estimates completion, false acceptance, false rejection, and the composition of those deterred. The implication is rejected when eligible people with greater need are disproportionately excluded without improved target-risk selection (Deshpande and Li, 2019; Shepard and Wagner, 2025).

I3: Conditional targeting and drift. Relative to uniform friction, risk-tiered friction should lower total user burden while remaining within every prespecified protection-loss margin only when risk heterogeneity is large relative to classifier error, manipulation, privacy cost, and disparate impact. After an exogenous change in threats, infrastructure, or feasible alternatives, controls randomly or administratively scheduled for revalidation should be less likely to remain dominated than comparable controls not yet reviewed. Equivalent protection without lower burden or no divergence under an exogenous review schedule rejects the respective prediction. The design requirement distinguishes review effects from institutions' pre-existing governance capacity.

Table 3 translates the framework into an audit record. It deliberately avoids a weighted score: failure of legal authority or a non-compensable rights floor cannot be averaged away.

Table 3. BRFF audit and status-transition template.

BRFF is not a weighted score. A failure of legal authority or a non-compensable rights floor cannot be offset by aggregate benefits.

Review tier changes evidentiary depth and not the meaning of pass. Minimum review is available only when burden is low, harm readily reversible, scale limited, and no core right or subsistence interest is implicated. It still records Gate 0, the evaluation unit, mechanism, basic protection and access evidence, a bounded alternative search, complaints and remedy, owner, reviewer, and expiry; unsupported evidence remains unknown. A material subgroup disparity, repeated failure, broad scale, irreversibility, sensitive-data use, or rights implication escalates the control. A function separate from the system owner checks minimum reviews, and batching or evidence reuse is permitted only for materially similar units. Enhanced review adds comparative estimates, subgroup analysis, and tested recovery; full review adds external independent scrutiny, affected-user participation, formal margin approval, and suspension rules. Minimum review is unavailable when any listed escalation trigger is present. The record must name the trigger and explain whether enhanced review is sufficient or full review is required because external scrutiny, affected-user participation, formal margin approval, or a suspension rule is needed.

BRFF itself should not become meta-sludge. Authorities should reuse valid evidence, batch or sample materially similar low-risk frictions, avoid duplicate reporting, and record audit time and cost. Review depth changes with stakes, but the meaning of pass does not. Early implementation may therefore generate many unknown results. Performance should be judged by time to resolution, closure of evidence gaps, and reclassification of overdue controls and not by the proportion approved. Validation should also report inter-rater agreement, completion time, administrative cost, decision stability, and whether BRFF resolves evidence gaps or changes actions more reliably than a simpler review procedure. Pilot implementation should use common case vignettes, double-coded samples, recorded adjudication, and versioned decision guidance, with agreement reported separately for unit definition, gate results, and final status.

The imposing institution should not self-certify without constraint. The audit record names a decision owner, the functionally appropriate reviewer for the applicable tier, and a route for affected users or their representatives to challenge task design and recovery. Independence means organizational separation from the system owner at minimum and external institutional scrutiny for rights-sensitive or high-consequence decisions, subject to the jurisdiction's oversight structure. At every tier, reviewers should disclose relevant conflicts, have secure access to the evidence, be able to require further testing, and issue a reasoned written conclusion. Independent review cannot convert missing effectiveness evidence or a rights breach into a pass. Public reasons should identify the risk, mechanism, outcome categories, gate results, status, and review date. Where publishing operational detail would enable fraud or attack, the authority may withhold exploit-enabling information, while providing aggregate outcomes and submitting the confidential evidence to an independent body with appropriate access. Contestability therefore does not require revealing a control's attack surface; it requires that secrecy not become immunity from scrutiny.

Together, the ontology, gates, life cycle, rules, and implications change the default unit of policy debate. The relevant claim is no longer that authentication, verification, deliberation, or screening is generally beneficial or burdensome. It is that a specified design, for a specified risk and group at a specified time, has passed an auditable sequence of causal, comparative, distributive, and temporal tests. That claim is stronger than an assertion of protective purpose but weaker than a declaration of permanent necessity.

6 Worked application and boundary conditions

The cases test decision consequences rather than validate BRFF. Table 4 distinguishes published observations from conditional decision branches; no illustrative branch is presented as empirical evidence.

Table 4. Worked SNAP evidence-gap application: evaluation units, status, action, and transition.

6.1 Flexible telephone interviews for SNAP: a worked evidence-gap application

A randomized field experiment involving approximately 65,000 Los Angeles County SNAP applications isolated delivery form. Eligibility, documentation, and interview requirements remained unchanged, but treated applicants could call a dedicated line to complete the mandatory interview when convenient. Thirty-day approval rose by 6.2 percentage points, from approximately 49% to 55%, and participation within 5 months rose by 2.2 points (Giannella et al., 2024). The study did not independently estimate fraud, erroneous payment, or false acceptance. It therefore establishes a causal access effect and not comparative protection preservation.

The application separates two evaluation units that a program-level label would conceal: f1 is the informational interview core, and f2 is the fixed-time scheduling requirement. Holding the formal interview requirement constant does not by itself establish functional separability. If fixed timing changes the information elicited, applicant behavior during the interview, or the interview's protection effect, the bundled interview-and-scheduling design must also be evaluated as a joint unit; the cited experiment does not resolve that interaction. The experiment formally held f1 constant and changed f2. It therefore does not establish Gate 0 authority or Gate 1 functional fit for f1, nor does it establish any independent protection supplied by f2. Those findings must come from the responsible institution's legal and evidentiary record. On the published record alone, both units have an unresolved legal precondition and missing functional evidence and cannot receive positive status. Before Gate 0 is documented, no BRFF status is assigned; conditional on Gate 0 being satisfied, the missing Gate 1 evidence makes each unit evidence-uncertain. In particular, BRFF does not infer that the interview core should be retained merely because the experiment retained it.

A sludge audit can record the scheduling cost and flexible alternative. Reasonableness or proportionality can ask whether fixed scheduling is necessary and whether the alternative is equally effective. BRFF adds a specified consequence to the unresolved comparison. Flexible scheduling is a plausible Gate 2 candidate for f2, but its comparative protection result remains Unknown. The observed access gain partially informs G3(a|f2), while the subgroup, recovery, remedy, and material-disparity evidence needed to complete either G3(a|f2) or G3(f2) remains unavailable. Later-gate comparison becomes decision-valid only after Gate 0 and the relevant Gate 1 result have been established. Once Gate 0 is satisfied, the units remain Evidence-Uncertain until Gate 1 and the conditional later decisions are resolved; any provisional continuation of f1 or f2 must separately satisfy the Grade C minimum and the severe-risk, safeguard, evidence-generation, and expiry conditions in Section 4.1.

A completed audit would prespecify, rather than derive from the cited experiment, a primary protection outcome such as subsequently confirmed erroneous approvals on an aligned observation window. It would also specify every material secondary protection outcome, including displacement, and the outcome-specific ε_k values and uncertainty rules. The access record would define interview completion, approval, delay, abandonment, and recovery, with subgroup-specific material-disparity thresholds. The audit would also name an evidence deadline, status expiry, decision owner, and reviewer. The numerical values are jurisdiction- and risk-specific and are intentionally not invented here. The published experiment supplies access estimates for f2; the remaining fields show exactly which evidence an agency must add before comparison.

The subsequent branches are logical and not empirical. Conditional on Gate 0 and a Gate 1 Pass for the relevant risk-control unit, if flexible scheduling meets every ε_k, lowers the prespecified burden outcome, and Passes G3(a|f2), Gate 2 Fails because f2 is dominated. Fixed scheduling is a Correctable Misfit when a Gate 1-passing core remains technically and behaviorally separable with a time-bounded repair, and otherwise is Sludge. If a material protection outcome misses its ε_k, the candidate is rejected at the protection screen. If G3(a|f2) Fails, the candidate is likewise rejected and the search resumes. Neither result establishes that G3(f2) Passes or that f2 is justified. If a material protection outcome or G3(a|f2) remains Unknown at the deadline, the candidate remains unresolved and Gate 2 remains Unknown if no other candidate qualifies. The application thus converts an unresolved inference into a scoped evidence gap, conditional test, safeguard, responsible action, and expiry condition.

6.2 Two explicitly hypothetical completed records

All values below are hypothetical and not empirical estimates or recommended thresholds.

Justified record. Gate 0 permits a 24-h hold and independent callback after a high-value benefit recipient changes bank details. A strong Grade B phased comparison estimates confirmed payment misdirection at 0.4% with the hold versus 1.0% without it, so Gate 1 passes. The lower-burden candidate is instant risk-tiered verification. Let P = 1−misdirection rate: P(f) = 99.60%, P(a) = 99.40%, and prespecified ε = 0.10 percentage points. Thus, P(a)−P(f) = −0.20, with a one-sided lower confidence bound of −0.32; both are below −ε = −0.10, so Gate 2 rejects the candidate. The documented search finds no other qualifying candidate, so Gate 2 Passes. G3(f) Passes because an expedited human exception, notice, restoration, and subgroup outcomes satisfy all rights floors and no disparity threshold is breached. The status is justified for the current 12-month review period, with monitoring and an earlier-review trigger.

Sludge record. Gate 0 permits annual pension-status verification, but f is mandatory in-person proof of life where an authorized death-register match is available. A strong Grade B matched audit finds confirmed ineligibility detection of 0.20% in person and 0.21% through the register, meeting the prespecified Gate 1 failure condition. It also finds 8% non-completion among mobility-limited older users versus 1% among other users and no timely restoration. The status is sludge on the stipulated current record; Gate 2 is unnecessary after functional failure. Remove f, restore interrupted payments, and assess the register-plus-escalation design as a new evaluation unit from Gate 0.

7 Discussion

BRFF contributes a friction-level transition architecture rather than another list of proportionality criteria. Completed Pass, Fail, and Unknown results from the three behavioral criteria—not the intermediate candidate-routing state—map evidence for a specified friction, risk, stage, group, and period to one of four time-indexed statuses, a default action, and an expiry condition. Gate 0 remains a legal precondition outside that trivalent completed-result structure. This changes the object and output of evaluation, while retaining established normative foundations (Doughty and Baehler, 2020; Möller, 2012; Sunstein, 2022). The claim is narrower than a new theory of administrative justice but stronger than a checklist because behavioral evidence is required to change status.

The contribution is behavioral because the same design activates two analytically distinct but potentially interacting pathways. Claimed verification, deterrence, or deliberation may reduce target harm, while the design's interaction with users' resources directly shapes experienced burden, selection, abandonment, delay, and recovery; the claimed mechanism does not mediate burden. Heterogeneity is therefore causal and not an equity adjustment after an average effect. Selection indicates accuracy only when capacity or willingness to bear cost predicts target risk rather than need or low administrative capacity (Deshpande and Li, 2019; Shepard and Wagner, 2025). Threat migration, habituation, and new infrastructure can alter both pathways and the feasible alternatives.

For practice, BRFF is an audit discipline and not an algorithm. It records the risk, mechanism, counterfactual, protection grade, alternatives, joint protection–access outcomes, subgroup effects, remedies, status, action, and review trigger. False acceptance and rejection apply only where ground truth is defensible. Judgment remains over outcomes, ε_k values, material disparities, repairability, and rights floors, but prospective definitions, reasons, separate scrutiny, and an audit trail constrain it. “Sludge” is therefore assigned through stated rules and evidence rather than inferred intent. The classification remains normative because those rules require contestable judgments about outcomes, margins, disparities, repairability, and rights floors; it is not an allegation about an official's motive. BRFF does not replace fiscal or cost-effectiveness analysis. Cost, administrative capacity, and implementation time may delimit the feasible alternative set and help choose among designs that already satisfy the criteria, but favorable net benefits cannot cure absent authority, failed functional fit, or a non-compensable floor.

Safeguards must work in practice. Explanation cannot legitimize an ineffective or dominated step, and an alternative channel is not protective if it is undiscoverable, inaccessible, stigmatizing, or too slow to prevent irreversible harm. Human review, correction, and restoration require use, success, time, and cost measures. Stronger precaution may answer severe target harm but cannot erase a rights floor. A high-scrutiny manual fallback may create queues, document demands, staff discretion, and unequal recovery; it therefore becomes a separate evaluation unit rather than inheriting the displaced control's status.

BRFF remains a conceptual synthesis and not a validated scale, causal model, or automated rule; inter-rater reliability is unknown. Evidence is asymmetric across domains: benefit studies often omit fraud outcomes, while security studies omit socioeconomic or disability effects. Early audits may therefore produce many evidence-uncertain controls, which is useful only if institutions resolve rather than warehouse uncertainty. Ground truth, observation windows, margins, rights floors, and residual-risk allocation remain contestable, and payment analogues may not transfer to services whose users cannot exit.

Implementation also depends on institutional capacity and incentives. Fragmented data ownership, limited evaluation budgets, procurement constraints, and the political cost of withdrawing visible controls may delay testing or redesign. BRFF does not solve those conditions; named ownership, independent review, public reasons, deadlines, and escalation make their effects on action visible rather than treating them as evidence of justification.

Core–shell separation is analytical before it is technical. Legacy interfaces may be hardcoded into validation, identity, or scheduling systems, making a lower-burden redesign costly or slow (Hegemann and Ritz, 2026; Peeters and Widlak, 2018). Engineering scope, migration cost, interim safeguards, and a dated modularization path should therefore enter feasibility and transition planning, but technical debt cannot convert a failing design into a justified one. Empirical work should test task-resource interactions, ordeal selection, risk tiering, review-induced drift, inter-rater agreement, audit cost, decision stability, and whether unknown findings close by their deadlines.

8 Conclusion

Administrative friction is neither justified by a protective label nor unjustified merely because it imposes cost. BRFF treats the defensible conclusion as a revisable state for a specified friction, risk, stage, group, and period. Functional fit tests incremental protection. Comparative fit enters Candidate Found—Pending G3(a|f) when an alternative meets every prespecified material protection margin. G3(a|f) then determines whether the candidate can finalize Gate 2, whereas G3(f) separately evaluates the current design for status assignment. Completed behavioral assessments remain trivalent, and the life cycle asks whether the evidence, safeguards, and feasible alternatives continue to support the resulting state.

The framework does not replace legal judgment, supply universal thresholds, or claim validation from illustrative cases. Its contribution is the evidence-to-status transition: purpose cannot substitute for performance, unknown cannot become approval, and a positive status cannot persist without renewal. Replacement designs, including manual fallbacks, must earn status as new evaluation units. Justified friction is therefore a monitored conclusion that a design may earn, lose, and regain and not a permanent property of the design.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. The author used the OpenAI Codex desktop application (version 26.707.51957, build 5175; GPT-5 model; OpenAI, https://openai.com/codex/; accessed July 13, 2026) solely for English-language grammatical correction. The author reviewed the final text and accepts full responsibility for the manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence, and reasonable efforts have been made to ensure accuracy, including review by the authors, wherever possible. If you identify any issues, please contact us.

Publisher's note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Sandro Serpa, University of the Azores, Portugal

Reviewed by: Gabriel Silva-Atencio, Universidad Latinoamericana de Ciencia y Tecnología (ULACIT), Costa Rica

Akira Nagamatsu, Tohoku University, Japan