Not Built to See

An access badge does not know when someone has stopped meaning well. It only knows whether the number on the card still matches a number in a database, which is, if you read this issue's piece on insider threats, most of what "trust" has ever meant inside an organization: a proxy, not a person.

That gap, between the thing an institution checks and the thing it's actually trying to know, turns out to be what a surprising number of this issue's writers are circling, from very different rooms. One contributor, building assistive AI, points out that every tool before this one required a diagnosis first, "a price of admission," before anyone would help you think. Another found an age cutoff on a security training program and asked, in public, what happens to the woman above forty who quietly closes the tab; 8,591 people had apparently been waiting for someone to ask. A third watches applicant-tracking systems filter out capable people because their last job title used the wrong word. Two more write from opposite corners, a boardroom and a classroom, and both describe a version of the same failure: someone still fully capable while the system reads her as less than she is, because it was never built to see the part that matters.

None of these writers agree on the fix. One thinks the gate should come down. Another, writing about that same kind of access two pieces later, thinks the more common failure is a login nobody thought to revoke: the "highest-risk window" between the day someone decides to leave and the day their access is actually cut. Both are right, which is the uncomfortable part.

What this issue doesn't offer is a clean answer to which is which. What it offers, story after story, is a group of women looking hard at the thing standing at the door: a diagnosis, a title, an age, a badge, a composed voice in a meeting. They refuse to mistake it for the person on either side of it.