PS-CLS-189 · r3
CLASSIFICATION
OBSERVED
ENGAGED
CONTEXT NOT OBSERVABLE
The safe behaviour and the usable behaviour differ, and nothing available says which situation this is.
01 DEFINITION
Condition in which the correct behaviour of a system depends on a property of its surroundings that it has no way to determine — who else can reach it, who else can see it — so one fixed way of behaving is applied to situations that call for opposite ones.
02 CONDITIONS
UNCERTAINTY
MISSING
The property that decides the correct behaviour is not observable from inside the system.
TIME PRESSURE
LOW
There is no urgency; the exposure lasts exactly as long as the wrong assumption does.
ERROR ASYMMETRY
ASYMMETRIC
Treating a private situation as shared and a shared one as private carry very different costs.
OPERATOR STATE
CONCURRENT
The person is doing something else in a place they did not choose for this purpose.
03 WHERE IT APPEARS
MEDICALA workstation on a ward may be attended by one person or standing open in a corridor, and the software cannot tell.
FINANCEA session may be on a personal device or a machine in a branch that several people use in a day.
RETAILA terminal is worked by staff and stands where customers are, and both are true at the same time.
EDUCATIONShared machines carry personal sessions, and whether anyone else is present is not something the session can establish.
PUBLIC SERVICECounters and kiosks hold sessions belonging to individuals in rooms belonging to everyone.
INDUSTRIALA panel on a floor is used by whoever is on shift, and the identity that opened it may not be the one still standing there.
04 WHAT AEON WORKED THROUGH HERE
The same session could be a machine belonging to one person or one standing in a room others pass through, and nothing reachable distinguished them. Behaving as though it were shared made the ordinary case tedious; behaving as though it were private made the unusual one costly. The work went into which protections could be made cheap enough to apply always, so that fewer of them depended on knowing.
The question it keeps returning to is who should be asked — putting the question to the person moves a safety decision onto someone with every reason to answer for convenience, and not asking leaves the system deciding on their behalf without telling them it did.