Solutions
Between 2005 and 2019, the Dutch childcare-benefits system flagged families through risk selection that used nationality, recovered benefits all-or-nothing, and served decisions its own reviewers could not explain. Tens of thousands of families were harmed; the 2020 parliamentary inquiry found a rule-of-law failure. The KYE™ Public Benefits & Citizen Rights Authority Profile™ from KYE Protocol™ binds every benefits action to the Rights-Bounded Authority Stack™ — so no policy rule, risk score or agent ever outranks the rights above it.
The worked failure
The Toeslagenaffaire was not a model accuracy problem. Every layer that should have bound the system — rights, statute, proportionality, explanation, appeal — was silently overridden by the layers below it. Four documented failures, stated factually and with respect for the families who carried them:
The risk-classification model processed (dual) nationality as an input. The Dutch Data Protection Authority found the processing unlawful and discriminatory in its 2020 investigation. a policy rule overrode fundamental rights
Families received stop-and-repay decisions that caseworkers and courts could not reconstruct the reasons for. Human review existed on paper; explanation did not. decision without notice or reasons
A formal error was treated like fraud: full repayment of years of support, enforced first, contested after — bankrupting households before any appeal was heard. consequence before contestability
Roughly tens of thousands of families were affected. Each file looked procedurally routine; the aggregate pattern carried the signal for years. The parliamentary inquiry, Unprecedented Injustice (2020), concluded fundamental rule-of-law principles had been violated. no aggregate harm monitor
The doctrine
Every benefits action a system or agent proposes is admitted — or refused — against a fixed ordering of authority. Your policy rules and models live at layer 6. They can narrow what the layers above permit. They can never widen it.
The invariant: no lower layer overrides a higher layer. A risk score that a right forbids is refused at the action boundary — whatever the score says. That single mechanical rule is what the scandal lacked.
Ungoverned vs governed
The same five failure modes, run twice: once as they executed in an ungoverned stack, once against a stack where KYE Protocol™ sits at the action boundary. Each governed refusal is a named rule with its own reason code, evidenced and replayable.
The governed action set
The profile binds 19 benefits-specific action classes — from flagging a risk signal to compensating a citizen — plus four reused data and legal classes for collecting, disclosing, exporting and producing case data. Every class carries its reversibility, its consequence tier, and its default human-oversight mode; the irreversible ones wait for two named people, some with legal review.
A risk signal is a lead, not a finding. It authorises exactly one thing: a named official opening a review with case-specific grounds recorded. per-transition authority
An honest mistake triggers correction and proportionate adjustment. A fraud label needs the highest evidence bar and legal review before it attaches. two-person with legal
Suspension, termination, repayment, offset, prosecution referral — admissible only from an established error or fraud state, with proportionality recorded and the challenge window clear. contestability first
History is written once and kept forever; a correction is a new, linked decision — with reinstatement and compensation where due. Evidence finality is not decision irreversibility. immutable history · linked remedy
For your audit and legal teams the payoff is concrete: reconstructing the full legal basis of any decision — who authorised it, at which state, under which layer — goes from months of file archaeology to minutes of replay against the sealed Evidence Pack™, and it cuts exam-preparation for an oversight review from weeks to days.
Who this is for — and what it honestly is
One authority spine, three wedges — and an honest boundary around what KYE™ does and does not claim.
Tax, welfare and family-benefit agencies deploying AI-assisted casework: grant machine speed to the routine, and make the consequential wait for layered, named authority you can defend to a parliament.
“Our casework agent cannot exceed its authority, and here is the replayable proof” is the sentence that survives procurement, DPIA review and the ombudsman’s first letter.
Ombudsmen, DPAs, courts and inquiries get what the Toeslagenaffaire archaeology never had: the decision-state chain, the authority basis per layer, and the aggregate harm signals — replayable on demand.
The honest boundary: KYE Protocol™ governs whether a benefits action may proceed — under which named authority, at which decision state, with contestability intact — and proves that basis. It does not adjudicate Dutch or EU law, does not replace the court or the ombudsman, and claims conformance only with frameworks it has actually mapped. The scandal is cited here as a worked failure mode, never as a claim that any protocol would have undone a specific historical injustice. Start with the authority diagram of your own benefits stack, then a scoped pilot on your highest-consequence action class.