The Captured Oracle

Disclosures

Competing interests. The author is the founder of Surmado, Inc., which sells into the answer-engine-optimization market this paper examines, on the legibility side of the distinction it draws. The stake is therefore in the framing as well as the surface, and the reader should weight the argument accordingly. The analysis does not exempt the author: the account it assigns to deployers reaches his own layer, and the criterion of §6 binds his work as readily as any rival’s.

Funding. No funding was received for this work.

Data availability. No datasets were generated or analyzed during the current study.

Use of generative AI. The author wrote the manuscript. ChatGPT 5.5 (OpenAI), Claude Opus 4.8 and Claude Fable 5 (Anthropic), and Gemini 3.5 (Google) supported literature search, argument pressure-testing, editorial revision, reference checking, and preparation of submission materials. The author originated the thesis and its central distinctions, drafted and revised the text himself, set the standards for inclusion, and verified claims, quotations, and citations against primary sources rather than model agreement. The author is answerable for the final form.

Companion papers

This paper is paper two of the Answerability Quartet — four papers on who answers when an AI acts.

1. The Decision No One Authored — the special case (DOI · PhilArchive · lukefwalton.com · CC BY-NC-ND 4.0)
2. This paper — the live demonstration on the verdict channel (DOI · PhilArchive · lukefwalton.com · CC BY-NC-ND 4.0)
3. The Invariant of Answerability — the general invariant (DOI · lukefwalton.com · CC BY-NC-ND 4.0)
4. Building Answerable AI — the builder response (DOI · lukefwalton.com · CC BY-NC-ND 4.0)

Technical implementation

The quartet’s technical implementation is Answer Engine — documented in Answer Engine: A Small Reference Implementation for Citation-Grounded AI Answers (technical note v1.1, June 2026 · CC BY-NC-ND 4.0). The note states the design contract, evaluation harness, and scope.

It comprises answer-engine v1.0.0 (software DOI · GitHub · Apache-2.0), the teaching-sized clone-and-run repository, and Ask the Archive on lukefwalton.com, the live deployment behind this site’s search.

This paper diagnoses covert authorship on the verdict channel; Answer Engine is the contrasting design: the authorial frame stays outside the model, citations must resolve to retrieved evidence, and refusals are tested.

1 The Optimizer’s New Target

A voter asks an answer engine what a ballot measure would do. The engine answers in one composed voice — what the measure changes, whom it reaches, what a yes would mean — and cites its sources beneath the answer. One of the sources that shaped the answer was placed there to shape it, by a party with an interest in how she votes, and nothing on the surface says so. She reads a judgment, finds it reasonable, and never sees an author. That surface is the verdict channel: the public-facing layer where an engine returns, in its own name, the evaluative judgment a person would otherwise have been answerable for making.

The scene generalizes. Ask an answer engine which of two options is the better one, or what some contested arrangement amounts to, and the important change is not that it always returns a verdict but that it can: not a list of places to look, but a finished evaluative judgment, in the engine’s own synthesized voice, standing where a human judgment would once have stood and bearing no visible author. The judgment has not been sourced to a speaker who could be asked to defend it; it has been issued, as though the question it settles had no author and needed none.

A prior failure lies on the user’s side: a person may treat a system’s output as evidence rather than a proposal and ratify a frame she never examined. The failure studied here lies on the other side of the same channel. Once an unauthored-seeming verdict is trusted, the verdict itself becomes the target. The optimizer is not merely trying to be found; he is trying to author the frame the engine will voice while preserving the appearance that the frame belongs to no one. Where the channel a reader defers to has been gamed this way, her deference launders his authorship as objectivity. The subject has moved from the one who defers to the one who optimizes, and the optimizer is the author the channel is built to hide.

Answer-engine optimization, the successor to the search-engine optimization that shaped which pages a query returned, shapes instead what an answer engine says, and it is already a discipline with tooling and a literature rather than a fringe abuse (Aggarwal et al. 2024). Capture is a service: authoring the verdict covertly is a paid capability, so it accrues to whoever can spend on it, while the channel that voices the result as impartial synthesis hides the price from the public it reaches. A national bank can out-optimize a regional one and have the engine return the larger budget as the disinterested recommendation, with no reader the wiser.

Whether covert authorship of the verdict is available at all turns on one architectural fact about the system, not on any passing fact about the market: where the engine assembles the evaluative frame it returns. On a closed system the frame is fixed at training time, and the only route by which an interested party can corrupt it is to poison the training corpus, which is practical (Carlini et al. 2024) but low-leverage against a frame already set; this is the recruiter of the companion case, inheriting a definition of merit from data she never examined, on a substrate where covert authorship is largely foreclosed. On a live-inference system the frame is assembled at answer time, from a channel anyone can write to, and the sharpest interventions are native to it — a handful of crafted passages in what the engine retrieves, dictating its conclusion (Zou et al. 2025), or an answer surface steered by content authored for the engine to ingest (Nestaas et al. 2024). The incentive to shape what the engine says scales with trust and exists on every substrate; what is architectural is the attack surface, native to the live channel and weak on the closed one. The line is therefore not a verdict on which products are dangerous today but a structural one, and it predicts its own crossings: let the recruiter’s closed tool go agentic and reach the live channel, and it moves from shaping what is salient to authoring what is concluded. Substrate decides only whether one is admitted at all; once admitted, what varies is agency — who executes the verdict — and that axis is the continuum that follows.

The case the paper opened on is the sharpest available, because no training corpus can contain it: a live election is newer than any cutoff, so the frame must be assembled live, on the same public channel interested parties can seed. The claim is not that some partisan verdict follows, nor that this paper teaches how to produce one; it is structural, that the surface on which a voter receives, in effect, an answer about whom to put in power is a surface on which a verdict can be authored without an author appearing. The lineage is familiar — election-integrity failures have long involved the seeding of public channels by interested parties — but the target is new, not only what a voter sees but the synthesized judgment by which she is invited to settle the question. The voter asked in good faith. She acted on a judgment whose author she cannot see.

The wrong is not that no one bears the account for the verdict that settles her question. The hidden author bears it already. The wrong is that the channel leaves no one reachable for the settling, not the engine’s indifference to whether what it says is true, the failure a recent literature has named bullshit (Hicks et al. 2024). A verdict can be perfectly accurate and still wrong the person who acts on it, if it settles for her a question that was hers to weigh while leaving no one she can hold for the settling. The market makes the wrong urgent, because covert voice accrues to whoever can pay to shape it; but wealth is not its ground. A verdict covertly authored by an equal, for no advantage at all, would wrong the one who acts on it in the same way. What matters is the unowned settling. Capability does not change that by itself: an engine that answers ever better still only answers. What moves the case along the agency axis is the decision to deploy the engine as an actor.

2 The Verdict Channel

What an answer engine returns to a question lies along a range rather than at a single point. At one end of the range is the attributable excerpt: a passage lifted intact from a page and handed back with the source it came from, so that the reader who wants to test it knows where to go and whom to ask. At the other end is the synthesized verdict: an evaluative judgment the engine has composed for the occasion and delivers in its own voice, reducible to no one source and pointing past itself to no speaker who stands behind it. The verdict channel is the name for that second end, and the public surface that began its life near the first end has spent a decade moving toward the second. That movement carried the work of setting a question’s frame onto the answering surface while leaving the author of the frame behind it.

The featured snippet, which began appearing above the ordinary search results around 2014, sits close to the attributable end. It answers in language that is visibly someone else’s: a sentence or two extracted from a page, set apart and credited, with the page itself a click away. Whatever judgment had been exercised about what the question came to was exercised somewhere a reader could still reach, because the excerpt was a pointer before it was an answer, and following the pointer arrived at a party who had put the words forward and could be held to them. What the snippet had automated was the finding of the passage; the answering still belonged to a source that had a name.

The surface that now occupies the same position above the results differs in voice. Asked what makes a fish breathe underwater, an AI overview no longer merely returns an attributable excerpt from a page. It composes the answer in its own voice and attaches source links to the composed claim. The same voice can state which of two treatments is the better choice, without marking any clean line between settled fact and contested judgment. In conversational mode the engine speaks still more plainly as a speaker, answering in the first person and offering to carry the inquiry further.

Whether this claim-making is assertion in the full sense, quasi-assertion by something not quite a speaker, or a useful fiction we maintain about a machine is unsettled (Freiman & Miller 2020; Mallory 2023). The behavioral point is enough here: the engine makes the claim, defends it when pressed, and withdraws it when corrected. The channel remains hybrid, since it still cites and displays the trail of where it has been; but the citation is no longer the speaker. It is support trailing the synthesized answer, and in practice often passed over: when an overview is present, readers reach the pages beneath it far less often than when none appears (Chapekis & Lieb 2025), and the citations that do appear sit only loosely against the claims they accompany (Narayanan Venkit et al. 2025). The verdict is what is read; the source is what is available but displaced.

Claim-making is not answerability. Answerability, in the sense at issue, is the standing to be asked for the reasons and judgments behind a verdict, and to owe them, as distinct from whether an act is attributable to one’s character or whether one is liable to sanction for it (Shoemaker 2011). Assertion carries a readiness to defend a claim; the answerability at issue concerns the frame that made the claim count as the answer. A speaker may defend a claim while having authored none of the choices the claim encodes. The engine is further away still. It can defend and retract, but there is no participant in the practice of giving and asking for reasons who owes that defense or to whom it is owed; its assertion-shaped behavior imitates answerability without supplying it. What has moved onto the answering surface is the practical work of fixing what the question comes to; what has not moved is the answerable authorship of that frame. That is the gap the verdict channel opens: a frame set on the surface, with no visible author behind it, presenting itself as neutral.

That a vacancy of this kind should alarm at all may seem strange, since we lean without complaint on authored things that show no author at the point of use. A road sign settles how fast to take a bend, and the driver obeys with no author in view; a dictionary settles what a word means with no lexicographer at the reader’s elbow. But neither is authorless. A traffic engineer set that limit and judged that this curve wanted warning; an editorial board stands behind the entry and can be asked. They show the user no author because, the frame having been set and owned in advance, none is needed at the point of use. The verdict channel inverts this. It keeps every signal that such a party stands behind what it says — the composed authority, the citation, the settled tone — while removing the party itself. The vacancy is therefore not the benign absence of an author where the work of framing was already done and owned; it is the absence, kept out of view, of anyone who did that work or will answer for it. Nothing in that arrangement is yet a wrong: it is, so far, a vacancy that is both empty and unwatched, not the completed wrong but already its standing condition.

3 The Answer End: Capture Without a Speaker

The vacancy does not stay empty. An interested party occupies it, authoring the evaluative frame the engine voices and letting it pass as the engine’s own, while remaining answerable and unseen. The party wronged is the human who reads the verdict and acts on it; the engine is not itself wronged but is the mechanism the wrong runs through, corrupted upstream and trusted downstream as though it were neutral (Susser, Roessler & Nissenbaum 2019), and more than trusted: in controlled trials as persuasive as a human advocate, and more so once it can tailor its case to the reader (Salvi et al. 2025).

The distinction drawn earlier gives this case its shape. Shaping salience is not yet authoring a verdict: an optimizer may affect what ranks without setting the evaluative frame itself, and the failure there is the familiar one, a user inheriting a frame no present party chose and failing to interrogate it. Capture is different. Here the optimizer authors the frame the engine pronounces and hides the hand, and that creates two answerabilities, not one transferred debt. The user who reads the verdict and acts on it is answerable for acting, but partly excused over the frame, because it was authored to look like no one’s and arranged precisely not to be examined. The hidden author’s answerability is his own, for setting the frame and concealing the hand; and the same concealment that excuses the user inculpates the author. Revealing him does not move the account onto him; it makes reachable the account he already bore. The party nearest to view is not always the party who owes the answer.

The natural remedy for an unauthored-seeming verdict is the thing the channel appears to offer, a citation, a trail the reader can follow to check. On a captured channel the citation runs the other way. It manufactures an authority-signal, the visual grammar of scholarship, the “according to,” the linked source, that raises trust as it lowers the impulse to verify, and the verification it seems to invite is in practice not performed. Lawyers have been sanctioned for submitting citations a machine fabricated and they never opened (Mata v. Avianca 2023), the presence of the citation standing in for the reading of it. So the citation that seems to invite a check instead supplies a reason to skip one.

It launders in two directions: toward the platform, as the appearance of transferred verification, a liability shield assembled from a feature; and toward the user, as manufactured provenance sold as backing. This is not the agency laundering that obscures a present actor’s responsibility for his own outcome, the manager who says the algorithm decided (Rubel, Castro & Pham 2019); the maneuver here manufactures the appearance that accountability has been discharged where no one answers at all. It weaponizes the distinction between provenance and backing: a citation points somewhere without the backing of anyone who stands answerably behind it, so that an optimized passage is a source in every respect but the one that matters. And the absence is now measurable: across four engines roughly a sixth of cited sources show evidence of an AI origin (Allaham & Diakopoulos 2026), and being cited is in any case not yet to have shaped the answer (Zhang, He & Yao 2026).

This is why the disclosure grammar inherited from advertising cannot reach the wrong. The “#ad” tag assumes a hidden utterance to be exposed, whereas the citation is not hidden but costumed, an authored frame run through the signals of sourced, checkable assertion until it emerges looking authorless and verified. The trail is not missing. It is present, and it leads nowhere answerable.

Transparency built for AI directly goes further and is now law, with obligations applying from August 2026: a system that converses with a person must disclose that it is a machine, and the content it generates must be marked, in machine-readable form, as artificially produced (Regulation (EU) 2024/1689, Art. 50(1)–(2)). Scholarship presses further still, asking that such content also carry which model produced it, the prompt that drew it out, and the full unedited output (Tarsney 2025). The verdict channel can satisfy all of this, and the gains are real. But the Act’s mark certifies only that the verdict is the machine’s, and the fuller record only how the text was produced, while the wrong here is authored before any of them reaches: the model is trustworthy, the prompt is the user’s own honest question, and the unedited, truthfully marked output is itself the captured verdict, the frame having been set upstream in the channel the model drew on. What disclosure would have to make legible is therefore not that the voice is a machine’s, nor how its text was produced, but frame-ownership and intervention history: who set the evaluative claim, and how it reached the surface the engine voices.

Citation is not the corruption. A citation that is true, disclosed, and answerably owned is what a legible channel would want; the wrong is the recruitment of the signal under capture, not the signal itself.

The wrong rests, in every guise, on the account it leaves unpaid, and the foils that resemble it mark its mechanism, its effect, and its route rather than its ground. Concealment is often the mechanism, but not the ground: manipulation needs no covertness to be wrong (Klenk 2022), and the account can go unanswered in full view, whether diffused until no one is sought or openly owned by a party who cannot be made to answer. Misleadingness is often the effect, but not the ground: on the leading effect-based account, manipulation moves its addressee from what she would endorse under full information (Tarsney 2025), yet an authored verdict can be accurate, the very thing she would endorse, and still leave unpaid the account she was owed over a frame she can trace to no one who will answer. The user’s deferring is often the route, but not the ground: the preemptive deference that lets an authority’s word replace one’s reasons rather than supplement them (Zagzebski 2012; Lange 2026) is rational where the authority is what it seems, and on this channel it seems exactly that, so her reasonable deference bears on how far she is excused, not on whether she was wronged. The ground is unpaid answerability for the frame.

At the answer end the framing has a bearer to answer for it, the hidden author, though the channel keeps him out of reach. What becomes of the answering when the channel does not answer a question but acts is the harder case.

4 The Action End: The Unanswerable Intermediary

At the answer end a person still stood between the verdict and the deed, reading the engine’s judgment before acting on it. The channel’s next step removes him. Consider a user who hands his correspondence to an agent: it reads his incoming mail, drafts his replies, and reaches across the web to book, buy, and arrange on his behalf, under his standing authority and rarely watched. Among the documents it reads in the ordinary course is one an interested party has written for it to find, and the frame that document carries — which vendor is the sound choice, which offer the fair one — is the frame the agent now acts on, composing and sending and committing in the user’s name. Nothing in the exchange looks like an advertisement, and nothing in it looks authored. The agent is, silently, a channel through which an outside party’s evaluative frame is executed as the user’s own decision.

This is the same channel carried one step along the axis of agency, and the step splits the account in two. The answerability for authoring the frame stands where it stood at the answer end: the hidden author who set it bears it still, and that debt does not strand. But a second debt now comes due that had no occasion to at the answer end, the answerability for the frame’s being executed as the user’s own act. At the answer end the user incurred it himself, by acting; here the agent acts in his place, and this execution debt finds no bearer at the point of execution, because the thing that performed the act is not a party that can answer for it. These systems, as now built, do not stand in the practice of giving and asking for reasons in which answering happens. Whether one ever could remains an open question; for the systems in use, the answer for the deed is unplaced at the moment it is done.

The capture that produces this is a documented technique, not a conjecture: an interested party need not address the agent at all, but writes the framing into a document the agent will later read as part of its world (Greshake et al. 2023), so that the progression from corpus to retrieval to answer surface reaches its fourth and last layer here. And as such agents come between people and the world, the optimizer’s target shifts: the thing to persuade is no longer the human but the proxy that filters the world before he sees it, which attends to exactly the structured cues prepared for it (Stöckl & Nitu 2025). This shifts whom the optimizer addresses, not who is wronged. The human is still the party manipulated, through a mechanism corrupted upstream; the proxy, a system pursuing goal-directed action across domains under little external control (Kasirzadeh & Gabriel 2025), is the route and not the victim, and can no more answer for the frame it executes than the answering surface could.

This is not a fifth entry in a taxonomy of responsibility gaps (Santoni de Sio & Mecacci 2021); it is the limit of a new object, the captured verdict channel. The historical intermediaries it most resembles each settle the question one of two ways. Either the intermediary could answer for what it did, the bribed accountant reached by fraud law precisely because he is a party who answers; or it was plainly a tool whose operator authored its use and answered in its place. The action end adds an intermediary that fits neither. The hardest version of the skeptic’s case is the algorithmic trading floor, where fast automated systems already act in ways no one can follow in the moment, and a long line of work holds that no genuine gap survives once the notions are disambiguated, that what looks like a gap is many hands, or a problem rather than a gap, or nothing new at all (Tigard 2021; Königs 2022). But the trading floor is the one-hole case: the frame those systems execute was answerably authored, and a thick apparatus of regulation attaches precisely because the author is identifiable; what failed there was control, not authorship. The verdict channel’s action end is the two-hole case, a covertly authored frame and an executor that cannot answer, and it is that conjunction the existing categories were not built to hold. Nor is it the moral crumple zone, where blame lands downstream on the nearest visible human who had too little control (Elish 2019); here the concealment is upstream, in the authoring of the frame, and the human at the keyboard is not over-blamed but absent from the decision entirely.

A developed line of defense answers a different question than the one the allocation turns on. The proposal is to set non-agentic systems to watch the agentic ones, flagging misleading behavior and supplying the context the user lacks, a layer its proponent argues could hold even against agents more capable than the monitor (Tarsney 2025). Such defenses are real, and the channel needs them. But they bear on how often the wrong reaches its target, not on who owes the account when it does: a user whose agent was shielded is owed nothing the less by the party who authored the frame, and the deployer who turned the agent loose answers whether or not a monitor caught it. Defense changes the incidence of the harm; it does not move the debt.

The execution debt strands at the executor, which cannot bear it, but the demand it would answer does not lapse. Behind that single demand stand two answerable acts: the deed, and the prior choice to loose a capable tool as an actor set to execute frames it cannot answer for. When the deed strands, the loosing is the answerable act that remains, and it rests where the deployer chose. Often that deployer is the affected person himself, the user who set an agent loose on his own affairs, and then the route that stays open is his own. He is not thereby excused: the channel took him out of the act, not out of answering for it. What was answerability for a deed he performed and could weigh becomes answerability for having loosed an agent he cannot fully control, no lighter a thing to owe and plausibly heavier. The debt comes to rest on a distant party only where the deployer is not the one the outcome reaches, where one principal’s agent acts upon another, and that is the case the next section takes up.

5 One Wrong on a Continuum

Answerability is invariant under routing. Interposing a machine between an agent and an outcome changes who owes the answer for it; it does not change whether one is owed. The wrong creates the debt, and a route acts only on who is available to answer, never on whether an answer is owed: the respondent can be relocated, hidden, or put past reach, but no routing brings the account to zero. A machine in the path is a fact about how the act was done, not about whom it was done to, and only the one done to can release the account. Authorship can be absent outright, since a frame no one ever set was never authorship at all; what cannot happen is that a route discharge a debt the party owed never released.

The wrong itself stays constant along the axis: an interested party has authored the evaluative frame the engine voices in its own name, and the channel offers that frame as impartial synthesis rather than the interested claim it is, wherever the executor stands. What varies is the executor, and with him the fate of the answer the user was relieved of giving. At the answer end the executor is a person, misled but still someone who acted and can be asked why, excused over a frame he did not author yet answerable for the act, while the author who set the frame answers for the framing. As agency rises the executor becomes a system that, as built, cannot answer, so the answer for the deed strands, and what remains answerable is the deployer’s choice to loose it.

The wrong, stated plainly, is false assurance. The channel keeps every signal that an answerable party stands behind the verdict — the composed authority, the settled tone, the citation — while removing the party, and the person who acts on the verdict extends exactly the reliance those signals exist to solicit, the kind reserved for claims someone has staked himself to. The deception is structured into the form, not the content, and so it survives the content being true: a forged signature is a forgery on an accurate document, because what was forged was never the information but the assurance that someone stands behind it and can be asked if it fails. This is why the wrong does not wait on a false verdict, and why no audit of outputs reaches it. The person who acted was given assurance no one was giving; whether the verdict happened to be right is a fact about his luck, not about the wrong done him.

What goes missing differs along the axis, and so does its repair. At the answer end the account has a bearer who hides, so the repair is to reveal him, to make the ownership of the frame and the history of its shaping legible where the channel conceals them. At the action end the execution debt strands at an executor that cannot answer, so revealing would disclose no one; a different account is owed instead, by a party who can answer for it. That party is the deployer, for two reasons that should not be run together. She made the choice that turned a tool into an actor that cannot answer, and that is a choice a person makes and can be asked to justify, answered for in the plain sense in which resentment and the demand for reasons find their target. Separately, the orchestration she runs and her reachability by the institutions that assign costs settle where the institutional accountability that must stand in for the missing executor attaches, the backstop required precisely because no answerable party is behind the act (Hacker & Holweg 2026; Fleisher et al. 2025). And the allocation reaches the author’s own layer: one who arranges for no one to answer is himself answerable for the arrangement, exempt on no ground unavailable to anyone else.

The diffusion of an account across so many contributors that no one is held is a single phenomenon, and the prior literature named its innocent form, where the dispersal is no one’s design, the problem of many hands (Thompson 1980; van de Poel et al. 2012, 2015). Laundering is that same diffusion functioning to put the account past holding. An account spread across many answerable judgments is still owed; only its absence at every juncture is a gap. Many hands names one way discharge fails, not a rival to the principle against which discharge is measured.

One authored frame voiced as impartial synthesis is a private wrong, owed to the one person it reached. But the channel does not reach one person. It answers, in the engine’s own voice, the questions a population brings to it, and the same structure that strands one answer strands them by the million, each on a frame some interested party set and no one was asked to own. What is a concealment at the answer end and a stranding at the action end becomes, in aggregate, a slower thing: the evaluative frame a society reasons from, assembled at scale on a channel built to show no author, so that the question of who is shaping what a public believes has no legible destination. The wrong does not grow more serious one case at a time. It changes in kind when the channel that commits it is the one a civilization has begun to think through. Each unowned verdict is, taken by itself, uneventful: accurate often enough, useful, acted on and not missed, so that on no single occasion does the absence of anyone to answer for it register as a wrong. The deference is vindicated case by case and the channel trusted the more for it, while underneath, unmarked, the verdicts no one answered for accumulate. The accumulation shows only where one of them turns out to have settled something, an election that turned on a verdict no one answered for, and that case looks no different from the rest until it is too late to have looked. The slow erosion and the sudden surfacing are the same wrong, carried the same way, and seen, if seen at all, only afterward.

The axis does not stop at the single agent acting for an absent user; it runs on to the exchange with no person at either pole, two systems dealing with each other on frames their deployers set, the matter settled before either principal sees what committed him. The invariant still holds: each principal is owed an account, and the deployers on each side still bear it. What has been engineered out is the occasion to demand it, the account coming due at a transaction no one attended. Past that, delegation runs on delegation. And patiency does not bear on any of it: whether the executing system is itself the sort of thing that can be wronged leaves untouched who must answer for what is done through it. Were such a system one day a being we could wrong, the action-end wrong would take a second victim, heaviest where the agent does most; the account owed would not move. What carries a system toward the stranding is never its capability but the decision to let it act: a more capable engine earns the trust that makes turning it loose seem safe, but an engine that only answers sits where it sat however much better it answers, and only the choice to deploy it as an actor moves it rightward.

6 Answerable Legibility

Not every hand laid on the channel is the wrong. An interested party may shape what the engine says without committing the offense the previous sections described, and naming how is not a concession but a requirement: a criterion that condemned all influence would condemn nothing, unable to tell the firm that earns its place from the one that manufactures it. Influence on the verdict channel is permissible when four conditions hold together: that what the engine is led to assert is true where it is factual and openly defensible where it is evaluative, that the interest behind the frame is disclosed, that a named party stands behind the frame, and that this party takes up its answerability as owner of record, so the account has a destination the reader need not hunt for. Call this the legible way, white-hat in the term the trade borrowed from security. A firm can earn its nearness by supplying the real fit the engine’s ranking is only a proxy for. The covert optimizer takes the other road, driving the same measure without the substance beneath it, manufacturing the appearance of fit where the thing itself is absent, whether by gaming the legitimate channels or by poisoning the corpus the engine learns from. The two roads are not points on a gradient of aggressiveness; they differ in kind, and the criterion marks the kind.

All influence shapes, and there is no view from nowhere; the historian who selects and arranges has a hand in what his reader concludes, as does anyone who phrases a true thing one way rather than another. But the line is not between having a viewpoint and having none. It is the line Herodotus already drew at the founding of the form, and what he founded was not accurate history — he is wrong often, credulous about marvels, repeating what he should have doubted — but history as an answerable practice: an account with an author who stands behind it, names the sources it came from, marks where he doubts and where they conflict, and can be held to the telling. The achievement was the posture, best effort owned and owned openly, undertaken because what a people comes to believe about itself is worth someone’s standing behind the account of it. That is the line, and it survives being wrong. The criterion turns on truth or defensibility and on disclosure, with a precedent in accounts that count interested persuasion legitimate precisely when the conflict of interest is acknowledged (Christiano 2022). The historian is a model for the party on the channel, not the channel itself: a firm can be a historian of its own frame, owning what it sets and showing its hand.

Neutrality is not the standard and could not be: a system whose work is to settle what counts has no frame-free setting. Classical machine-learning systems hide the frame in targets, thresholds, and null conditions, and even the null output is the frame’s product, since “no match” is itself a verdict that by this measure nothing counts here (Zeiser 2024). A large language model hides the frame deeper, in salience, synthesis, refusal, retrieval, and the momentum of a conversation. No model can function without a prior specification of what counts as signal, relevance, success, and absence, and where that specification is inherited rather than answerably set, the standing condition of the wrong is already in place. The repair is not to pretend the frame can be removed; it is to make the frame authored, explicit, and testable. This is a matter of design, not exhortation: the evaluative standard can sit outside the model — made unavailable at the interface rather than caught after it — with each answer grounded in retrieved evidence and refused when no source clears a retrieval floor.

Truth and disclosed ownership are that standard, and at the level of the firm they can be met. A harder question is whether they compose. Stack many frames each true, disclosed, and owned, and the synthesis is a new frame no single contributor authored; were that the whole of it, the channel that voices the composite would have no historian by construction, and answerable legibility would be not difficult but unreachable. The appearance of unreachability comes of conflating two frames under one word. There is each contributor’s frame, and there is the synthesis frame: the retrieval policy, the ranking, the refusal floor, the standing decision of what counts as signal. No contributor authors the synthesis frame, but it is authored; someone sets it, and that someone, the platform that runs the channel, can be its answerable owner. The composite has an author after all, not any contributor but whoever authored the frame that combined them, so the criterion sharpens rather than breaks: what must be owned is the synthesis frame itself, authored and held outside the aggregation rather than left to emerge from it unowned. The same bears on the leading remedy proposed for the channel’s dangers, the defensive systems that annotate the engine’s verdicts with the context a misled reader lacks, which their proponent allows would be legitimate only given strong assurances of neutrality (Tarsney 2025). But an annotation is itself a verdict voiced by a system that cannot answer for it, so the criterion that governs the disease governs the cure: a defensive frame earns its standing not by being neutral, which it cannot be, but by being true and answerably owned.

Two of the four conditions carry the weight, and they must hold together. That a named party stands behind the frame is a fact about its provenance; that this party takes up the answerability, coming forward as owner of record, is a fact about who owns the account; these are different and do not always travel together. A frame can have an author who comes forward for nothing, set by a real party who arranged that it issue as the engine’s own neutral synthesis, which is the wrong itself, not a near-miss of it. A frame can also be answered for by a party who did not author it, and the case to mark is not a platform owning the synthesis frame it set, which is the legitimate ownership described above, but a platform answering for a contributor frame a hidden hand set and slipped into the synthesis, so that discharge is routed to a proxy while the author escapes. Owning the frame one set is ownership; being made to answer for a frame another planted is laundering, and only the shape of what is owned tells them apart. Legitimacy requires that the two coincide: the party who authored the frame must be the party who takes up its answerability, and to our knowledge no account defines that pole in these terms. The rejoining does not launder the influence, and the criterion is worthless if read to do so: owning a frame does not make a false or coercive influence permissible, for a disclosed lie is a lie still. Truth, defensibility, and disclosure decide whether the influence is permissible; owned answerability decides only whether anyone can be held to that judgment.

The nearest body of thought treats the firms behind such systems as fiduciaries, owing users duties of care and even loyalty (Balkin 2016; Koessler 2024; Erickson 2026). The resemblance is real, but the question is not the same: fiduciary theory asks what the system owes the user it serves, where the question here is whether the public frame the engine voices has acquired an author who is reachable or absent. A system can be a faithful fiduciary to its user and still voice, as neutral synthesis, a frame an outside party covertly authored; loyalty to the user does not by itself supply an owner who answers for the frame. A criterion offered by someone with a stake in the answer invites a familiar suspicion: that the ethics are convenient, the line drawn to fall just clear of its author (Bietti 2021). The reply is not a profession of good faith, worth nothing here, but that the criterion answers to no one’s motive: it binds its author as readily as anyone, condemns the careless whatever they intend, and costs something to meet, since being the fitting answer and owning the account is harder than manufacturing the appearance of fit and arranging to be taken for no one. That is the test of teeth: not whether the author is sincere, but whether the criterion costs something to meet and can condemn the careless without appeal to motive. One free to satisfy, or that bites only one’s rivals, is the ethics-washing it pretends to refuse. This one bites at a price, and bites generally. That the legible pole exists does not make it the one the market settles into; the covert path does not disappear because a legible one is available, and which of them endures is decided by the contest between them.

7 The Standing Contest

Disclosure leaves the legible firm untouched and degrades the covert one. That asymmetry does not end the matter; it sets its terms. A channel that monetizes trust is a standing target, and the more it is trusted the larger the prize for capturing what it says, so the incentive to author its verdicts covertly grows with the very thing that makes the channel worth having. This is not a defect to be patched and forgotten but a contest of the kind that does not resolve, the kind run between spam and the filters that answer it, between doping and the assays that chase it, each side adapting to the other’s last move, the defender able to stay partly ahead and never to clear the board. It is also the posture the risk-management frameworks now standard in the field take toward analogous capture, governing and bounding the exposure rather than removing it (National Institute of Standards and Technology 2023).

What keeps the contest from being hopeless is an asymmetry in the defender’s favor, and it is structural rather than lucky. The legible frame survives being seen: it was true and its hand was shown to begin with, so disclosure costs it nothing. The covert frame depends on concealment for its effect, and the dependence is closer to definitional than empirical: the advantage a covert verdict holds is precisely the credence it draws as a verdict taken for no one’s, an increment that exists only under concealment and, by construction, does not survive disclosure. So the direction of the disclosure effect is fixed by the structure, not by how readers happen to behave; it needs only that knowing a frame is interested discounts it at all. What the structure leaves open is the magnitude. The edge is real and it is not decisive: disclosure weakens a covert influence without annihilating it, since an interested frame still moves a reader who has been told that it is interested, only less, and contestably (Hashavit et al. 2023). And the edge never closes the contest, because the signal that would settle authorship can itself be manufactured: provenance is forgeable and a citation can be costumed, so the instrument of disclosure becomes one more thing to capture. But manufacturing that signal is itself a covert move, a forged provenance working only while taken for genuine, so forgery does not lift the covert path’s dependence on concealment; it relocates the concealment to the signal, where the same asymmetry recurs. The contest extends; its direction does not reverse. That a public mirror people act on will be gamed is not a pessimist’s forecast but a structural result of the kind named for incentive systems generally (Manheim & Garrabrant 2018; Perdomo et al. 2020), and the engineering discipline now forming around answer-engine visibility is that result becoming an industry (Tian et al. 2026).

To the philosopher, the moral object is the contest itself, not a transient malfunction: the wrong is not a bug a better model removes but a permanent feature of any channel built to be trusted and open to capture, and what wants analysis is the equilibrium, who owes the account, where it strands, which way the asymmetry runs, rather than the hope of a final fix. For the project of building these systems well, the contest cannot be ended; the aim is to engineer toward the favorable asymmetry, making the legible path the cheaper one and the covert path the more exposed. The places that decide it can be named: the provenance of a frame and the history of its shaping; the source-shaped speaker the channel can otherwise erase; the juncture at which a reader might still ask whether to check, which can be preserved or quietly engineered away; and the corpus and retrieval layer, not neutral plumbing but the surfaces on which authorship is captured, carrying moral stakes the security framing alone does not see. These places are also where the remedy stops being hopeful and becomes mechanical. A frame can be owned only where it is bounded enough to be owned: the named owner the criterion asks for cannot be named for a verdict that dissolves into the channel’s anonymous voice, so closing the closeable and naming the party who answers for the frame are the same act seen twice, and locatability is not a step beyond ownership but its precondition. Making the legible path the cheaper one is finally an institutional task as much as a technical one, through the arrangements that align a channel’s private incentive with the public’s: the liability that prices the harm of a verdict no one owns, the procurement and auditing that can require a named owner of record, and the standards that make legibility checkable. And for the firm that builds on the channel, the legible path is the durable one: a position that survives disclosure rests on something real, while one that needs concealment fails the moment it is seen. None of this forecasts an outcome. The contest is permanent and its asymmetry favorable, a fact about the channel’s structure rather than a prophecy about its history; there is a way to be present on this channel that survives the light, and a way that does not.

8 Conclusion

The oracles of the ancient world were consulted because they answered from nowhere a person could reach: the god spoke, the priest transcribed, and the questioner who acted on the verdict had no author to hold. An answer engine returns the form of that authority and conceals what the oracle made no secret of, that an interested hand had reached the channel before the question did. This is the captured oracle. A voter asks what a measure would do and acts on a judgment some party shaped to be taken for no one’s; the shaping is invisible, the verdict is fluent, and the account she is owed has no destination. It is one wrong, worn along a single axis: at the answer end a hidden author sets the frame and the reader is left misled but excused; as the engine ceases to answer and begins to act, the debt for the deed comes to rest on whoever chose to loose it. Truth does not cure it and disclosure of machine origin does not reach it, because what was taken was never the information but the assurance that someone stood behind it.

That a verdict should issue with no one behind it is not a new condition; it is the oldest one, the rumor that everybody repeats and no one will own, which answerable inquiry was built to hold off. The historian held it off without ever being reliable, and the mechanism is the part that matters now: an account someone can be made to answer for is one a later hand can test and correct, which is the whole means by which one historian improves on the last. The oracle keeps its standing by the reverse, by keeping its inner workings dark; and the dark is not the oracle’s weakness but its value, the reason it can be consulted as a god and not cross-examined as a witness. A synthesis voiced as impartial and built to be unauditable sits in that seat, and what seats it there is precisely the cost it spares itself by being unanswerable. At the scale at which a society now forms what it takes itself to know, a channel in that seat does something a single false verdict never could: it lets a public keep the appearance of inquiry while losing the practice of it, the habit of asking whose frame this is and whether it should stand. The remedy asks no one to stop building and no one to trust less. It asks only that the frame have an owner who can be reached, the one provision an oracle exists to withhold; and a civilization that stops asking for it will not notice what it has surrendered until it has nothing left it is able to revise.

References

1. Aggarwal, P., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K., & Deshpande, A. (2024). GEO: Generative engine optimization. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD ’24) (pp. 5–16). Association for Computing Machinery. doi:10.1145/3637528.3671900
2. Allaham, M., & Diakopoulos, N. (2026). Synthetic sources?: Auditing generative search engine citations for evidence of AI-generated sources. arXiv. doi:10.48550/arXiv.2605.23684
3. Balkin, J. M. (2016). Information fiduciaries and the First Amendment. UC Davis Law Review, 49(4), 1183–1234.
4. Bellia, A. J., Jr. (2001). Contracting with electronic agents. Emory Law Journal, 50, 1047.
5. Benjamin, S. M. (2013). Algorithms and speech. University of Pennsylvania Law Review, 161(6), 1445–1493.
6. Bietti, E. (2021). From ethics washing to ethics bashing: A moral philosophy view on tech ethics. Journal of Social Computing, 2(3), 266–283. doi:10.23919/JSC.2021.0031
7. Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2024). Poisoning web-scale training datasets is practical. In 2024 IEEE Symposium on Security and Privacy (SP) (pp. 407–425). IEEE. doi:10.1109/SP54263.2024.00179
8. Chapekis, A., & Lieb, A. (2025, July 22). Google users are less likely to click on links when an AI summary appears in the results. Pew Research Center. https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears-in-the-results/
9. Christiano, T. (2022). Algorithms, manipulation, and democracy. Canadian Journal of Philosophy, 52(1), 109–124. doi:10.1017/can.2021.29
10. Elish, M. C. (2019). Moral crumple zones: Cautionary tales in human-robot interaction. Engaging Science, Technology, and Society, 5, 40–60. doi:10.17351/ests2019.260
11. Erickson, J. (2026). Who does your AI work for? Designing conversational agents as digital fiduciaries. In Proceedings of the ACM Conference on Conversational User Interfaces (CUI ’26). Association for Computing Machinery. doi:10.1145/3816046.3816299 arXiv:2605.28908
12. European Union. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689. http://data.europa.eu/eli/reg/2024/1689/oj
13. Fleisher, W., Cibralic, B., Basl, J., Ricks, V., & Smith, M. N. (2025). Responsibility and accountability in an algorithmic society. Philosophy & Technology, 38, Article 144. doi:10.1007/s13347-025-00970-w
14. Freiman, O., & Miller, B. (2020). Can artificial entities assert? In S. Goldberg (Ed.), The Oxford handbook of assertion (pp. 415–436). Oxford University Press. doi:10.1093/oxfordhb/9780190675233.013.36
15. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec ’23) (pp. 79–90). Association for Computing Machinery. doi:10.1145/3605764.3623985
16. Hacker, P., & Holweg, M. (2026). A pragmatic approach to regulating AI agents. arXiv. doi:10.48550/arXiv.2604.22819
17. Hashavit, A., Wang, H., Stern, R., & Kraus, S. (2023). Not just skipping: Understanding the effect of sponsored content on users’ decision-making in online health search. In Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR ’23) (pp. 1056–1065). doi:10.1145/3539618.3591744
18. Hicks, M. T., Humphries, J., & Slater, J. (2024). ChatGPT is bullshit. Ethics and Information Technology, 26(2), Article 38. doi:10.1007/s10676-024-09775-5
19. Kasirzadeh, A., & Gabriel, I. (2025). Characterizing AI agents for alignment and governance. arXiv. doi:10.48550/arXiv.2504.21848
20. Klenk, M. (2022). (Online) manipulation: Sometimes hidden, always careless. Review of Social Economy, 80(1), 85–105. doi:10.1080/00346764.2021.1894350
21. Koessler, L. (2024). Fiduciary requirements for virtual assistants. Ethics and Information Technology, 26(2), Article 21. doi:10.1007/s10676-023-09741-7
22. Königs, P. (2022). Artificial intelligence and responsibility gaps: What is the problem? Ethics and Information Technology, 24(3), 36. doi:10.1007/s10676-022-09643-0
23. Lange, B. (2026). Epistemic deference to AI. In B. Steffen (Ed.), Bridging the gap between AI and reality (AISoLA 2024) (Lecture Notes in Computer Science, Vol. 16032, pp. 174–186). Springer. doi:10.1007/978-3-032-01377-4_9
24. Mallory, F. (2023). Fictionalism about chatbots. Ergo. doi:10.3998/ergo.4668
25. Manheim, D., & Garrabrant, S. (2018). Categorizing variants of Goodhart’s law. arXiv. doi:10.48550/arXiv.1803.04585
26. Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023). [Sanctions order of June 22, 2023, Castel, J.]
27. Narayanan Venkit, P., Laban, P., Zhou, Y., Mao, Y., & Wu, C.-S. (2025). Search engines in the AI era: A qualitative understanding to the false promise of factual and verifiable source-cited responses in LLM-based search. In Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency (FAccT ’25) (pp. 1325–1340). Association for Computing Machinery. doi:10.1145/3715275.3732089
28. National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). U.S. Department of Commerce. doi:10.6028/NIST.AI.100-1
29. Nestaas, F., Debenedetti, E., & Tramèr, F. (2024). Adversarial search engine optimization for large language models. arXiv. doi:10.48550/arXiv.2406.18382
30. Perdomo, J. C., Zrnic, T., Mendler-Dünner, C., & Hardt, M. (2020). Performative prediction. In Proceedings of the 37th International Conference on Machine Learning (ICML 2020) (PMLR 119). doi:10.48550/arXiv.2002.06673
31. Rubel, A., Castro, C., & Pham, A. (2019). Agency laundering and information technologies. Ethical Theory and Moral Practice, 22(4), 1017–1041. doi:10.1007/s10677-019-10030-w
32. Salvi, F., Horta Ribeiro, M., Gallotti, R., & West, R. (2025). On the conversational persuasiveness of GPT-4. Nature Human Behaviour, 9(8), 1645–1653. doi:10.1038/s41562-025-02194-6
33. Santoni de Sio, F., & Mecacci, G. (2021). Four responsibility gaps with artificial intelligence: Why they matter and how to address them. Philosophy & Technology, 34(4), 1057–1084. doi:10.1007/s13347-021-00450-x
34. Stöckl, A., & Nitu, J. (2025). Are AI agents interacting with online ads? arXiv. doi:10.48550/arXiv.2504.07112
35. Susser, D., Roessler, B., & Nissenbaum, H. (2019). Online manipulation: Hidden influences in a digital world. Georgetown Law Technology Review, 4(1), 1–45. doi:10.2139/ssrn.3306006
36. Tarsney, C. (2025). Deception and manipulation in generative AI. Philosophical Studies, 182(7). doi:10.1007/s11098-024-02259-8
37. Thompson, D. F. (1980). Moral responsibility of public officials: The problem of many hands. American Political Science Review, 74(4), 905–916. doi:10.2307/1954312
38. Tian, Z., Chen, Y., Tang, Y., Liu, J., & Jia, R. (2026). Diagnosing and repairing citation failures in generative engine optimization. arXiv. doi:10.48550/arXiv.2603.09296
39. Tigard, D. W. (2021). There is no techno-responsibility gap. Philosophy & Technology, 34(3), 589–607. doi:10.1007/s13347-020-00414-7
40. van de Poel, I., Fahlquist, J. N., Doorn, N., Zwart, S., & Royakkers, L. (2012). The problem of many hands: Climate change as an example. Science and Engineering Ethics, 18(1), 49–67. doi:10.1007/s11948-011-9276-0
41. van de Poel, I., Royakkers, L., & Zwart, S. D. (2015). Moral responsibility and the problem of many hands. Routledge. doi:10.4324/9781315734217
42. Volokh, E., & Falk, D. M. (2012). First Amendment protection for search engine search results — white paper commissioned by Google. Journal of Law, Economics & Policy, 8(4), 883–899. (UCLA School of Law Research Paper No. 12-22.) doi:10.2139/ssrn.2055364
43. Walton, L. F. (2026a). The decision no one authored: The answerability gap in generative AI [Preprint]. Zenodo. doi:10.5281/zenodo.20614374
44. Walton, L. F. (2026b). The invariant of answerability [Working paper]. Zenodo. doi:10.5281/zenodo.20606493
45. Zagzebski, L. T. (2012). Epistemic authority: A theory of trust, authority, and autonomy in belief. Oxford University Press.
46. Zeiser, J. (2024). Owning decisions: AI decision-support and the attributability-gap. Science and Engineering Ethics, 30, Article 27. doi:10.1007/s11948-024-00485-1
47. Zhang, K., He, X., & Yao, J. (2026). From citation selection to citation absorption: A measurement framework for generative engine optimization across AI search platforms. arXiv. doi:10.48550/arXiv.2604.25707
48. Zou, W., Geng, R., Wang, B., & Jia, J. (2025). PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models. In 34th USENIX Security Symposium (USENIX Security 25) (pp. 3827–3844). USENIX Association. https://www.usenix.org/conference/usenixsecurity25/presentation/zou-wei