Before anyone opened a spreadsheet, Amina, a fourth-year statistics student, wrote the protocol on the laboratory whiteboard.
“Our question is not ‘Is the model evil?’” she said. “Our question is narrower: within the sample we can ethically collect, which legitimate contexts appear alongside adverse flags?”
Wema nodded.
Recruitment did not run only through Wema’s contacts. The team used the student press notice, welfare clubs, and scheduled recruitment windows around Student Services to reduce self-selection where they could. They knew they could not eliminate it.
Twenty-eight participants consented.
The team split the work. One group coded context without seeing the outcome. Another recorded the outcome without seeing the context. Wema stayed away from coding cases she had previously interviewed.
“Blind coding,” Amina said. “We do not reward ourselves for finding what we expect.”
Case one: safety helmet purchase. Context coders marked *mandatory course equipment*. Outcome: high-risk band.
Case two: funeral travel. Context: family emergency. Outcome: medium-risk.
Case three: an expensive phone purchase. Outcome: green.
“That one matters,” Wema said.
“Every counterexample matters,” Amina replied.
Another case surprised them. A low-cost pair of workshop boots received a red outcome, while a much more expensive textbook purchase did not.
“Amount may not be the core factor,” Wema said.
“Category mapping may matter,” Amina said. “May.”
They did not have source code. They could not prove a causal rule. Their sample was small and skewed toward students willing to discuss reviews.
The report became full of phrases activists hated: *within this sample*, *suggests*, *cannot infer population prevalence*, *requires controlled verification*.
Kelvin read the draft and shook his head.
“This sounds weak.”
“It sounds bounded,” Amina said.
“Will a donor care about confidence intervals?”
“We are not writing to scare a donor.”
Wema added the strongest counterexamples to the summary rather than hiding them.
The emerging pattern was still meaningful: mandatory course expenses and emergency transport appeared repeatedly among adverse outcomes. But the data did not justify saying that the system targeted a particular faculty or that every lifestyle flag was wrong.
A monitoring analyst joined a call and questioned Amina about the wide confidence intervals.
“That is why our recommendation is on-site process verification,” Amina answered, “not a population claim.”
Wema wrote that sentence down.
The team created a public repository containing the protocol and codebook, but no participant-level data. Their recommendation listed four things an external monitor could inspect without exposing students: the appeal desk, service-propagation rules, public policy notices, and a synthetic rule test.
That last step transformed the audit from a classroom exercise into a bridge toward operational verification.
At the end of the night, Amina printed the one-page summary and read every conclusion aloud.
Wema felt the temptation to delete the qualifiers.
She left them.
A counterexample was not an enemy.
A limitation was not surrender.
A testable claim was more useful than a viral accusation.
They sent the report and methodology to Grace.
Fourteen minutes later, she replied.
*Can your team support an on-site verification of process rather than individual cases?*
Wema answered yes and added one request:
*Please verify ordinary service points, not only prepared presentation rooms.*
Grace responded:
*Agreed. I will choose the route on arrival.*
Then a calendar invitation appeared.
**Monitoring visit: within 48 hours. No staged route requested.**
The team ended the audit by writing an explicit list of what their work could not establish. They could not estimate the campus-wide error rate. They could not know the model’s internal weights. They could not infer discriminatory intent. They could, however, identify contexts that deserved controlled testing and show that the appeal process itself required verification. Grace’s monitoring team valued that separation. Rather than asking Wema for more student records, they asked for service points and synthetic scenarios. That was exactly the outcome Wema wanted: the next stage would test the institution’s process without expanding the collection of private lives.
Their spreadsheet was about to meet the real campus.