The campus looked unusually polished on monitoring day.
New support posters had appeared in corridors. Student ambassadors wore matching badges. Fresh flowers sat in the Scholarship Office reception.
Grace Naliaka arrived at nine with a laptop and a small folder. Karanja welcomed her beside a group of managers.
“We have prepared a route.”
“Thank you,” Grace said. “First I want to see the appeal desk.”
Karanja smiled. “The appeal function is largely virtual.”
“The donor presentation described a dedicated appeal desk.”
“Operationally integrated.”
“Then let us see how a student reaches it.”
They walked the ordinary route.
The desk marked **Appeals & Review** was empty.
Grace asked the receptionist, “Who staffs it?”
“An officer is usually here Tuesday.”
It was Thursday.
“Appeal register?”
The receptionist searched a drawer. There was none.
Karanja explained that the digital queue was primary.
Grace requested the number of cases closed through a formal appeal outcome rather than automated review.
After several minutes, the answer came back.
Zero completed panel appeals.
Grace wrote it down without theatrics.
In another corridor, she scanned a newly posted QR code titled **Appeal Here**. It opened a general support form, not an appeal workflow.
Karanja immediately told staff to fix the link.
Grace noted both facts: the defect and the repair during the visit.
“A fix now does not prove the route functioned yesterday,” she said.
At the pantry, Bibi Achieng explained the alumni emergency stock.
“Were you instructed to deny meals to students under review?” Grace asked.
“Yes. We used separate emergency stock because people still had to eat.”
Karanja said, “That was temporary.”
“Temporary harm is still harm.”
At the examination office, Ouma showed the redacted incident ticket from Kendi’s case and the manual-clearance instruction that followed.
“Was the integration approved?”
No approval record was attached.
Grace kept returning to one question at every service point: “What happens today when a student is flagged?”
The answers were fragmented.
That became one of her notes: **fragmented safeguards**.
At lunch, management tried to steer the group into the prepared slide presentation.
Grace closed her folder.
“I would rather see a demonstration.”
“Of what?” Karanja asked.
“The rule set. Synthetic data. No student information.”
Wema suggested categories the shadow audit had already identified: mandatory course equipment and emergency transport. Grace added a normal control case so the test would not consist only of examples chosen to fail.
Karanja looked at Wema.
“You are not the technical owner.”
“I know. IT should run it.”
The IT lead confirmed that vendor restrictions prevented source-code disclosure but allowed a decision simulator to be used with synthetic inputs.
Grace asked everyone to submit one test concern in writing.
Management wrote: fraud-control consistency.
Wema wrote: context handling before sanction.
Zuri wrote: student-mandate boundaries.
Grace combined them into the testing agenda.
That mattered. The next day’s test would not belong to one side.
Karanja agreed that the resulting outputs could become part of the monitoring record.
Before leaving, Grace selected the synthetic scenarios herself.
One included funeral transport received as a family gift.
The other included a mandatory course helmet.
Tomorrow, the question would move beyond whether the appeal desk existed.
Grace also asked each side to describe what would count as a meaningful result from the simulator. Management wanted to know whether fraud-control flags remained functional. Wema wanted to know whether context-free inputs could trigger service loss. Zuri wanted to know whether rules beyond the council mandate had entered the workflow. The IT lead translated those questions into observable outputs. By agreeing on the test before seeing the result, they reduced the chance that either side would redefine success afterward. Wema wrote that procedure into her notes because it was one of the first moments in the conflict when adversaries had agreed on a shared way to find out what was true.
The model itself would have to show what it did when context was missing.