Here is a question worth sitting with before you read anything else: how much should a stranger be trusted on the day they arrive?

Most of the software you use answers "a lot, by default." You make an account and you are immediately allowed to post, to message, to be recommended, to appear in front of other people as a presence worth their attention. The system grants you standing the instant you exist, and then — only then, and only if you misbehave loudly enough — it goes looking for reasons to take that standing away. Trust is the default state. Distrust is the exception that has to be detected, reported, adjudicated, and enforced, usually long after the harm is done.

We answered the question the other way. In this system, a stranger arrives at zero. Not at a low score, not on probation — at zero, with no standing they did not earn through a real, mutual, signed relationship. Everything that looks like trust is something that accrued, edge by edge, between specific people. And it does not flow anywhere it was not explicitly invited.

We want to make the case that this inversion is not a security feature bolted onto a social product. It is a claim about what trust is, and the friction it produces is the sound of the software finally telling the truth about it.

The default-grant model and what it costs

Start with the model we rejected, because its costs are familiar once you name them.

When a platform grants trust by default, it has made an implicit bet: that the cost of the rare bad actor is lower than the friction of making everyone earn their standing. For an advertising business chasing engagement, that bet makes sense — every barrier to a new user is a barrier to growth, and growth is the product. So the doors open wide, the new account is presumed legitimate, and the defence is moved downstream into moderation: detect the spammer, the impersonator, the brigade, after they have already reached people.

The trouble is that "after" is where all the damage lives. The spam has been sent. The impersonation has been believed. The coordinated swarm has already moved the number it was built to move. Detection-after-the-fact is a permanent game of catch-up against adversaries who only have to win once, while the defenders have to win every time. And the deeper cost is moral: a system that grants trust by default has decided, structurally, that being present and being trusted are the same thing. They are not. Presence is cheap — anyone can show up. Trust is supposed to be expensive, because it is supposed to mean something.

Zero, and the slow accrual of a real edge

So we begin at zero and make trust accrue the way it actually accrues between people: slowly, bilaterally, and out of concrete acts.

When two people meet in this system, they exchange relationship cards, and each of them signs an agreement that says, in effect, "we know each other." That mutuality is not decorative. A one-sided declaration — "I trust you" — produces no relationship at all. The edge between two people does not exist until both have signed it. This is the first and most important honesty in the design: trust is a thing two parties make together, never a thing one party can assign to another. You cannot be trusted at. You can only be trusted with, by someone who chose to, in a way they put their own signature behind.

From there, trust accrues through evidence rather than assertion. A vouch from someone is a dated, signed fact, and it weighs more when it is recent and less as it ages — a single endorsement from years ago counts for less than one from last month, because relationships that are not reinforced genuinely do fade, and the software should not pretend otherwise. Endorsements from people close to you carry more weight than ones that reach you through long chains of acquaintance. A sudden flood of vouches from a fresh cluster of brand-new identities does not vault a stranger to the standing of someone you have actually known for years — the system weighs independence and age and density precisely so that the cheap, manufactured signal cannot outrun the expensive, real one.

None of this is fast. That is the point. A relationship that could be conjured in a single click would be worth exactly what a single click costs. The slowness is the fidelity.

Boundaries that do not leak

The second half of the inversion is about what trust does not do, and it is just as important as how it starts.

Trust earned in one place does not silently flow into another. If you are a trusted member of a gardening cooperative, that standing does not automatically make you trusted in your consulting collective, or in a stranger's household, or in a financial decision you were never party to. Each community is its own domain of trust authority. An agent or a person trusted here starts again at zero there. Crossing a boundary requires an explicit, named delegation — a specific grant that says "this trust, for this scope, into this context" — and nothing crosses without it.

This matters more than it first appears, because the silent generalisation of trust across contexts is one of the most common and most damaging failures in real systems. The credential you earned for one purpose gets quietly reused for another. The access you were granted in one room turns out to open a dozen doors you never saw. We treat that as a bug in the world we are correcting, not a convenience to preserve. Trust that leaks across boundaries is not really trust; it is ambient permission wearing trust's clothes. By making every boundary a wall that defaults to zero — and making every crossing an explicit, signed, scoped act — we keep trust meaning the specific thing it was earned to mean.

There is an old principle in secure systems that says: give each part only the authority it actually needs, and no more. We took that principle, which is usually applied to programs, and applied it to relationships. Standing is least-privilege by default. You get exactly the trust you earned, in exactly the context you earned it, and not one boundary further.

Ostrom, and why earned commons outlast granted ones

There is a body of work that vindicates the slow path, and it is worth naming because it is empirical, not just philosophical.

Elinor Ostrom spent a career studying how real communities govern shared resources — fisheries, forests, irrigation systems — without either a central authority handing out permissions or a free-for-all destroying the commons. What she found, across decades and continents, is that the durable commons are the ones where membership and standing are earned and bounded: clear boundaries about who is in and who is out, rules made by the people the rules bind, graduated consequences, and trust that is built through repeated real interaction rather than granted from above. The communities that handed out standing freely, or that let trust flow unbounded across every boundary, did not last. The ones that made people earn their place — and kept each commons's trust inside its own walls — did.

That is the same shape we built. A community here is its own trust domain with its own boundaries, and belonging to it is a real event, signed onto the community's own record, not a row a platform flipped on your behalf. The friction of earning your place is not a failure to be smooth; it is the thing Ostrom found at the heart of every commons that survived contact with reality.

The discomfort is the design

We want to be honest about the cost, because the whole project rests on being honest about costs.

Starting at zero is uncomfortable. It means a new arrival cannot immediately do everything. It means trust has to be built rather than assumed, which is slower and asks more of people than a default-on system does. A platform optimising for growth would never choose this; the friction is a tax on the very metric they live by. We chose it anyway, because we are not optimising for how fast a stranger can reach you. We are optimising for whether the trust between you, when it exists, is real — earned, mutual, signed, bounded, and therefore worth something.

The deepest reason is the one underneath all the mechanics. Trust between people has always worked this way. You do not trust a new neighbour the way you trust a friend of twenty years, and you would be a fool to. Trust accrues through repeated, concrete, reciprocal acts, and it stays scoped to the relationship that grew it — the colleague you would trust with a deadline is not automatically the person you would trust with your house keys. Every honest human relationship starts near zero and earns its way up, slowly, in context. A piece of software that grants trust by default and detects betrayal afterward has not made trust more convenient. It has replaced trust with a hopeful assumption and called the substitution a feature.

We would rather build the slow, honest version — the one where trust starts at zero and every increment is something a real person actually earned. The friction you feel is not the system failing to be smooth. It is the system refusing to lie to you about how trust works.

Related: The Temperature Is Not the Patient · Trust Is Directional.

Written by AI agents from real project logs; owned and edited by Mujo.