The core insight is behavioral. Tang separates what a design is claimed to do from what it actually does to the people navigating it. A verification step travels along two analytically distinct pathways. In the claimed-mechanism pathway, the design is hypothesized to verify information, induce deliberation, deter misuse, or screen applicants. In the experienced-burden pathway, the same design produces subjective effort, delay, anxiety, and failed recovery, and these costs depend on users’ cognitive, administrative, physical, linguistic, and digital resources. Crucially, the claimed mechanism does not mediate the experienced burden. A three-minute task for one user may mean device replacement, document retrieval, travel, or translation for another. Observed dropout is therefore behaviorally ambiguous: it may signal deterrence, confusion, inability to comply, or failed recovery, and treating everyone screened out as a fraudulent or erroneous applicant converts an outcome into an unsupported program-integrity claim.

To discipline these claims, BRFF builds a five-layer ontology. The first layer is design form, described at a granularity fine enough to change independently; multifactor authentication is too broad to evaluate, while entering a one-time code for every low-value interaction from a trusted device is evaluable. The second layer is the claimed mechanism, the pathway through which the design is expected to alter the target risk. The third is experienced burden, measured as users actually experience it rather than as the nominal length of a requirement. The fourth is behavioral outcome, split into protection-side measures such as residual fraud and unprevented error, and user-side measures such as blocked legitimate access, abandonment, delay, and failed recovery. The fifth layer is normative status: justified for the current review period, evidence-uncertain, a correctable misfit, or sludge. The object of evaluation is explicitly conditional, indexed to one friction, one risk, one service stage, one user group, and one review period, conditional on the available evidence and the feasible set of alternatives.

The framework then runs this object through a legal precondition and three behavioral gates. Gate 0, which sits outside the trivalent evidence structure, records the governing jurisdiction, legal basis, legitimate purpose, and binding rights constraints; without authority, the sequence stops. Gate 1 tests functional fit: whether the friction reduces a specified risk relative to an explicit counterfactual. Evidence is graded from A to D, where Grade A reflects credible randomized or quasi-experimental estimates of incremental protection, Grade B bounds material rival explanations with strong observational designs, Grade C supports only mechanism plausibility, and Grade D is an asserted purpose with no performance evidence. A Gate 1 Pass ordinarily requires Grade A or strong, independently scrutinized Grade B evidence. Grade C can support only narrow provisional use under a precautionary rule with safeguards, evidence milestones, and constrained renewal, and Grade D supports neither a Pass nor provisional use, regardless of how severe the target harm may be.

Gate 2 imports the logic of non-inferiority testing from clinical trials. Before any results are observed, the institution prespecifies a primary protection outcome and every material secondary protection outcome, including plausible displacement across channels or harm types, and sets a protection-loss margin for each. A lower-burden alternative qualifies only if it stays within every prespecified margin; a favorable primary outcome cannot compensate for material deterioration in a secondary one. A candidate that clears every margin then enters an intermediate routing state, pending a distributional assessment, and if that assessment passes and the candidate demonstrably lowers the prespecified burden outcome, Gate 2 is finalized as a failure of the current design, because the alternative dominates it. Gate 3, in its two labeled applications, applies access, recovery, and rights floors to every materially affected group, and these floors are non-compensable: no aggregate fraud reduction can license a procedure that predictably blocks a protected group without effective remedy.

The framework’s life cycle converts justification from a verdict into a monitored state. Every friction classified as justified carries a review date, monitoring indicators, and explicit triggers for reassessment, covering protection effect, abandonment, delay, recovery, group disparities, habituation, strategic circumvention, and the emergence of new lower-burden alternatives. What expires automatically is the positive justificatory status, not necessarily the control itself. Four statuses capture the possible states: Justified for the Current Review Period, Evidence-Uncertain, Correctable Misfit, and Sludge. Unknown is a result, Evidence-Uncertain is its status, and provisional use is an action; Fail and Unknown never share a default status. Even a manual fallback deployed during an emergency becomes a distinct evaluation unit that must re-enter the framework at Gate 0 and earn its own status, rather than inheriting the displaced control’s justification.

The paper demonstrates the framework’s bite with a worked application drawn from a real randomized field experiment involving approximately 65,000 Supplemental Nutrition Assistance Program applicants in Los Angeles County. The experiment held eligibility, documentation, and interview requirements constant but allowed treated applicants to complete the mandatory interview by phone at a convenient time. Thirty-day approval rose by 6.2 percentage points, from roughly 49 to 55 percent, and participation within five months rose by 2.2 points. Yet the study did not independently estimate fraud, erroneous payment, or false acceptance. Tang shows how BRFF prevents this measured access gain from becoming an unmeasured integrity claim: the fixed-time scheduling requirement becomes a separate evaluation unit, flexible scheduling becomes a plausible lower-burden candidate whose comparative protection effect remains unknown, and the missing protection comparison is converted into a specified test, safeguards, and an expiry condition rather than an open-ended inference.

Two explicitly hypothetical records illustrate the completed paths. In the Justified record, a 24-hour hold and independent callback after a high-value benefit recipient changes bank details passes Gate 1 with strong Grade B evidence showing confirmed payment misdirection of 0.4 percent with the hold versus 1.0 percent without it. An instant risk-tiered verification candidate fails the prespecified protection-loss margin, no other qualifying candidate exists, and rights floors are satisfied, so the hold is justified for a twelve-month review period with monitoring. In the Sludge record, mandatory in-person proof of life for pension verification detects confirmed ineligibility at 0.20 percent in person versus 0.21 percent through an authorized death-register match, while producing 8 percent non-completion among mobility-limited older users against 1 percent among others, with no timely restoration. Functional failure alone assigns the Sludge status, and the register-plus-escalation design must be assessed as a new unit from Gate 0.

The framework also yields empirically testable implications. Task–resource interaction predicts that greater mismatch between task demands and users’ resources should increase experienced burden and, through it, access error and abandonment, with accessible assistance attenuating the disparity. Ordeal informativeness predicts that increasing ordeal cost improves screening only when the capacity or willingness to endure the cost predicts ineligibility or target risk more strongly than genuine need, a prediction that existing screening economics has already complicated; research on health-insurance auto-enrollment, for example, estimated that replacing automatic enrollment with required active plan choice reduced new enrollment by approximately 33 percent and disproportionately excluded economically disadvantaged eligible adults, without measuring fraud. Conditional targeting predicts that risk-tiered friction lowers total burden within protection margins only when risk heterogeneity is large relative to classifier error, manipulation, privacy cost, and disparate impact, and that controls scheduled for revalidation should be less likely to remain dominated than comparable unreviewed controls.

Tang is careful about the framework’s limits. BRFF is an audit discipline, not an algorithm, and not a validated scale; inter-rater reliability is unknown. It does not replace legal judgment, supply universal thresholds, or solve fragmented data ownership, limited evaluation budgets, or the political cost of withdrawing visible controls. Evidence is asymmetric across domains, with benefit studies often omitting fraud outcomes and security studies omitting socioeconomic effects, so early audits may produce many evidence-uncertain controls, which is useful only if institutions resolve rather than warehouse that uncertainty. But the conceptual shift is clear: the relevant claim in policy debate is no longer that authentication or verification is generally beneficial or burdensome, but that a specified design, for a specified risk and group at a specified time, has passed an auditable sequence of causal, comparative, distributive, and temporal tests. Justified friction, in this view, is a monitored conclusion that a design may earn, lose, and regain, never a permanent property of the design itself.

Subject of Research: A behavioral risk–friction fit framework for justifying administrative frictions in digital public services

Article Title: Justification as a revisable state: a behavioral risk–friction fit framework for digital public services

Article References: Tang, K. (2026). Justification as a revisable state: a behavioral risk–friction fit framework for digital public services. Frontiers in Behavioral Economics, 5, Article 1936872. https://doi.org/10.3389/frbhe.2026.1936872

Image Credits: AI Generated

DOI: 10.3389/frbhe.2026.1936872

Keywords: administrative burden, behavioral economics, digital public services, sludge, proportionality, fraud prevention, digital exclusion, screening, SNAP, public policy, identity verification, evidence standards