Deliberative Audit Method (DAM)

• Deliberative Audit Method (DAM) is a socio-technical framework that combines participatory audits with operational override mechanisms for urban automation systems.
• It operationalizes the Right-to-Override standard by engaging diverse stakeholders to set thresholds, validate fallback states, and ensure contestability.
• Simulations in power distribution, building HVAC, and traffic control demonstrate DAM’s ability to mitigate distributional harms with minimal efficiency loss.

Searching arXiv for the main DAM paper and closely related deliberation/audit work. arXiv search query: "Deliberative Audit Method Right-to-Override critical urban control systems" The Deliberative Audit Method (DAM) is a structured, participatory audit and review method for critical urban automation systems such as building HVAC control, distribution-grid load shedding or demand response, and adaptive traffic signal control. In the authors’ framing, it is the procedural counterpart to the Right-to-Override (R2O) standard: R2O defines who may interrupt or revert automated control, on what evidence, and to which safe fallback states; DAM defines how those authorities, thresholds, and fallback rules are socially and operationally constructed, tested, reviewed, and maintained over the system lifecycle. It is presented not as a purely mathematical audit or a conventional software QA checklist, but as a socio-technical governance method with operational artifacts—playbooks, checklists, templates, walkthroughs, drills, and review gates—that make urban automation contestable in operation and reviewable after the fact (Mushkani, 16 Sep 2025).

1. Definition, motivation, and relation to Right-to-Override

DAM addresses a governance gap created by the increasing role of automation in consequential infrastructure. The motivating claim is that residents and civic bodies rarely have a legitimate, operationally safe mechanism to interrupt systems when those systems produce harm. The harms motivating DAM are explicitly distributional, accessibility-related, and procedural, not only technical failures: inclusivity harms, safety risks, accessibility burdens, distributional harm across groups, service quality degradation, lack of contestability, lack of reviewability, and unevenly distributed burdens from optimization. Domain examples include traffic systems that lengthen pedestrian waits near elder centers, energy automation that may exacerbate energy poverty, systems that complicate accessibility for wheelchair users, load-shedding practices that disproportionately affect vulnerable customers, and building control that creates discomfort-hours for seniors due to occupancy uncertainty (Mushkani, 16 Sep 2025).

The relation between DAM and R2O is central. R2O is the formal override framework: override levels and authorities, thresholds and triggers, validated fallback states, and time bounds. DAM is the audit and deliberation method that operationalizes that framework: how thresholds are chosen, how fallback states are validated, how evidence is reviewed, how stakeholders deliberate, and how deployment and incidents are governed. In that sense, DAM is not separate from R2O; it is the method that makes R2O implementable and auditable.

This structure also defines DAM’s normative orientation. The paper’s claim is that efficiency-oriented automation does not adequately handle these harms unless contestability is designed directly into operations. A plausible implication is that DAM treats public-interest control systems as objects of ongoing governance rather than as one-time technical deployments.

2. Formal structure and override logic

DAM is best understood as a combination of a procedural audit framework, a socio-technical governance method, and an operational ModelOps or lifecycle control process. The paper does not give a formal mathematical definition of DAM itself, but it gives a formalization for R2O, which DAM operationalizes. Let $P$ denote a control policy mapping state $s_t$ to action $a_t$ at time $t$: $P: s_t \mapsto a_t$ and let the system track a vector of monitors $\mathbf{m}_t$ representing distributional harm, safety, accessibility, and service quality (Mushkani, 16 Sep 2025).

A key monitor is the disparity ratio: $$D_t \;=\; \frac{\mathbb{E}[h_t(g)]/\mathbb{E}[b_t(g)]}{\mathbb{E}[h_t(\bar g)]/\mathbb{E}[b_t(\bar g)]}$$ where $h_t$ is harm at time $t$, $b_t$ is a baseline quantity, $s_t$0 is a designated group, and $s_t$1 is its complement. Additional monitors are $s_t$2, the predicted hazard rate per hour; $s_t$3, accessibility downtime for group $s_t$4 in minutes within 24 hours; and $s_t$5, a service-quality index tied to service-level agreements. Override conditions occur when any monitor violates its bound: $s_t$6 with illustrative defaults

$s_t$7

and service-specific $s_t$8.

R2O defines three override classes. Level 1, operator stop, is available to duty engineers for immediate safety or integrity risk, for up to 4 hours, and is logged and reviewed. Level 2, municipal pause, is available to a designated municipal controller when equity, accessibility, or service-quality thresholds are exceeded, for up to 72 hours. Level 3, civic board hold, is available to a standing civic board with community representation for material, persistent, or systemic impacts, for up to 30 days, with mitigation plan and public notice required.

The control-level gating logic computes $s_t$9, computes monitors $a_t$0, and, if any monitor violates threshold, determines escalation level $a_t$1, logs evidence, notifies stakeholders, applies fallback $a_t$2, starts a timer, and initiates DAM review. This means DAM is activated not only before deployment but as an ongoing review process coupled to live threshold breaches.

The paper also states a fallback-enforced disparity lemma: if Level 2 and Level 3 fallbacks enforce

$a_t$3

at each step, then for any window $a_t$4 during which fallback is active, cumulative disparity $a_t$5 satisfies $a_t$6. This suggests that deliberatively selected and validated fallback rules can produce a bounded governance effect.

3. Lifecycle workflow and operational artifacts

DAM is a lifecycle sequence rather than a one-time audit. Before deployment, it begins with system scope, control horizon, operator and vendor responsibilities, protected services, stakeholders, and authority structure for overrides. Protected services vary by domain, but examples include elevators, clinics, bus lines, pedestrian-sensitive sites, and protected occupancies such as seniors’ programming. These protected services anchor fallback design and escalation logic (Mushkani, 16 Sep 2025).

DAM then requires selection and justification of monitors for disparity, safety, accessibility, and service quality. Thresholds are not treated as universal constants; they are set locally through deliberation and sensitivity analysis. The paper explicitly states that DAM uses model cards and datasheets to connect technical choices to governance rationales. Scenario walkthroughs use historical logs, synthetic maps, time series, and contextual overlays to rehearse likely impacts and refine thresholds, monitors, fallback definitions, and escalation expectations.

The pre-deployment worksheet records system scope, operator or vendor, control horizons, protected services, selected monitors, thresholds, legal basis, fallback validation results, shadow-mode results, edge cases and oscillations, civic tabletop roster, agreements and dissent, and final go or no-go decision and conditions. Shadow-mode trials run controllers without actuation so that participants can verify that monitors work as intended, dashboards are interpretable, notification channels function, and trigger logic behaves correctly. Civic tabletop exercises allow community organizations and operators to red-team assumptions, align evidence standards, and finalize escalation rules.

A deployment gate requires municipal sign-off and a public notice summarizing rationale, thresholds, and fallbacks. During operation, near-real-time R2O indicators are published in privacy-preserving form, monitors continue running, threshold breaches can trigger R2O levels, and DAM review starts upon invocation. After incidents or overrides, DAM requires a structured, blameless review linking trigger, violated monitor, immediate action, level invoked, fallback applied, duration, affected groups, metrics, root causes across technical, organizational, and data-pipeline dimensions, mitigations, public-notice details, and closure of corrective actions. The method is sustained by periodic drills, board reviews, annual statistics, and institutional memory.

4. Participants, evidence, and validated fallback states

DAM is explicitly multi-actor. The paper names duty engineers and operators, municipal controllers, a standing civic board with community representation, municipal practitioners in traffic operations, public buildings, and electricity planning, community organization leaders representing older adults, people with disabilities, and tenants of subsidized housing, vendors or operators, civic observers, and residents. Authority remains structured and bounded: operators may invoke Level 1 for immediate safety or integrity risk; a municipal controller may invoke Level 2 when thresholds on equity, accessibility, or service quality are exceeded; a civic board may impose Level 3 for persistent, systemic, or material impacts; and any resident may file a request, though Level 2 and Level 3 action requires municipal or board action (Mushkani, 16 Sep 2025).

Evidence in DAM is partly formal and partly procedural. The paper does not specify probabilistic evidentiary formulas beyond monitor thresholds. Instead, evidence is operationally defined through monitor exceedances, scenario walkthrough results, shadow-mode validation outcomes, logs, dashboards, historical traces, tabletop findings, post-incident metrics, public notices, and machine-readable logs. Level 1 may act provisionally when immediate harm is plausible, even before full evidence is assembled; Level 2 and Level 3 require reference to monitors exceeding adopted bounds.

Safe fallback states are a defining feature. The paper repeatedly stresses that fallback states are not arbitrary pauses but domain-validated safe states chosen through simulation, drills, scenario walkthroughs, stakeholder review, and domain standards. In power, examples are rotational curtailment with equity caps, protected load exemptions, and deterministic $a_t$7 dispatch. In buildings, fallback is anchored in ASHRAE 55 and 62.1 comfort and ventilation bounds; the building appendix specifies occupied temperatures between $a_t$8 and $a_t$9, indoor $t$0 below $t$1 ppm, night setbacks disabled when protected occupancies are present, and ventilation minimums following ASHRAE 62.1. In transport, fallback is anchored in fixed-time plans, pedestrian recall, transit signal priority, and maximum pedestrian red constraints. The paper’s emphasis is graceful degradation, not uncontrolled shutdown.

5. Domain instantiations and quantitative findings

The paper instantiates R2O and DAM in simulations of smart-grid load shedding, building HVAC under occupancy uncertainty, and multi-agent traffic signals. In the smart-grid case, the controlled system is a distribution service area with feeders serving heterogeneous customers, including protected services such as elevators and small clinics. The baseline controller minimizes weighted curtailment cost; override is triggered when the disparity ratio exceeds $t$2 or protected feeders approach minimum service levels; and fallback policies include proportional curtailment with equity cap, rotational curtailment, reserved feeders for protected loads, and deterministic $t$3 dispatch. The paper reports baseline total ENS $t$4 MWh and R2O total ENS $t$5 MWh, so total curtailment is unchanged; group-specific ENS changes from $t$6 to $t$7; and disparity drops from $t$8 to $t$9 (Mushkani, 16 Sep 2025).

In the building HVAC case, the system is a community facility with envelope heat transfer, internal gains, and variable occupancy. The baseline scheduler applies a night setback at 20:00 while seniors may still be present until 22:00. Under R2O, staff can assert occupancy, which disables aggressive setback and maintains occupied comfort and ventilation conditions. The reported results are baseline senior discomfort-hours $P: s_t \mapsto a_t$0, whole-building energy $P: s_t \mapsto a_t$1 kWh; with R2O, senior discomfort-hours $P: s_t \mapsto a_t$2, whole-building energy $P: s_t \mapsto a_t$3 kWh; energy delta $P: s_t \mapsto a_t$4 kWh.

In the transport case, the controlled system is a $P: s_t \mapsto a_t$5 arterial grid with signalized intersections, crosswalks, and one transit corridor. Throughput-oriented adaptive control can produce long pedestrian waits near sensitive sites and irregular bus service. Override switches control to fallback plans that guarantee pedestrian walk phase every cycle, maximum pedestrian red, and transit signal priority on designated corridors. The paper reports baseline vehicle mean delay $P: s_t \mapsto a_t$6 s and median delay $P: s_t \mapsto a_t$7 s; pedestrian mean wait $P: s_t \mapsto a_t$8 s and median wait $P: s_t \mapsto a_t$9 s. Under R2O, vehicle mean delay becomes $\mathbf{m}_t$0 s and median delay $\mathbf{m}_t$1 s; pedestrian mean wait becomes $\mathbf{m}_t$2 s and median wait $\mathbf{m}_t$3 s. Transit headway deviation also improves: mean from $\mathbf{m}_t$4 min to $\mathbf{m}_t$5 min, median from $\mathbf{m}_t$6 min to $\mathbf{m}_t$7 min, and 95th percentile from $\mathbf{m}_t$8 min to $\mathbf{m}_t$9 min.

These results support the paper’s central empirical claim that R2O reduces distributional harm with limited efficiency loss: no increase in total curtailed energy in power, $$D_t \;=\; \frac{\mathbb{E}[h_t(g)]/\mathbb{E}[b_t(g)]}{\mathbb{E}[h_t(\bar g)]/\mathbb{E}[b_t(\bar g)]}$$0 kWh extra energy in the building case, and a $$D_t \;=\; \frac{\mathbb{E}[h_t(g)]/\mathbb{E}[b_t(g)]}{\mathbb{E}[h_t(\bar g)]/\mathbb{E}[b_t(\bar g)]}$$1 s increase in mean vehicle delay in traffic.

6. Policy standard and ModelOps integration

DAM is coupled to a policy standard and a ModelOps integration pattern. The proposed policy standard includes standing, thresholds, fallbacks, transparency, and review cadence. Standing provides that any resident may file a request, Level 2 requires municipal controller decision, and Level 3 requires civic board resolution. Thresholds require overrides to cite monitors exceeding adopted bounds, while Level 1 can act provisionally when immediate harm is plausible. Fallbacks require that only pre-validated fallback states may be used, and that they meet safety, accessibility, and service constraints. Transparency requires every override to produce public notice, machine-readable logs, and a post-incident report. Review cadence requires periodic civic-board review and publication of annual statistics (Mushkani, 16 Sep 2025).

The ModelOps integration pattern embeds thresholds, fallback mappings, authority levels, documentation requirements, and review checkpoints in versioned configuration. The example schema includes thresholds for disparity $$D_t \;=\; \frac{\mathbb{E}[h_t(g)]/\mathbb{E}[b_t(g)]}{\mathbb{E}[h_t(\bar g)]/\mathbb{E}[b_t(\bar g)]}$$2, safety risk per hour $$D_t \;=\; \frac{\mathbb{E}[h_t(g)]/\mathbb{E}[b_t(g)]}{\mathbb{E}[h_t(\bar g)]/\mathbb{E}[b_t(\bar g)]}$$3, and accessibility downtime 30 minutes; level-specific fallbacks and durations of 4 hours, 72 hours, and 30 days; domain fallbacks for power, buildings, and transport; documentation requirements for model card and datasheet; pre-deploy reviews including scenario walkthrough, shadow mode, and civic tabletop; post-incident blameless review and public report; and publishing to an open data portal with disparity, risk, accessibility, and quality SLA metrics.

This suggests that DAM is designed to be live in deployment rather than external to code. In the paper’s own terms, governance is treated as code or configuration plus procedural artifacts, making DAM auditable and less vulnerable to configuration drift.

7. Related methodologies, limitations, and open questions

Several adjacent papers illuminate components that DAM either incorporates directly or leaves open. “From Debate to Deliberation: Structured Collective Reasoning with Typed Epistemic Acts” characterizes itself as a strong conceptual precursor and partial instantiation of a Deliberative Audit Method: typed epistemic acts, shared workspace, tension preservation, minority report, reopen conditions, and a convergent flow algorithm supply a formal process architecture for auditable deliberation (Prakash, 12 Mar 2026). “A Replica for our Democracies? On Using Digital Twins to Enhance Deliberative Democracy” provides a strong conceptual and methodological foundation for the simulation-and-sandbox component of DAM by treating deliberative institutional design as something that can be twinned, simulated, calibrated, and iteratively optimized (Novelli et al., 7 Apr 2025). “AQuA -- Combining Experts' and Non-Experts' Views To Assess Deliberation Quality in Online Discussions Using LLMs” is best understood as a strong DAM submodule or baseline for automated contribution-level deliberation-quality scoring (Behrendt et al., 2024). “Question the Questions: Auditing Representation in Online Deliberative Processes” develops a justified-representation audit for question slates and effectively operationalizes a full audit framework for representation in expert-question selection (De et al., 6 Nov 2025). “Numerical evaluation of deliberative discussions of the UK food system” supplies a low-burden audit architecture for repeated-measure opinion change and reversion, and “An AI-Powered Framework for Analyzing Collective Idea Evolution in Deliberative Assemblies” offers a strong prototype of a DAM analytics stack for transcript-grounded idea flow and stance-change auditing (Buckell et al., 17 Jun 2025, Poole-Dayan et al., 16 Sep 2025). “Habermolt: Delegating Deliberation to AI Representatives” contributes the three-axis framework of representation, aggregation, and revision for auditing AI-delegated deliberation (Low et al., 23 May 2026). “Bridging Voting and Deliberation with Algorithms” contributes modular auditable components for group formation, proportional allocation, and opinion-shift tracking in hybrid democratic processes (Yang et al., 7 Feb 2025).

Within the DAM paper itself, the main limitations are explicit. The simulations are stylized, the data are synthetic, and the results are not forecasts for any specific city (Mushkani, 16 Sep 2025). Real deployments will require calibration, data-sharing agreements, privacy protections, safeguards against perverse incentives, and safeguards against strategic overrides. Thresholds encode value judgments and must be set locally. Open questions include realism and external validity, threshold calibration, privacy-preserving public reporting, institutional burden of recurring deliberation, governance against misuse or strategic override, legal and organizational feasibility of civic-board authority, and integration with existing safety and regulatory frameworks.

Taken together, these materials place DAM in a broader research program on contestability, reviewability, and operational governance. Its distinctive contribution is to specify the procedural machinery by which override authority becomes authorized, evidence-based, bounded, technically safe, publicly reviewable, and institutionally learnable.