Catalyst Conference 2008

Blog powered by TypePad

« Keeping track of authorization management | Main | Some thoughts on the RSA Conference »

January 24, 2007

Law of Relational Risk

In a previous post, I postulated on the Law of Relational Symmetry. In this post, I offer a further law of relation: the Law of Relational Risk. It’s a simple law, but I believe leads to important conclusions about how relations are structured.

    Contribution to the relationship that is not met proportionally by the other participants is a loss to the contributor.

It’s common knowledge that participants in a relation are at risk of losing time, energy, money, health, emotional stability, and any other kind of contribution they could make to a relationship. Given that most of these are exhaustible resources, participants are justifiably wary of entering nothing-for-something relations. But the key, often overlooked point is that unreciprocated contributions are what constitute losses. Unlike poker, it’s when other players don’t call a bet that the initiator loses. In many ways this law encapsulates important aspects of game theory, such as the Prisoner’s Dilemma.

Because of the need for reciprocation, loss of one’s contributions is generally a secondary concern in relations. At the core of most relation-based conflicts is the instinctive desire not to get suckered or be made a fool of; no one wants to be left holding the bag. Duped: few concepts have such a wealth of synonyms or idiomatic phrases. No one wants to be tricked, deceived, conned, taken in, swindled, hoodwinked, cheated, double-crossed, ripped off, or defrauded or to have the wool pulled over one’s eyes. No one wants to be strung along, beguiled, mislead, bluffed, gulled, hoaxed, fleeced, cuckolded, hustled, swindled, betrayed, forsaken, sold out, had, snowed, screwed over, shafted, or hung out to dry. In other words, the risk of betrayal is what participants in a relationship fear most.

The law of relational risk suggests that where the expectation of loss is high or the potential severity is high, the relation itself is at risk and collaboration is unlikely to occur. The potential for loss has therefore engendered a great many risk avoidance and loss acceptance strategies in relationships—both at the individual and societal level. The following list is here for illustrative and rhetorical purposes, and not meant to be exhaustive.

Societal strategies for relational risk management
Societies have vital interests in ensuring that relationships form, remain relatively stable through their lifecycle, and terminate peacefully. Some of the societal approaches include the following.

Shared beliefs
Culture, values, and shared beliefs improve parties’ confidence in assessing risks. This is particularly true where the culture practices reciprocity—possibly through status and reputation—in connection with stated values. Participants with similar ideals have a framework for anticipating how other participants in a relation will respond. If all parties believe lying is bad (and have basically the same belief about what lying is), then the likelihood of deceit in the relation decreases significantly.

Some beliefs instill fear in would-be perpetrators. Other beliefs, such as the ideas that energy is never lost, that a good deed is its own reward, that karma eventually catches up with defectors, and that “what comes around goes around” help participants deal with loss and possibly encourage them take greater risks as well.

Social conventions
Industry standards, coalitions, and self-imposed public policies are types of social conventions that set expectations of behavior in relationships.

Contractual arrangements
Externalizing expectations beyond shared beliefs helps participants and observers be clear on their roles and obligations. So, for things that really matter, better get it in writing. And it would be even better to have some disinterested party vouch for it; still better to have access to an arbiter with power to enforce contracts. A written agreement also enables the holders to publicly shame or punish a defector.

Barriers to exit
Some relations are constructed in such a way that it is very difficult to exit a relation. The hope is that the parties will “work it all out” if they see that their fates are inextricably linked. There is some merit to this idea. Per Axelrod, collaboration is more likely when participants perceive an indefinite term to the relationship; or more accurately, that transactions will continue among participants indefinitely. But for this approach to work fairly (or at least without exploitation), the relation requires a high degree of symmetry—something not often seen in the wild.

Structural solutions
Resourceful societies can spread risk across many relations, using the law of averages to create an insurance policy against loss.

Individual and organizational strategies
Some of the following strategies are applicable to both individuals and organizations, but they don’t always achieve societal scale. Here are some ways individuals behave in the face of relational risk.

Duration
One way to limit risk exposure is by returning to parity in the shortest possible period of time. This could mean lots of short-lived relations if the transactions are short-lived. But for expensive, complicated transactions it could mean years. Time is a critical enough issue in relations that it deserves its own blog entry, so I will return to this topic later.

Gamble
Some play the odds by making guesses on relations, limiting risk exposure based on instinct and available resources.

Exploit
Create asymmetric relations through slanted terms that increase your odds of not losing.

Violence and force
I’m not an expert on this. Apparently, some people resort to violence to get their way.

Toward a balanced approach to management of relational risk
Many of the approaches I’ve listed are at least moderately effective—which is why they’re still used. But they don’t often produce balanced results, because most of these methods are one-sided, unilateral attempts at maximizing the relation for any particular party (including society). One party may choose the exploit method, which perhaps leads other parties to violence. But is it possible to approach the risks of getting led on and of losing one’s investment in a cooperative way? I believe with the development of a few principles, we can improve the odds for all parties. For starters, literature on social dilemmas suggests that equilibrium and continuity in relationships promote collaborative action. Here I’ll try to formalize a few of these notions in the context of identification technologies.

The Principle of Relational Equilibrium
The law of relational risk suggests that by balancing risk across parties and maintaining equilibrium through the transaction, parties will perceive balanced incentives to cooperate. That is, balanced fear of loss among parties promotes cooperation. For the sake of discussion, I’m introducing the notion of a risk cycle, which describes the iterative process of proposing an action and its eventual result in the relationship. The phases of the risk cycle I refer to as the ante, the match, the transaction, and the shared result.

Using this terminology, the principle of Investment Equilibrium is that parties should maintain proportional risk exposure through a risk cycle.

  • Parties may have widely differing risk capacity, in absolute terms, as a function of their resources. The idea is that for every ante, reciprocation is bounded proportional risk exposure.
  • The phases may be iterated, with the outcome of previous phases in memory. The beginning of a relationship therefore has a different risk profile than a long-standing relationship. At the beginning of the relationship, risk of exploitation is high, so trust should be low.
  • If a deal goes bad, all parties should experience the loss equally. For example, if my credit card is stolen, the perceived loss to the credit card company should be analogous to the loss I experience.

The principle of Relational Continuity
Cooperation depends on participants’ belief that others will stay in the relation through the risk cycle (ante to shared result). The principle of Relational Continuity is that some structure must give parties equal assurance that the relationship will persist through a risk cycle.

  • Note that the relationship must persist, but actors in the relationship may in fact change. For example, a homeowner’s association continues to exist even as people move in and out of the neighborhood.
  • The relation therefore has an identity all its own that is only loosely related to the participants in it.
  • The relation continues to exist as long as all the committed roles are filled.
  • Identification plays a part in allowing parties to recognize each other and to seek redress if things go wrong, but such identification needn’t be synonymous with the person’s identity from other contexts.

Significance of the Principles on Identity Management Technologies
The principles are much more than an academic exercise—they have real ramifications for designing identity—and relation—systems. As a means of promoting relational continuity, for example, the principles suggest that issuance of IDs to participants is only a partial solution. Relations must be addressable resources separate from the actors involved. Further, each relation needs a definition of roles—symmetrically formed—that embody equilibrium for participants. And there must be rules stipulating that participants can't leave a relation without either settling all one’s outstanding transactions or designating a proxy. And finally, as participants fill roles in the relation, they receive those rights by recognition of the participants (and not simply by issuance of an ID).

The principles also suggest that single sign-on (SSO) efforts are often misguided. In the interest of promoting relational continuity, the more authenticated connections the better—particularly if the user can parlay these authentications into improved reputation. Recognition of participants based on multiple channels of connectivity would be the method for improving identity assurance rather than on a single login event. (This is a bit of a teaser: I plan to go into much greater detail on multi-factor identity in a follow-on post.)

Another idea for a follow-on post (and hopefully some industry discussion) is a kind of “SSL” sessions for relationships—for now I’ll call it Relational Continuity Sockets Layer. It would allow multiple participants to interact on a channel that is secure for the duration of the relationship or at least one risk cycle (this means longer-lived sessions than SSL) and allows for relation IDs (similar to session IDs). Such an invention would also address the requirements of addressable relations, as mentioned above.

In summary, today’s identification technologies aren’t sufficiently featured for building and sustaining symmetrical relationships.

[posted by Mike Neuenschwander]

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/t/trackback/1045303/7612312

Listed below are links to weblogs that reference Law of Relational Risk:

» Look Up! from Perilocity
Something that promotes looking not just across the table, but also up to society, sideways to similar groups, backward to precedent, and forwards to posterity. [Read More]

» Diversity as a form of Defense in Depth from tuesdaynight
I was thinking about David Maynors post on Ciscos latest security updates. His feelings are quite clear on the danger of a homogenous network: Again let me state for the record how I feel about this: do not buy a single vendor solution fo... [Read More]

» Thoughts on Relational Continuity Sockets Layer from tuesdaynight
Mike has clearly been doing some heavy thinking and his recent post on his Law of Relational Risk is evidence of that. Mikes last idea in the piece caught my attention, the notion of Relational Continuity Sockets Layer. The idea is that: It wo... [Read More]

Comments

Post a comment

Comments are moderated, and will not appear on this weblog until the author has approved them.

If you have a TypeKey or TypePad account, please Sign In