Day One: designing for the officer who is present at both ends.

Holding one person for a year runs to roughly $150,505, and the seventy-two hours after release decide an enormous amount.

For about 625 days somebody tells these people where to be. On the last morning it stops at once.

We began with the obvious response: they walk out with the first week already on their phone, the premise most reentry technology is built on.

Each is small. Together they end every version of a service that reaches the person after the gate.

Nobody is released with a phone. No device, no number, no account. Every assumption about reaching the person after release fails on that sentence.

Institutional IT is air gapped. A deliberate security posture, not a procurement gap waiting to be fixed.

The American evidence does not transfer. Published reentry research describes a privatized system where Canada's is public.

Three of us worked in parallel for eight weeks on one shared research document.

• I mapped where an officer's information comes from
• I audited the hypothesis against the Privacy Act, the CCRA, sixteen commissioner's directives and Treasury Board policy
• I specified the assistive-AI field map and its refusals
• I wrote the cost case
• Natashi Sills built the dashboard; Yuki Shi the app and the card

The institutional parole officer follows a case from intake to release, and sits inside the air gap by employment.

So the project moved its subject. The named persona gave way to two archetypes, because a name and a face invite a reader to picture one officer instead of 1,272.

A record has a template, a deadline, and somebody who notices when it is late. Release planning has none.

The two activities that most decide whether a release holds are neither mandated nor productive of an artifact, so they lose to work that leaves a trace.

That is structural, not motivational, which is what tells you what to build. Give it a form and it competes.

Collapsing inferred into guessed overstates the uncertainty. Collapsing it into verified is a lie.

Twenty nodes and twenty-one edges, with line style carrying confidence so a reviewer needs no legend lookup.

Then the notation earned itself. The only dotted edge with an empty governing-rule column carries the community officer's reporting instructions to the person. It exists on the word of two practitioners.

Constraint-first rather than ideation-first: the directives settled more design questions than a workshop could have.

A rule tells you which of your options were never available.

The problem is not that a drafting assistant might be wrong. It is what being wrong means here.

A fabricated sentence in an assessment that reaches the Parole Board is disqualifying, and one instance would end a pilot. The usual mitigation is review on top of generation. I took the generation out.

Applications became deterministic pre-fill from verified fields, so there is nothing to fabricate. The facility-rules directory is maintained by people, because a hallucinated eligibility rule sends somebody to a door that turns them away.

A room asked to accept AI inside a prison should be suspicious, and reassurance does not answer that. A rule you can look up does, so every change is stated as a pain, a fix, and the basis the fix stands on. Two rows police that standard in public, and one has no citation at all, because there is not one. Marking the weakest rows made the board harder to attack: a reviewer who finds the soft spot unaided stops trusting the strong rows.

The pitch needed an argument in the language the buyer uses, and nobody else was going to write it.

The discipline is the tagging: published reporting is sourced, arithmetic on it derived, our estimates modelled.

I expected that to be disclosure and it was defence. Challenge the twelve hours saved per case and the board has already conceded it is an estimate.

The class response was that the argument was sound and abstract at once, so I gave the savings somewhere to climb, starting at one case.

The boards above are mine. These six are my teammates', and the convergence is the finding.

Her five tracks are my five jobs, and neither of us numbered them together. Her app refuses score, streak and leaderboard, which my field map states as a rule. The printed card crosses the wall when nothing digital can, and nobody specified who prints it.

Nothing here has been operated by a parole officer. Three things survive scrutiny anyway.

Evaluative testing inside a federal security perimeter, on an eight-week timeline, was not achievable once the access had gone on interviews. I would spend it the same way again, and it is why the research here is strong and the testing is not.

The money is the softest: $18.5M against a $3.86B budget is half a percent. The capacity figure is the argument, at 41 officer-years.

The second is the one nobody planned. Three of us worked in parallel with no reconciliation pass and the artifacts agree checkably: her five tracks are my five jobs, and her interface copy is my field map's human-in-the-loop rule, written by someone who never read it.

The third is that it was delivered, and nobody pushed on AI inside a government system or on data privacy, the two objections that had dominated every prior review.

The plan called for one, and three workstreams started without it. It worked, but three people is small enough to hold one model between them, and on a team of eight the thread would have broken.

The other thing I would change is cheaper. The air gap and the no-phone rule are both in public documents, and either read in week one would have redirected the concept. Before any concept work, write down what the deployment environment physically permits.

And the only iteration cycle that ran on outside input was the afternoon after the pitch. It beat three of our own. The review I ran on my own deck reversed an earlier pass of mine that had prescribed a label on every slide, which is the thing worth keeping: a usability heuristic run over a presentation treats listeners as users of an interface.