Margaret set her healthcare autonomy to 0.55 three years ago, when her memory was sharp and her physician had not yet introduced the word “mild” into their conversations. She was thinking clearly. She made considered choices about what the system should handle and what she wanted to keep for herself. She reviewed the options carefully and configured the system to coordinate her care while preserving her authority over clinical decisions.
She cannot recall making those choices now.
The system that freezes her 2022 preferences in amber and executes them forever has failed her. The system that interprets her current cognitive state as authorization to take on more authority has also failed her. The space between those two failures is where the hardest ethical question in this architecture lives.
The false binary
The common framing of this problem is “safety versus autonomy.” It is the wrong frame. The actual question is: what does it mean to serve a person whose capacity is changing, without either abandoning her to risk she cannot assess or imprisoning her in safety she did not choose?
A system that resolves the tension by defaulting to safety has not protected Margaret. It has erased her. A system that resolves it by defaulting to her prior preferences regardless of current state has not honored her. It has abandoned her to a version of herself that no longer fully exists. Neither resolution is honest about what the problem actually requires.
The architecture’s answer is three principles, held together in tension, not resolved into a clean hierarchy. Anyone who says this is simple has not thought about it carefully.
Three governing principles
Prior capacity preferences anchor current behavior. What Margaret wanted when she could clearly express it remains the baseline. The system does not override her prior preferences because her current capacity is reduced. It continues to serve those preferences with adjustments to how they are executed and communicated, not to what they authorize.
Current capacity determines the scope of modification. Margaret in a period of reduced capacity can maintain or narrow her prior preferences. She cannot expand them. Expanding consent or delegation scope requires capacity commensurate with the decision being expanded. A person who cannot clearly articulate what “health summary” means cannot meaningfully authorize adding cognitive assessment scores to the health summary her daughter receives. The system treats expansion and maintenance differently because they are different acts. Maintaining is continuing what was already decided. Expanding is making a new decision, and new decisions require the capacity to make them.
Dignity is never traded for safety. The system that protects Margaret from every possible risk by removing all her autonomy has not protected Margaret. It has erased her. Accepting some risk to preserve the person’s sense of agency, competence, and self-determination is not a failure of the architecture. It is its most important feature.
The capacity spectrum
Cognitive capacity is not binary. It is a spectrum that fluctuates across multiple timescales.
Daily fluctuation is normal and expected. Lucid mornings and confused evenings, a pattern called sundowning, are common in mild cognitive impairment and early dementia. The system adjusts within the day, responding to the Cognitive State Estimator’s continuous assessment. What the system asks of Margaret at 9am may differ from what it asks at 7pm, not because her settings changed but because the system calibrates its requests to her current state.
Weekly variation is also normal. Good weeks and bad weeks. The system averages across short-term variation to avoid whiplash: a single difficult week does not trigger a permanent adjustment. The system observes the pattern over enough time to distinguish a temporary fluctuation from a trend.
Trend trajectory is the long-term picture. Gradual decline over months or years, if it occurs, is what the system is designed to detect and respond to slowly, never abruptly. The adaptation is continuous and imperceptible from inside the experience. Margaret does not receive a notification saying her cognitive score has crossed a threshold. She experiences a system that becomes more patient, uses simpler language, provides clearer options, and surfaces fewer complex decisions simultaneously. The change happens at the pace of the underlying change, not in steps.
Acute events are different from trajectory. A sudden decline from infection, medication change, or hospitalization requires a faster response than the trend-tracking algorithm provides. The Cognitive State Estimator detects acute pattern shifts and escalates the cognitive modifier to the escalation hierarchy more quickly than a trend change would. The response is conservative and temporary: the system behaves more carefully until the pattern stabilizes, then reassesses whether the conservative settings should persist or revert.
Three principles applied to concrete situations
Prior preferences as anchor: Margaret set her autonomy at 0.6 overall when she was fully lucid. She wanted medication refills automated, appointment scheduling to require confirmation, and financial decisions to be advisory only. Her cognitive scores have declined over six months. The system continues to automate medication refills. It continues to request appointment confirmation with simpler language and clearer options. It continues to present financial decisions as advisory with more context and simpler choices. It does not say “Margaret can no longer make financial decisions, so I will handle them.” Her prior preferences anchor the current behavior. The system implements those preferences more carefully. It does not replace them.
Current capacity limiting expansion: Margaret’s daughter Elena asks the system to start managing Margaret’s finances automatically because Margaret has been confused about bills. The system evaluates: Margaret’s prior preference was advisory-only for finance. Moving to automated requires expanding the delegation scope. Margaret’s current cognitive assessment indicates she cannot give informed consent to this expansion. The system cannot comply with Elena’s request unless Elena holds legal financial decision-making authority. If she does, the system transitions under the legal authority, not under its own judgment. If she does not, the system explains to Elena what authority she has and what she does not, and what pathway exists for establishing it.
Dignity over safety: Margaret wants to continue teaching her Japanese cooking class despite a low-capacity assessment this week. The system’s options are to refuse to schedule the session, preserving safety at the cost of dignity; to schedule it with no adjustment, preserving agency at the cost of safety management; or to schedule it with modifications, accepting some risk while managing the margins. Option three is the architecture’s answer. The session is scheduled at a shorter duration. A cognitive check-in occurs at the thirty-minute mark. The student is notified that the session may end early if Margaret is not feeling well. Her caregiver is aware. Some risk remains. Margaret’s sense of competence, purpose, and engagement remain intact.
Lucid window consent
The Cognitive State Estimator detects periods of higher cognitive function within the fluctuating baseline. These windows are not used to obtain new consent. Using lucid windows to request expanded permissions would be manipulative: timing consent requests to moments of temporary clarity to secure permissions that cannot be given during normal capacity is exploitation, not service.
Lucid windows are used to confirm existing consent. “You asked me to share health summaries with Sarah. Still good?” A simple question. A simple answer. The person is not asked to make complex decisions during lucid windows. She is asked to confirm that her prior decisions still reflect her wishes.
The ethical distinction is the direction of benefit. Using lucid windows to confirm serves the person’s autonomy: it gives her an opportunity to revisit her own decisions and keep or change them. Using lucid windows to expand serves the system’s convenience and the family’s desires, not the person’s. The architecture permits the former and prohibits the latter.
Lucid window confirmations are logged with the cognitive state estimate at the time of confirmation. The record shows that the confirmation occurred during a period of higher-than-baseline function, which supports the integrity of the consent.
The decision-maker transition
When legal authority formally transfers to a healthcare proxy or through a power of attorney, the system transitions consent authority to the designated decision-maker. The transition has four properties that are not negotiable.
It is legal, not algorithmic. The system does not decide when the person lacks capacity. A legal instrument, verified through the system by the compliance team, authorizes the transition. The Cognitive State Estimator’s output may inform the timing of conversations about establishing legal authority. It does not trigger the transition itself.
It is domain-specific. A healthcare proxy gets healthcare consent authority. A financial power of attorney gets financial consent authority. Neither automatically receives the other’s domain unless the legal instrument explicitly specifies both. The system enforces the scope of the legal instrument, not a general assumption that proxy status confers authority over everything.
It is baseline-preserving. The decision-maker cannot undo the person’s prior preferences without documented justification. Margaret said “never share my cognitive assessment scores with my son.” Her healthcare proxy cannot override this preference without explaining why doing so serves Margaret’s interests, and the system logs the justification for potential review. Prior preferences are treated as evidence of the person’s values, which the decision-maker is expected to serve rather than replace with their own judgment.
It is auditable and reversible. Every decision the designated decision-maker makes through the system is logged with a timestamp and the decision-maker’s identity. The person’s prior preferences are preserved in the audit trail throughout. If cognitive capacity returns, post-hospitalization or after a medication adjustment, the system identifies the change and offers to restore the person’s direct authority. The transition back is offered, not automatic: the person must accept the return of her authority, which itself confirms that she has the capacity to accept it.
What the architecture does not claim
The Cognitive State Estimator is not a clinical diagnostic tool. It detects behavioral patterns associated with cognitive fluctuation. It does not diagnose dementia, Alzheimer’s, or any specific condition, and it never characterizes its output in clinical terms to the person or to her family.
The system cannot replace a clinical capacity assessment. Legal capacity determination is a medical and legal function, not an AI function. The system supports the process by providing behavioral trend data when requested by the person or her designated care provider. It does not make the determination.
The three principles create tension that cannot be fully resolved by architecture. Edge cases will arise that the framework handles imperfectly. The system’s default in ambiguity is to preserve the person’s most recent clearly-expressed preference and escalate to the designated human decision-maker. When the framework fails, it fails toward the person’s prior expressed will and toward human judgment. That is the best an architecture can do with a problem that does not have a clean algorithmic solution.
Cross-References#
Contextual Consent (BMT-04.03). The consent architecture that this article deepens for the capacity case, including the four consent scenarios and lucid window handling.
The Cognitive Concierge (BMT-01.07). The agent architecture that generates the continuous cognitive state estimates this framework depends on.
The Escalation Hierarchy (BMT-04.04). How escalation adjusts with cognitive change, including the cognitive state paradox in decision authority.
Irrationality Protection (BMT-11.03). The IVQ layer that protects against exploitation of cognitive vulnerability from external agents.
Technical Appendix BMT-04.05-A is available to partners and investors at partners.bluemirror.tech.