This paper is primarily aimed at professionals who have been involved in “architecting” large scale, multi agency socio-technical systems particularly in the areas of care and wellbeing. Their work has been situated at the interface between management, practice, public sector commissioning and legal, regulatory and statutory matters, in the context of data and communications platforms and environments. This is a context which has been prone to outright failure and under performance for many years. Seasoned, systems practitioners oen wonder “why does it all go so horribly wrong so regularly?” The standard response is to try to identify mishaps and mistakes and to assign blame, but the fundamental nature and adequacy of our information and communications systems paradigms is rarely questioned. The background to this paper assumes that this failure is due to a fundamental mismatch between the real world, emergent complexities that are being addressed and the limitations of the architectural paradigms which are built into current technical, legal and commercial practices. This paper represents an attempt to identify a practical path toward a better way of deploying and governing the platforms that support the delivery of relational and transactional services. The path suggested, builds on, and extends, an important and long-standing strand of thinking in IS based on the Language Action Perspective which represents a rejection of the narrow functionalist and process/data driven approaches and adopts a more communications oriented approach to socio-technical processes. We explore the architecture for a proposed Trustworthy Governable Platform (TGP), able to deliver systemic responses to delicate social dimensions, such as accountability (the reliable attribution of credit and blame in relation to outcomes), and contextual integrity (respect of privacy and the uses that are made of personal information) in dynamically evolving, multi-agency settings of business and public service. Since the requirements that the TGP architecture attempts to address are those of human relationality, at a very fundamental level, we look to Heidegger to provide our philosophical underpinnings STPIS'25: The 11th International Workshop on Socio-Technical Perspectives in IS (STPIS'25) September 17-18 2025
1. Introduction Providing the appropriate balance between dynamic exibility and stability in platforms to support networks of cooperating peer agencies, represents a clear example of the challenges confronting the design of coordination platforms and
management information systems (IS) [
A key element of these challenges concerns the distinction between the different sorts of decision making and design processes associated with the policy domain, on the one hand, and with the operational domain, on the other. In current practice, the former is assumed to generate the requirements for the latter and must, therefore, be completed in a prior epoch. In the sorts of multiagency environments we are considering, roles and responsibilities often require regular renegotiation and redistribution, so barriers to the success and to fitness for purpose of information and communication platforms are deeply embedded in our methods and in the commercial practice of the ways we design and supply them.
In this paper, we accept the premise that the design and operation of partnership and
community systems, in these contexts, must be based, primarily, on communicational rather than
business, functional and accounting processes. This orientation was first addressed in the
literature of the Language Action Perspective (LAP) [10, 18, 19, 20, 21] but we have the following
observations to make on that approach:
1. The LAP, limited its approach to first order conversation/speech act concepts and has failed to
provide the new foundation for IS design that it promised [4, 22, 23].
2. By including second order concepts, through the support of not just operational acts and
conversations but also conversations about the sorts of conversations that are, or will be, required,
as part of the system, [
Technology, and especially information technologies, deployed under current socio-economic practice, represent an example of the danger Heidegger warned of, this is the potential technology has to dominate our understanding and experience of the way we relate to the world and to each other [5, 24]. The architectural approach developed here is designed to minimize this obscuring tendency and to render technologically mediated relationships open to the agency and to governance of its users.
In summary, this paper will explore the concept, structure and design of a Trustworthy
Governable Platform (TGP), which represents a shift and augmentation of current Data Processing
and Distribution and Basic Communications paradigms, particularly in the context of relational
enterprises operating in multi-agency settings, where, as we have stated, complex social
affordances, such as accountability and contextual integrity, become critical [
Heidegger’s philosophy [9] challenges Descartes’ cogito, “I think, therefore I am”, by shifting the focus from individual rationality to being-in-the-world (Dasein). His existential ontology emphasizes that human experience is fundamentally relational and embedded in a world which is essentially shared. Unlike Descartes, he did not seem to favour aphorisms, but, if he had, perhaps his version would have been “We converse therefore we become”, aligning with the views he expressed in Being and Time and in later works. This formulation captures the Heideggerian idea that human existence (Dasein) is fundamentally co-constituted through dialogue, making conversation not just a means of communication, or even of acting, but also a process of collective becoming.
This perspective strongly resonates with Winograd and Flores’ work [10], where conversation is
seen as the foundation of action and understanding in socio-technical systems. It suggests that
identity and knowledge do not pre-exist but are shaped dynamically through interaction. LAP,
the Language Action Perspective, according to Terry Winograd [
We now clarify the term “conversational instrument”: Such instruments are information objects that carry the record or trace of particular instances of the exercise of sets conversational rights, obligations and responsibilities, including those associated with desires and duties to inform and needs and rights to know. Typical examples are contracts, invoices and receipts but we would also recognise, in the age of social media, a simple thumbs up emoji could, in some contexts, be taken as a simple instrument of commitment. In this approach, agendas, minutes and action lists are the instruments of a <formal meeting> conversation. These observations represent some important architectural distinctions in the domain of ICT systems: In DPD, roles, and their associated accountabilities, are reflected, in the system, as user functions and capabilities: your role is the set of things you can do to, and with, data. In a basic communications (BC) system, such as social media, structural roles, and any accountabilities associated with them, are entirely implicit and, from the infrastructural systems perspective, the only distinctions visible are between initiating and responding parties. In a structured IC system, the unit of activity is an ongoing conversation and this is defined by shared purposes together with a set of roles and associated responsibilities. These, in turn, define a set of capabilities with respect to set of conversational instruments, that is to say, types of contribution that are relevant and appropriate to a type of conversation’s logic and protocols. For example, in the <formal meeting> we have a chair, a secretary, participants and, possibly, observers.
So, the concept of structured conversation, referred to here, represents an intermediate level of pre-definition and design of the work-flow/act-flow instruments. In DPD these are completely pre-defined and transactionalised in applications work-flows and data models, in BC, they are infrastructural traffic or pay-load uninterpreted at the structural level, in SC they are instances of archetypes which define structure and purpose, rights and responsibilities, but with content that is specific to each instance and its particular context.
The second critique of the LAP approach that Hans Weigand identifies is the following:
“For Lucy Suchman, the Coordinator was not an enabler of human responsibility but
rather an instrument of management control based on a rationalistic perception of work”
[
While the introduction of LAP represents, as we have observed, the necessary augmentation of, DPD to IC, in the architectural discourse of socio-technical systems, it still maintains the classic demarcation, and hermetic separation, between the epoch of policy and design and the epoch of deployment and use. The former involves the supplier – designer/architect – policy maker conversation in which the requirements on the system, and the policies it will sustain and enforce, are established, while the latter, in general practice, involves the configuration of the users to the resulting, fixed system design. Emancipatory systems methodologies introduced the moral reordering of participative design, enabling, and empowering users, rather than only managers and proprietors, to participate in policy making and design. In such approaches, however, a fundamental issue remains: the respective systems epochs continue to be logically separate, a separation which is not fundamentally changed in more agile or extreme approaches to systems programming and development. The consequence is that information platforms are either fully infrastructural, supporting the basic communication of information between initiators and responders, with their purposes and processes remaining implicit and opaque to the platform, or they became congealed applications where information exchange in the system is mediated through the fixed application of workflows, data models, queries and reports.
The LAP assertion that “all information is communication” is equivalent to the statement that all IS use is conversational. Since IS use is, to varying degrees, institutionalised, it involves shared ethos, rules, norms and expectations and, as we have discussed, implying pre-distributions of rights obligations and responsibilities. But, in real life, such institutions usually need to be able to learn and evolve if they are to survive and succeed in the face of complexity. To achieve this flexibility, the IS platform must be able to support the ongoing negotiation and re-inscription of the rules, norms and expectations as well as support operation under them. In current practice rules, norms and expectations are only partially articulated and fixed in the external legal documentation of the “small print”, such as consents, SLAs, terms and conditions of use; they exist is a separate domain from that of technical design and operation.
We argue here that LAP practice should be augmented so as to establish and maintain the cybernetic distinction between first and second order conversations and act/commitments, that is to say, between conversations we conduct within a set of agreed commitments to shared objectives, norms and expectations and conversations about the effectiveness, appropriateness and possible revision of these commitments. Suchman’s critique of LAP is fully addressed if it is then possible for both first and second order conversations to be conducted not only in the same epoch but in the same conversational space, that is to say, with appropriately overlapping participations and representations of the respective conversational roles. Whether such overlapping participations occur, in practice, or a managerialist separation is enforced, is a matter of situated policy and power, that is to say, as a result of the ethos of the usage context and environment, it is not enforced by the procurement and technical design of the IS. 3 The TGP
The online resource annex, attached to this paper, [13], presents an outline specification of a primordial TGP architecture which directly addresses the concept of first and second order conversations and the deployment of the network nodes over which they can be conducted. We claim that this represents a response to, and encapsulation of, the fundamental requirements and affordances of social action and interaction, in the Heideggerian sense, which we have discussed in this paper, and is a potentially radical innovation in the relationship between IS thinking and IS practice. Initial implementations of TGPs are in progress and the first of these is currently under field trial in a real world, community care and wellbeing initiative in the U.K.
A consequence of our approach is that a TGP can be initially presented as a “primordial system” which is the seed from which peer agencies and their members can negotiate shared objectives, coordinate their activities and grow and evolve their partnership and shared enterprise. In most real life situations, however, the primordial system, which we will describe next, is pre-populated with initial meeting, case management and document conferencing conversations which are then available to be adapted and customised to local needs.
In its pure, initial state, the primordial system simply allows enrolled users to initiate and participate in “vanilla” conversations which have two sorts of contribution types: (a), an invitation message to a set of prospective participants to join a new conversation and (b), a contribution to an existing conversation. Thus, the pure primordial system offers a basic, more or less, unstructured communication service as an initial basis for development.
There are two fundamental architectural concepts associates with the TGP which are that of a ‘publication’ and a ‘session’. Publications correspond to the instruments or contributions to conversations and sessions correspond to the occasions when an individual, authenticated user selects one of their existing conversations, is presented with the sequence of its existing publications and, optionally, publishes a new contribution or publishes an invitation for a new conversation. So far, what we have described corresponds to a simple chat app. supporting simple, first order conversations. We will now consider the second order, which represents the innovation of the TGP.
Both the user session and each of the two primordial publications, corresponding to a chatinvitation and chatcontribution, are instances of publication architypes, and architypes are, themselves, publications. So, we can assert that all content that persists in the TGP is a publication. Further, there is a primordial role, and associated session, which supports the editing and re-publication of archetypes. In annex [13] there is an illustration of how the basic chat could be elaborated to create a <formal meeting> with roles, as we have seen, that include a chair, who can add items to the agenda, and participants who can only read agenda items making this form of meeting hierarchically, or centrally, controlled. With small modifications to the rights of roles over publication fields, this meeting architype can be made anarchic with, for example, all participants able to add items to the agenda, or it could be made democratic, where proposed agenda items require majority support to be adopted for discussion. This illustrates how the TGP is initially policy free, simply allowing the creation of discreet conversation spaces, and how different policies, about the distribution of agency and control among role holders, can be inscribed and put into practice within and between those spaces.
Since we are still applying LAP principles and, as we have observed, all IS use is conversational, this introduction of the second order conversational principle allows us to change the traditional separation of design and use epochs to an interleaving relationship between governance and use conversation sessions, the former including the creation and maintenance of conversational architypes and the latter about the generation and interpretation of instances of those architypes.
We have noted that all the items of information that are communicated and persist in the TGP are contained in publications and that publications are instances of architypes. It is also the case that instances of publications can only be generated or accessed from within properly constituted instances of sessions which conform to preexisting session architypes associated with a particular type of role in a particular type of conversation. Now each session architype is associated with a particular set of publication architypes which represent the different sorts of contribution that can be made to that type of conversation (and which roles can make them). For example, in a social care case management context, each case will be represents as an ongoing conversation between the parties involved and may have contribution types such as journal entry, contact report, expense form, case conference (a sub-conversation), current action list and current priorities/objectives.
Some of these my represent a single publication that is updated and maintained while others bay involve sequences of multiple entries over time, but the architypes of all of them are open to modi ication in governance conversations, from within the community system, over time, as practice evolves and new protocols and procedures emerge through internal learning and in response to external circumstances.
The information associated with a particular session instance, within a particular (ongoing) conversation instance, can ultimately trace the purpose and context of that publication, together with all the relevant information available to the originator, at the time of its original creation. This constitutes the provenance of the publication. In the TGP, publications and, indeed, whole conversations, may be archived and become operationally invisible, but it cannot be deleted in any ordinary use or administration session. It is a statutory requirement in the U.K., for example, that social care records must be maintained for 70 years. In the TGP, the act of destruction of publications is a very particular and significant one and the norm is that content, in all its successive editions and versions, persists in the interests of learning and accountability.
Thus, provenance is not simply a matter of who, where, when, and how? of publications, it also captures the prevailing purposes and conversational context. On this basis, we claim that the TGP supports systemic accountability in, and across, agency boundaries, in multi-agency situations. Additionally, on the basis of the fact that architypes relating to both publications as information objects, and publications as act/events, are rigorously maintained, we claim that contextual integrity [Nissenbaum, 2010] is also a systemic property of the TGP: information can only be accessed, and therefore used, in conversational sessions that have been explicitly promulgated within the system.
The pure primordial system is represented topologically as a community hub, with a community administrator role and a community administration conversation which has the effect of publishing branches. A side effect of this publication is the spawning of a cloud container which is a publication server associated with a peer information controlling entity as a member of the community. The branch administrator is able to enrol branch members who then have access to the basic chat session and have access to all the enrolled basic chat members of all community branches.
A branch comes into existence as a side effect of the publication of a branch profile in a community hub session, instigated by a community hub administrator, and the community hub came into existence as a side effect of a Federation Hub administrator session publishing its profile. So, ab initio, the primordial system comprises an empty federation hub and the TGP grows from it through the spawning of communities and these communities spawning branches that enrol users. This illustrates the emergent property of the TGP.
As we have indicated, in practice there are some additional conversation architypes, such as more structured meetings and, at the community hub level, the initial phases of use of a TGP consists in the discussions about and publication of role and publication architypes to co-construct and commit to “conversation types” such as case conferences and journals, budget management and so on. These information exchange and coordination structures are then operationalised and trialled and, on the basis of conversations about analytic evidence and the experience of use the following governance questions can be addressed in governance conversations: Is this what we intended? Do we still intend this? Can this be improved? Based on the answers to the questions, architypes may be modified and session types redistributed.
The starting point of this paper has been the insight, form the Language Action Perspective, that all information is communicational. This implies the shift in IS paradigm from the Data Processing and Distribution to that of Structured Communications, that is to say, communications conceived of as conversations between role holding individuals, in the pursuit of explicit, shared objectives, norms and expectations.
Conversational roles, in turn, are defined in terms of sets of rights and capabilities with respect to the different sorts of conversational contributions or publications which are associated with a type of conversation. Finally, these contribution publications are all instances of architypes which define their structure and orchestrate their processes and relationships, i.e. the speech acts they imply and the record they generate, in the conversational context.
In the approach defined here, IS platforms, to support living and evolving human enterprise, are not modelled in terms of business processes and data structures, or as protocols and sequences of speech acts, but in terms of networks of enterprise conversations. Such conversations may be operational, instantiating an existing set of published conversational architypes, or may be of governance, elaborating and republishing such architypes on the basis of the evaluations of their effectiveness and the outcomes they have produced, so far.
This approach addresses the two critiques LAP identified by Hans Weigand [
Early exploration and experience of the application of this TGP approach have illustrated how, for example, formal meetings, modelled as TGP conversations, can be dynamically re-modelled on a policy spectrum from completely hierarchical, through democratic to anarchic, simply by reallocating role capabilities, between chair, participants and observers, over agenda, minutes and action-list contributions, that is to say, modifying and republishing architypes. Similarly, in the context of multi-agency case management, the care record becomes an ongoing conversational trace among a “constellation” of care roles and relationships, with contributions such as journal entries, current to-do and priority lists, case conferences, as sub-conversations, and expense forms. An accountant role is included in all case conversations but only sees the content relevant to their responsibilities regarding costs and budgets.
This approach has interesting impacts on the response to information governance regulation. In sensitive and personal information situations, there is a role, automatically included in each such conversation, which is the GDPR Officer. Normally, this is a not an actively participating role but there are explicit sets of circumstances under which the information subject of a conversation can publish a contribution to the conversation which triggers the officer role and invokes a GDPR principle such as to disclose, correct or forget. The important point here is that, in the full TGP, information management, analytics and governance operations take place through explicit role/session/conversation mechanisms rather than through “back door” or platform level accesses of database administration.
All of these examples underline the observation that the proposed TGP approach replaces the concept of “data as stuff” which is controlled and contained, to information as communication in the context of conversations that establish and maintain its purposes and provenance.
The supporting outline specification [13] is open to two levels of implementation. “TGP light” is based on the deployment of a community hub and an appropriate set of branches, as URLs or as enterprise edge servers by a trusted platform supplier. In this case, the integrity and control of physical access to underlying data depends on conventional platform provision trust and contractual practice.
The full TGP architecture implementation deploys a community hub as the side effect of a Federation hub publication and the automatic deployment of cloud containers and capacities. Branches are similarly published and spawned from that community hub. The encryption of data both on the move and stationary is internal to the community and the platform supply relationship operates at the level of K8s orchestrations [ https://kubernetes.io/docs/home/ ] in a trust free environment. An instance of the TGP light platform is undergoing field trials and evaluation in a real-world community care project in the UK. The full TGP trust free platform is currently in an advanced stage of technical development.
The ultimate objective is to publish a core, primordial TGP as open source.
The author(s) have not employed any Generative AI tools.
God.
ger-la-questione-della-tecnica. (023 [14] The “ordo amoris,” or, ordered loves, emerges from scripture and was first articulated as such in the 5th century by Augustine of Hippo in The City of [15] M. P. Rosito, M. Heidegger: la questione della tecnica. Un saggio metafisico sull'essenza. Online resource: https://www.meer.com/it/75443-m-heideg[16] P. Rittgen A Framework for Language-Action Modeling in UML Managing Modern Organizations Through Information Technology, Proceedings of the 2005 Information Resources Management Association International Conference, edited by Mehdi Khosrow-Pour. Idea Group Inc. 2005 [17] J. Habermas Theory of Communicative Action, trans. Thomas McCarthy, Boston: Beacon Press. 1984 [18] G. Goldkuhl & K. Lyytinen Information systems specification as rule reconstruction, in Bemelmans T (Ed 1984) Beyond productivity: Information systems development for organisational effectiveness, North-Holland, Amsterdam. 1984 [19] G. Goldkuhl LAP revisited: Articulating information as social relation Invited paper to the LAP workshop, Tilburg, The Netherlands. 2017 [20] F. Flores Pluralistic Networks. See: https://conversationsforaction.com/fernando-flores; Plural https://www.plurallearning.com [21] O., Eriksson & P. J. Ågerfalk Speaking things into existence: Ontological foundations of identity representation and management. Information
Systems Journal, 32(1), 33-60. 2022 [22] T. Winograd, Ed. Bringing Design to Software. Addison-Wesley. 1996 [23] T. Winograd The design of interaction. In P. Denning & B. Metcalfe, Eds, Beyond Calculation, The Next 50 Years of Computing. SpringerVerlag, 1997