# No per-person surface

> worklists.app — 2026-08-20
> Written for VC-2 — the co-manufactured mid-market CPG brand org — the brand's operations lead, new to running a floor through a co-packer, who assumes a frontline app comes with a people report and needs to understand why this one refuses.

One thesis: **this app has no per-person surface, and that absence is the product.** You can ask
*who touched this pallet* and get an attested answer. You cannot ask *what has this person done*,
and neither can anyone else with access to your deployment. Object → performer is the product;
performer → objects is refused. Every other refusal in this post follows from that one.

## What you were expecting

A frontline app usually arrives with a people view. A roster of who is on shift. A per-person
count of completed tasks. A picks-per-hour figure, maybe with a target and a color. An export to
spreadsheet with one row per worker.

You will not find any of it here, and this is not a gap in a first version. Here is the full list
of what is absent, so nothing has to be inferred:

- **No roster.** No list of people anywhere in the app, for anyone. There is no assignee column on
  a worklist, because every row is already the reader's own.
- **No per-person report.** No query that returns two performers side by side, in any face, in any
  export.
- **No per-unit-time figure.** No duration, no picks per hour, no time in queue, no shift progress
  bar, no "ahead of / behind," no streak. Allowed: a count, a step indicator within one task, and
  a timestamp.
- **No presence.** No "online now," no connected count. A transport that can enumerate who is on
  shift is a roster arriving as an implementation detail, so the transport does not expose one.
- **No supervisor face.** A supervisor who opens a deployment is a performer in it or is nothing in
  it.
- **No target, no scoreboard, no badge, no level.** Turning a per-unit-time figure into a game is
  still a per-unit-time figure.

## Why, in one sentence

Because the thing you are paying for is an attested *who* on every event, and the attested *who*
is only there as long as the people supplying it have no reason to make it flattering.

The moment an app will answer *what has this person done*, every person on it has a reason to make
the answer look good, and the cheapest way to do that is to stop scanning honestly — to scan the
easy case twice, to skip the one that will be slow, to close on the tap and not the pallet. A
per-person report poisons the ledger it is drawn from. Your recall record on a lot of lettuce is
made of that ledger. You cannot have both.

## What you do get, fully

**Who touched this pallet.** Ask it of any object — a case, a pallet, a lot under recall — and the
answer is every attested act against it: the receiver at dock 12 at 06:14, the inspector at 06:40,
the approving shift lead at 06:52. Names, places, times, event hashes. This is the question an
auditor, a customer and a chargeback panel ask, and it is answered without reservation.

**Who holds this task.** A task's own record shows its assignments and its current holder. That is
the object → performer direction, and it is permitted.

**A count.** How many tasks are pending at this station. How many were closed against this PO. A
number about work, not about a person.

## Where the line is enforced

Not in the screen layout, where a column could be added next quarter. The work door behind this
app, [worklists.dev](https://worklists.dev), refuses the performer → objects direction where a
query is constructed — in the row grain, in the group-by, in the parameters by name and by value,
and in the keys a face would render. A request for your deployment's data that groups by person
does not return a permission error. It returns a typed refusal, because the query cannot be built.

And a worklist query has no field for an assignee at all. "Me" comes from the login. There is no
way to ask for someone else's list by writing a clever request.

## Identity is regime-scoped

Where a regulation requires the performer be identified — food-safety monitoring under HACCP,
forklift operation under OSHA, and the like — who-completeness on those events is a compliance
metric, and it is legitimate because the regulator set it. Where nobody requires it, it is not
sold. **A scope with no cited authority does not get the metric.** Your deployment's regime is
compiled in, and the screen tells each person which one they are under.

That is what keeps a frontline app from becoming the whip, and it is what lets the people on your
co-packer's floor scan into it as if it were a record rather than a trap.

## What to tell the person who asks for the report

That the report and the evidence cannot both exist, and the evidence is what the customer's auditor
will accept. Get started with an evaluation deployment, try to find a list of people in it, and then
ask it who touched a specific pallet. One of those comes back.

---
Get started: https://worklists.app/get-access/ · All posts: https://worklists.app/blog/ · Machine face: https://worklists.app/llms.txt · Product document: https://worklists.app/product.md