Kybernetika záměrného tření: Kognitivní autonomie, pasti plynulého UX a fyzická digitální suverenita

Research Paper (Open Access): The full 28-page preprint is published and indexed on Zenodo under permanent DOI: 10.5281/zenodo.22735874.

Author: Bekzhan Ramazanov
Independent Researcher / Systems Architect
Prague, Czech Republic
www.ramazanov.cz

---

Abstract

The dominant paradigm in Human-Computer Interaction (HCI) and consumer software engineering posits the systematic elimination of interaction resistance—termed “Seamless UX”—as the primary index of architectural optimization. This paper presents a structural critique of frictionless interaction models across neurobiological, game-theoretic, cybernetic, and infrastructural dimensions. We demonstrate that zero-friction interfaces actively induce cognitive passivity, degrade supervisory prefrontal control, and externalize severe tail risks onto human operators, culminating in systemic socio-technical vulnerabilities such as Multi-Factor Authentication (MFA) fatigue exploits and Automated Transfer System (ATS) banking compromises.

Applying Daniel Kahneman’s dual-process cognitive architecture and Donald Broadbent’s learning modes, we evaluate how sensory habituation and motor automation erode operational vigilance. We formalize interface design as a non-cooperative game, demonstrating that absent regulatory intervention, platform market competition produces a Pareto-suboptimal Nash Equilibrium characterized by stripped verification checkpoints and asymmetric risk externalization. We expose the hidden operational expenditure (OPEX) inflation of flat friction curves, proving that unmitigated seamlessness shifts costs to customer support escalation, fraud litigation, and catastrophic user churn. Applying W. Ross Ashby’s Law of Requisite Variety, we establish why one-dimensional software confirmation channels cannot regulate high-variety socio-technical disturbance vectors, extending this cybernetic limit to synthetic, homogeneous AI testing environments. Finally, we propose the Cybernetic Triad of Intentional Friction: a structural design framework establishing spatial-motor discontinuity, orthogonal dimensional variety, non-linear risk-scaled friction, and hardware-enforced boundaries to restore cognitive agency and local data sovereignty in safety-critical computing environments.

Keywords: Intentional Friction, Cognitive Ergonomics, Human-Computer Interaction, Behavioral Game Theory, Ashby’s Law, Tangible Computing, Local-First Architecture, Socio-Technical Cybernetics, FIDO2, Risk Asymmetry.

---

1. Introduction: The Illusion of Zero-Friction

Over the past two decades, software product design has coalesced around the doctrine of “frictionless computing”. Rooted in high-frequency consumer conversion metrics, software architectures have systematically purged mechanical, cognitive, and procedural verification boundaries. Single-click checkouts, persistent web sessions, biometric background authentication, and single-tap approval prompts are celebrated as ergonomic triumphs.

However, treating all operational resistance as architectural debt conflates two fundamentally distinct classes of interface resistance:

• Accidental Friction: Inefficient interface layout, inconsistent typography, bloated data entry schemas, and unoptimized layout rendering caused by negligent development.
• Intentional (Essential) Friction: Deliberate cognitive, sensory, or mechanical boundaries engineered to interrupt automated motor routines, force explicit mental modeling, and authenticate human intentionality prior to irreversible state transitions.

The wholesale eradication of essential friction has produced an acute systemic crisis: human operators are forced into continuous, unreflective cognitive auto-pilot. In safety-critical operational environments—ranging from cloud infrastructure administration and enterprise authentication to consumer financial settlement—zero-friction design turns the human operator into an exploitable single point of failure. As Norbert Wiener (1948) established in foundational cybernetics, stable homeostatic control depends fundamentally on the integrity and fidelity of feedback channels; stripping operational resistance dismantles the corrective communicative feedback required to govern complex systems. To understand and remediate this failure mode, interface architecture must be re-evaluated through the lens of cognitive ergonomics, empirical breach analysis, game theory, and cybernetics.

---

2. Neurobiology and Cognitive Ergonomics of Interface Modalities

2.1 Spatial/Graphical vs. Formal/Command-Line Modalities Under Fatigue

Human-computer interaction regimes determine the rate at which neural metabolic resources are consumed during operational problem-solving. Svendsen (1991) demonstrated that direct-manipulation Graphical User Interfaces (GUIs) degrade systematic problem-solving relative to formal Command-Line Interfaces (CLIs). Utilizing the dual-mode learning framework of Broadbent and Berry (1987), Svendsen proved that direct-manipulation environments induce unselective implicit learning (U-mode), characterized by low-cost exploratory trial-and-error behaviors where operators alter external states without constructing robust internal mental models. Conversely, command-driven interfaces compel selective explicit learning (S-mode), requiring verbalizable working memory operations, hypothesis testing, and state forecasting prior to command dispatch.

O’Hara and Payne (1998) formalized this dynamic as operator implementation cost: the temporal, physical, and cognitive effort required to execute an operation. When implementation costs are low (e.g., single-click commands), operators rely on shallow visual heuristics. Elevated implementation costs function as an external governor, forcing the operator to construct longer look-ahead search trajectories in working memory before committing changes.

Under physiological depletion, acute stress, or circadian disruption, interface modality dictates operational failure profiles:

• The CLI Paradox: Under extreme cognitive fatigue, command-line interfaces preserve systemic safety through strict syntactic constraints: an exhausted operator who mistypes or enters an invalid argument triggers a terminal syntax error, failing safe. However, in an unconstrained CLI shell (e.g., raw bash execution), the absence of persistent spatial state representations (HUD) places total reliance on volatile working memory.
• The GUI Failure Mode: Graphical direct manipulation saturates the visual-spatial processing stream. Neuroergonomic studies by Trimmel and Huber (1998) recorded a statistically significant attenuation of the P300 event-related brain potential (ERP) amplitude alongside positive direct current (DC) shifts during sustained computer interactions, indicating severe cortical resource depletion and impaired working memory consolidation. When fatigue impairs prefrontal supervisory control, GUI operators succumb to visual capture, treating critical production confirmation modal dialogs as routine interruptions to be dismissed on motor auto-pilot.

2.2 Cognitive Switching Costs and Motor Cortex Activation

Modern seamless UX targets Daniel Kahneman’s (2011) System 1: an evolutionary, rapid, associative, automatic, and metabolically inexpensive operational state. System 2 represents slow, deliberate, analytical, rule-governed, and computationally demanding cognitive procedures.

Continuous input within a single modality (e.g., uninterrupted typing on a keyboard or rapid mobile swiping) relies on motor chunks consolidated within the supplementary motor area (SMA) and the basal ganglia. These feedforward motor routines fire ballistic sequences without executive verification.

Introducing a physical friction point disrupts this automated loop:

1. Requiring an operator to interrupt keyboard input, reach across physical space, orient an isolated cryptographic hardware token, and insert it into a physical port forces a recalibration of egocentric space.
2. This tactile transition recruits the primary motor cortex (M1), primary somatosensory cortex (S1), and anterior cingulate cortex (ACC).
3. The ACC acts as an endogenous conflict monitor. Upon encountering a mechanical barrier, it generates an Error-Related Negativity (ERN) signal, suppressing basal ganglia motor routines and engaging the dorsolateral prefrontal cortex (dlPFC).
4. The physical action operates as a non-bypassable, biological cognitive forcing function, transitioning the operator from System 1 automaticity to System 2 conscious deliberation.

2.3 Agency, Effort Justification, and the Rejection of Operator Infantilization

Perceived agency—the subjective experience of being the causal author of an action and its environmental consequences—is fundamentally tied to sensorimotor feedback, effort expenditure, and temporal contiguity.

In behavioral economics, Norton, Mochon, and Ariely (2012) formalized the IKEA effect: self-directed labor invested in completing an artifact substantially increases the subjective valuation attributed to that artifact. Rooted in Festinger’s (1957) theory of cognitive dissonance and effort justification, individuals assign up to 63% greater economic valuation to self-assembled items than to pre-assembled equivalents. When an individual expends physical or cognitive effort, cognitive dissonance requires a psychological realignment: to justify the resources expended, the individual elevates the perceived utility, security, and attachment associated with the completed state.

Zero-friction digital environments produce an operational alienation: by removing subjective labor, seamless interfaces induce learned helplessness and degrade operational commitment. Operators managed by zero-friction systems display an external locus of control, viewing catastrophic failures as ambient platform events rather than failures of vigilance.

Crucially, modern interface design has pursued a pathological objective: designing systems that accommodate the absolute lowest denominator of user attention—effectively infantilizing the human operator. By removing all demands for procedural discipline, software systems condition operators to expect zero consequences for unconsidered actions.

In high-reliability organizations (HROs) such as commercial aviation, nuclear operations, and trauma surgery, this design assumption is explicitly rejected:

• Commercial aviation cockpits do not eliminate pre-flight physical checklists under the rationale that pilots might find them tedious.
• If a flight crew fails to confirm flap settings or ignores an altitude warning horn, the sociotechnical architecture places direct personal and regulatory liability on the operator.
• Interface friction in safety-critical systems serves as an essential attentional contract: it does not exist to babysit the irresponsible, but to establish a deterministic boundary within which a trained, accountable operator is held liable for intentional actions.

By demanding deliberate physical and procedural attestation, interface architecture restores personal accountability, reversing the operational decay caused by cognitive infantilization.

Ergonomic and Neurobiological Parameter	Direct-Manipulation GUI	Command-Line Interface (CLI)	Tangible / Hardware-Bound Interface
Cognitive Processing System	Kahneman System 1 (Intuitive, opportunistic)	Kahneman System 2 (Analytical, rule-based)	System 2 anchored by mechanical forcing functions
Broadbent Learning Modality	U-Mode (Implicit, trial-and-error)	S-Mode (Explicit, hypothesis testing)	S-Mode integrated with physical spatial schemas
Primary Neural Substrates	Ventral visual stream, basal ganglia schemas	Prefrontal cortex (PFC), Broca’s area, dlPFC	M1, S1, anterior cingulate cortex (ACC), dlPFC
P300 ERP Attenuation Rate	Rapid and severe (cortical resource depletion)	Moderate (sustained working memory load)	Low (distributed across cognitive and motor modalities)
Failure Profile Under Fatigue	Automated click-through errors, habituated confirmation	Syntactic errors blocking execution (fail-safe)	Mechanical stop; requires physical presence
Subjective Locus of Control	Externalized (machine autonomy, passive consumption)	Internalized (symbolic authorship, high control)	Embodied (physical ownership, ritual justification)
Operator Model	Infantilized (zero assumed competence or liability)	Expert (syntactic rigor, unguided memory)	Accountable Professional (enforced agency, non-bypassable duty)

---

3. Empirical Failure Modes of Zero-Friction Architectures

3.1 Multi-Factor Authentication Fatigue and Push Bombing

The migration from physical cryptographic tokens to “seamless” mobile push notifications (e.g., single-tap Okta, Duo, or Microsoft Authenticator prompts) replaced out-of-band verification with a single binary decision: “Approve” vs. “Deny”. This design optimization introduced the vulnerability of Multi-Factor Authentication Fatigue (push bombing).

Push bombing weaponizes cognitive exhaustion against an operator subjected to non-deterministic, high-frequency approval requests. Because single-tap prompts demand negligible cognitive effort, the psychological resistance required to repeatedly deny alerts exceeds the cost of tapping “Approve” to silence the interruption.

High-profile corporate intrusions across 2022 documented the efficacy of this vulnerability:

• Cisco Systems (August 2022): The Yanluowang threat group leveraged employee credentials synchronized from a personal browser profile to breach the corporate network, initiating an aggressive Duo push-bombing barrage combined with voice phishing (vishing) (NCC-CSIRT, 2022). Sustained late-night prompts led to employee approval, granting corporate VPN access, domain admin privilege escalation, and internal data exfiltration.
• Uber Technologies (September 2022): Threat group Lapsus$ acquired contractor credentials via dark-web markets and issued continuous Duo mobile push requests until the operator accepted the prompt, supplemented by communication impersonating corporate IT security claiming the prompts were necessary to resolve an alert storm (Uber Newsroom, 2022). The compromise granted administrative access across internal G-Suite, Slack channels, AWS environments, and HackerOne vulnerability reports (Uber Newsroom, 2022; R v Kurtaj, 2025).
• Rockstar Games (September 2022): Lapsus$ executed an identical MFA fatigue sequence against internal development communication channels, compromising Slack and Confluence environments and exfiltrating source code assets and confidential pre-release media (R v Kurtaj, 2025).

3.2 Notification Desensitization, Number Matching, and FIDO2 Efficacy

Single-tap push prompts systematically induce sensory habituation governed by the thalamic reticular nucleus. The binary prompt lacks semantic discriminability: it fails to convey what operation is being authorized, the IP origin, or the cryptographic challenge context.

To mitigate blind approvals, identity providers deployed Number Matching (Compare-and-Confirm), forcing users to enter a two-digit integer displayed on the login terminal into the mobile authenticator. While this intentional friction disrupts blind approvals, Jubur et al. (2024) demonstrated that number matching remains vulnerable under concurrent login attacks: when an adversary triggers a login concurrent with an authentic user workflow, users demonstrate high misattribution rates, entering the attacker’s dynamic number into their mobile app without validating geographical or network context.

The empirical solution to authentication failure is the complete physicalization of the cryptographic exchange via FIDO2 / WebAuthn hardware security keys. In a two-year enterprise deployment study tracking over 50,000 corporate employees, Lang et al. (2016) demonstrated:

• Successful account takeovers dropped to 0.00% across the entire population over the two-year window.
• Hardware-enforced touch verification reduced mean authentication time ($T_{auth}$) to 5.3 seconds, compared to 22.7 seconds for mobile phone authenticator apps and 13.6 seconds for SMS OTP codes.
• Overall authentication failure rates declined from 3.1% (phone apps) to 1.5% (hardware tokens).
• Post-provisioning support tickets dropped by 85% relative to mobile authenticators.

FIDO2 succeeds where push prompts fail because the cryptographic challenge is bound to the verified TLS channel and origin URL (ClientDataHash and rpId) by the client browser. The Test of User Presence (TUP) requires physical electromechanical capacitance, completely insulating the assertion from remote relay attacks or push-bombing scripts.

3.3 Catastrophic Unprompted Actions: Automated Transfer Systems in Banking

In consumer finance, the push toward conversion velocity led to the introduction of SMS OTP auto-fill, background biometric assertions, and single-swipe transfers. These zero-friction primitives created an operational vacuum exploited by mobile banking trojans leveraging Automated Transfer Systems (ATS), including malware families such as RatOn, GoatRAT, and Xenomorph.

ATS frameworks abuse the Android Accessibility Service API to execute programmatic transfers without human intervention:

1. The trojan instantiates an opaque visual overlay when a banking app is launched, concealing the real interface.
2. Operating beneath the overlay, the ATS engine traverses the Document Object Model (DOM), identifies account balances, and repopulates recipient account fields with adversary mule identifiers.
3. When the financial platform transmits an out-of-band authorization code, mobile OS auto-fill captures the token or the malware reads it directly from the notification buffer.
4. The trojan executes programmatic clicks to finalize irreversible wire settlements in under 1,000 ms, completely bypassing human consciousness.

To break this automated chain, regulatory intervention in the United Kingdom via the Payment Systems Regulator (PSR, 2024) mandated Confirmation of Payee (CoP). CoP introduces intentional verification friction: the payer’s bank verifies the recipient account name via an algorithmic directory prior to settlement. Discrepancies generate non-bypassable “Close Match” or “No Match” interface warnings.

Empirical regulatory data demonstrated an immediate 30% to 50% reduction in misdirected transactions and Authorized Push Payment (APP) fraud following CoP deployment (Payment Systems Regulator, 2024). Furthermore, shifting fraud reimbursement liability 50:50 between sending and receiving institutions forced platforms to structurally integrate intentional friction into checkout flows (Payment Systems Regulator, 2024).

Interface Paradigm	Primary Threat Vectors	Mean Auth Time ($T_{auth}$)	Account Takeover Rate (Empirical)	Primary Human Failure Mode
Binary Push Notification (Single-Tap)	Push Bombing, SIM Swapping, AitM Phishing	$\approx 22.7\text{ s}$	High ($\approx 1.00$ under targeted campaigns)	Thalamic habituation, sensory saturation, nuisance silencing
Compare-and-Confirm (Number Matching)	Concurrent Terminal Injection, Reverse Proxies	$\approx 18.0\text{ s}$	Low to Moderate ($\approx 0.15 - 0.30$ concurrent)	Visual misattribution, blind spatial confirmation
SMS / Mobile OTP with Auto-Fill	Accessibility API Exploitation (ATS), SS7 Interception	$\approx 2.0\text{ s}$ (auto) / $13.6\text{ s}$ (manual)	Severe ($\approx 0.90$ against mobile trojans)	Complete bypass; zero human perceptual engagement
FIDO2 / WebAuthn Hardware Security Key	Physical theft of hardware token	$5.3\text{ s}$	0.00% (Google study, $N=50{,}000+$)	Misplacement of physical token (mitigated via in-person protocol)

---

4. Game-Theoretic Formalization of Seamlessness and Platform Incentives

4.1 The Principal-Agent Problem in Interface Design

The propagation of frictionless interfaces can be formalized as an asymmetric Principal-Agent problem. The user functions as the Principal ($P$), delegating interface security architecture and transaction mediation to the digital platform, the Agent ($A$).

Let interface friction be parameterized by $\phi \in [0, 1]$, where $\phi = 0$ represents a completely frictionless interaction (one-click execution, persistent sessions, automated credential caching) and $\phi = 1$ denotes an intentionally governed, high-verification operational boundary (out-of-band attestation, explicit confirmation syntax, physical hardware coupling).

The platform’s expected utility $U_A$ is expressed as:

$$U_A(\phi) = R(V(\phi), \phi) - C_A(\phi) - P_B(\phi) \cdot \theta \cdot L$$

where:

• $R(V(\phi), \phi)$ represents platform revenue, monotonically driven by transaction velocity $V(\phi)$, where $\frac{\partial V}{\partial \phi} < 0$, $\frac{\partial R}{\partial V} > 0$, and $\frac{\partial R}{\partial \phi} < 0$. Minimizing friction maximizes gross platform revenue.
• $C_A(\phi)$ is the operational engineering cost of maintaining rigorous verification pipelines, where $\frac{\partial C_A}{\partial \phi} > 0$.
• $P_B(\phi)$ is the probability of a catastrophic security breach or fraud event, with $\frac{\partial P_B}{\partial \phi} < 0$.
• $L$ is the gross systemic loss resulting from compromise.
• $\theta \in [0, 1]$ represents the liability transfer coefficient—the fraction of total breach loss internalized by the platform.

The end-user’s utility function $U_P$ is defined by:

$$U_P(\phi) = B(V(\phi)) - E(\phi) - P_B(\phi) \cdot (1 - \theta) \cdot L$$

where:

• $B(V(\phi))$ is the consumption utility derived from transaction execution.
• $E(\phi)$ is the cognitive and physical effort cost experienced by the user, where $\frac{\partial E}{\partial \phi} > 0$.
• $1 - \theta$ represents the unpriced fraction of catastrophic loss externalized onto the user.

In unregulated digital environments, platform Terms of Service (ToS) compress the liability parameter ($\theta \to 0$). Under these conditions:

$$\frac{\partial U_A}{\partial \phi} = \frac{\partial R}{\partial \phi} - \frac{\partial C_A}{\partial \phi} - \theta L \frac{\partial P_B}{\partial \phi} < 0, \quad \forall \phi \in [0, 1]$$

To maximize immediate profit, the platform selects $\phi^* = 0$. Seamlessness operates as an unpriced risk transfer mechanism: the platform captures high-margin transaction rent while externalizing catastrophic tail risk ($P_B(0) \cdot L$) onto the user population.

4.2 Coordination Failures and the Software Engineering Prisoner’s Dilemma

Within competitive market environments, the elimination of safety checkpoints is governed by a non-cooperative $N$-firm Prisoner’s Dilemma.

Consider two competing enterprise software firms, Firm 1 ($F_1$) and Firm 2 ($F_2$). Each firm chooses between two software delivery strategies:

• Strategy $S_F$ (Intentional Friction): Enforce robust human-in-the-loop security verification, non-bypassable CI/CD release gates, multi-party cryptographic authorizations, and strict rate limiters.
• Strategy $S_0$ (Seamless Delivery): Eliminate verification gates, deploy continuous unverified CI/CD pipelines, automate credential provisioning, and optimize onboarding for instantaneous conversion.

Let the market reward customer acquisition velocity: if $F_1$ implements $S_F$ while $F_2$ implements $S_0$, users facing cognitive switching costs migrate to $F_2$ due to lower immediate resistance. $F_2$ captures monopoly rent $\pi_M$, while $F_1$ faces marginalization or insolvency (payoff $0$). If both firms maintain intentional friction ($S_F, S_F$), structural integrity is preserved, yielding stable long-term returns $\pi_L - C_F$. If both firms deploy zero friction ($S_0, S_0$), both maintain market share but induce systemic fragility, incurring an expected catastrophic breach loss $P_B \cdot L_P$.

The strategic payoff matrix is formalized below:

Firm 1 \ Firm 2	Strategy $S_F$ (Intentional Friction)	Strategy $S_0$ (Seamless Delivery)
Strategy $S_F$ (Friction)	$\pi_L - C_F, \;\; \pi_L - C_F$	$0, \;\; \pi_M - C_0$
Strategy $S_0$ (Seamless)	$\pi_M - C_0, \;\; 0$	$\pi_M - C_0 - P_B L_P, \;\; \pi_M - C_0 - P_B L_P$

Given that $\pi_M - C_0 > \pi_L - C_F$ and $\pi_M - C_0 - P_B L_P > 0$, Strategy $S_0$ strictly dominates Strategy $S_F$:

$$u_i(S_0, s_{-i}) > u_i(S_F, s_{-i}), \quad \forall s_{-i} \in \{S_F, S_0\}$$

The unique Nash Equilibrium is $(S_0, S_0)$, which is Pareto-suboptimal compared to the socially optimal cooperative state $(S_F, S_F)$. Unconstrained market competition acts as a centrifugal force, systematically stripping defensive checkpoints from modern software lifecycles.

4.3 Mathematical Formalization of Interface Security Archetypes

To evaluate macro-systemic stability, consider the social welfare function $W$ evaluated over an infinite-horizon discounted time frame ($\delta \in [0, 1]$):

$$W = \sum_{t=0}^{\infty} \delta^t \left[ B(V(\phi_t)) - C_A(\phi_t) - E(\phi_t) - P_B(\phi_t) \cdot L \right]$$

In safety-critical workflows and national infrastructure layers, catastrophic failure yields unbounded existential loss ($L \to \infty$). Under the low-friction regime ($\phi = 0$):

$$\lim_{L \to \infty} W(S_0) = -\infty$$

Conversely, an intentional friction regime ($\phi = \phi_F$) guarantees non-negative social welfare if and only if:

$$P_B(\phi_F) \cdot L \le B(V(\phi_F)) - C_A(\phi_F) - E(\phi_F)$$

Intentional friction functions mathematically as an indispensable insurance premium, whose operational payment prevents socio-technical divergence toward systemic collapse.

4.4 Non-Linear Risk-Scaled Friction and the Hidden Unit Economics of Support (OPEX)

Product management orthodoxy often treats conversion velocity as a strictly linear virtue: minimizing friction across all interaction paths is assumed to universally maximize Customer Lifetime Value (LTV). This assumption contains a fatal unit-economic flaw rooted in a flat friction topology.

Consider an interface where an inconsequential micro-transaction ($50\text{ CZK}$, e.g., consumer retail purchase) is mediated through the exact same interaction barrier as an irreversible, high-consequence macro-transaction ($100{,}000\text{ CZK}$, e.g., wire transfer to an unverified third-party account).

Let transaction magnitude and irreversibility be denoted by $M \in \mathbb{R}^+$. Under a zero-friction or flat-friction architecture:

$$\phi(M) = \text{const} \approx 0$$

When $M$ is small, the friction cost $E(\phi)$ is negligible, and transaction execution yields positive net utility. However, when $M$ is large, the probability of fraudulent manipulation, coercive social engineering, or cognitive slip remains non-zero ($P_B > 0$). In the event of catastrophic error at high $M$, user psychology does not operate according to textbook game-theoretic rationality. Instead, it triggers the Last-Mile Attribution Fallacy:

$$\text{User Blame} \propto \frac{M}{\phi(M)}$$

The victim does not rationalize: “I benefited from low-friction onboarding.” Rather, they attribute total causal culpability to the host institution: “The bank failed to prevent me from transferring my life savings to an adversary.”

This dynamic detonates downstream operational costs across three vectors:

1. Support Escalation (Payroll / OPEX): Ticket resolution complexity scales non-linearly with transaction gravity. A trivial $50\text{ CZK}$ dispute is resolved programmatically. A disputed $100{,}000\text{ CZK}$ transfer demands manual tier-3 security audit, legal intake, compliance triage, and repetitive inbound call handling. The marginal personnel cost ($\text{OPEX}_{support}$) escalates exponentially:

$$\frac{\partial^2 \text{OPEX}_{support}}{\partial M^2} > 0$$

2. Legal and Regulatory Overhead: As evidenced by UK PSR mandates (Payment Systems Regulator, 2024), systemic platform failure to prevent authorized push payment fraud shifts direct restitution liabilities and legal arbitration fees back onto the provider.
3. Permanent Retention Attrition (Deep Conversion Loss): While seamlessness yields an initial, superficial conversion spike ($\text{CVR}_{shallow}$), catastrophic breach events produce absolute churn and brand destruction ($\text{CVR}_{deep} \to 0$).

Therefore, viable interface cybernetics mandates a Non-Linear Risk-Scaled Friction Topology:

$$\phi^*(M) = \begin{cases} \phi_{min} & M < M_{threshold} \\ k \cdot \ln\left(1 + \frac{M - M_{threshold}}{\alpha}\right) + \phi_{step} & M \ge M_{threshold} \end{cases}$$

For low-stakes operations ($M < M_{threshold}$), friction is minimized to eliminate operational drag. When operations cross the critical safety threshold ($M \ge M_{threshold}$), the interface injects non-bypassable, discrete physical and cognitive governors: full-screen modal halts, required manual input of beneficiary strings, mandatory time-delays (cooling-off windows), and out-of-band hardware attestation.

By scaling friction non-linearly with systemic consequence, the architecture curbs exponential support payroll explosion, satisfies regulatory compliance, and protects long-term institutional solvency.

---

5. Cybernetics and Ashby’s Law in Socio-Technical Systems

5.1 Ashby’s Law of Requisite Variety in Authentication Systems

In foundational cybernetics, W. Ross Ashby (1956) formulated the Law of Requisite Variety: “Only variety can destroy variety.” In any regulatory control system, the capacity of a regulator ($R$) to minimize the entropy or disturbance ($D$) transmitted to an essential system variable ($E$) is fundamentally bounded by the ratio of the state varieties of $R$ and $D$:

$$H(E) \ge H(D) - H(R)$$

where $H$ denotes Shannon entropy or logarithmic state variety: $H(X) = \log_2 \vert{}X\vert{}$. For a system to maintain homeostasis ($H(E) \to 0$), the regulatory variety must equal or exceed the disturbance variety:

$$H(R) \ge H(D)$$

Applied to information security and interface design, this principle exposes the vulnerability of software-only authentication:

• Disturbance Space ($D$): Encompasses the full spectrum of socio-technical perturbations: adversary-in-the-middle reverse proxies, session-token hijacking, SIM swapping, OS kernel hooks, credential stuffing, human circadian fatigue, and social engineering. The state variety of this space is massive: $H(D) \gg 0$.
• Software-Only Regulator ($R_{soft}$): Operates within the identical logical substrate as the host OS and network stack. It projects verification challenges onto a one-dimensional, scalar bitstream: a binary confirmation dialog (“Yes/No”) or an alphanumeric OTP string.

Because $R_{soft}$ shares the memory space, display bus, and communication medium with the host environment, any disturbance that compromises the operating system or habituates the human visual cortex simultaneously compromises the regulator. The state variety of a single-tap push prompt is constrained to:

$$\vert{}R_{soft}\vert{} = 2 \implies H(R_{soft}) = \log_2 2 = 1\text{ bit}$$

Attempting to regulate a high-variety disturbance space with a 1-bit regulator violates Ashby’s Law:

$$H(E) \ge H(D) - 1 > 0$$

Systemic failure is mathematically guaranteed.

To achieve requisite variety, the regulator must expand its dimensional state space. A Physical and Tangible Regulator ($R_{phys}$)—such as a FIDO2 hardware cryptographic key or smart card—introduces orthogonal physical dimensions into the feedback loop:

1. Electromechanical Coupling: Demands physical human capacitance and localized kinetic energy to bridge a physical contact.
2. Spatial-Temporal Locality: Cryptographic assertions are bounded to the localized physical micro-environment of the hardware bus (USB, NFC) and cannot be relayed across arbitrary IP networks.
3. Cryptographic Micro-Isolation: Private keys reside permanently within a dedicated, air-gapped silicon die operating its own clock, bus, and microcode, decoupled from host OS memory.

By projecting state verification across physical, electrical, and isolated cryptographic dimensions, $R_{phys}$ satisfies Ashby’s condition:

$$H(R_{phys}) \ge H(D) \implies H(E) \to 0$$

Homeostasis is restored because the physical hardware token possesses sufficient dimensional variety to absorb and neutralize the socio-technical disturbance vectors.

5.2 Socio-Technical Hype Cycles as Second-Order Cybernetic Loops

The evolution of computing architectures oscillates between centralized enclosure and decentralized autonomy. Rather than progressing linearly, this movement represents a second-order cybernetic feedback loop governed by non-linear differential equations with significant time delays ($\tau$):

• Centralized Mainframes (1960s–1970s): Compute was concentrated in centralized mainframes; users interacted via thin dumb terminals without local agency.
• Decentralized Personal Computing (1980s–1990s): The microcomputer revolution decentralized silicon, local storage, and software execution, establishing local computational sovereignty.
• Cloud Re-Centralization and SaaS (2000s–2010s): Platform capitalism leveraged broadband to re-centralize compute and storage under the banner of seamlessness and Access-as-a-Service, establishing modern digital feudalism.
• Local-First and Cryptographic Physicalization (2020s onward): The recognition of platform lock-in, recurring subscription rent, surveillance, and arbitrary remote service revocation has initiated a structural return to local storage, verifiable cryptography, and edge sovereignty (Kleppmann et al., 2019).

This structural oscillation is modeled as a delayed negative feedback system:

$$\frac{dC(t)}{dt} = -\kappa \cdot \left( F(t - \tau) - F^* \right)$$

where $C(t)$ represents the degree of architectural centralization, $F(t)$ is the observed systemic friction and operational vulnerability, $F^*$ is the targeted operational equilibrium, and $\tau$ is the information latency—the multi-year delay between adopting a centralized architecture and experiencing its systemic failure modes (monopolistic rent extraction, large-scale data breaches, and remote service shutdowns).

Because the feedback signal $F(t)$ is delayed by $\tau$, the system cannot settle at a static equilibrium. Instead, it generates sustained, un-damped oscillations between hyper-centralized platform enclosure and fragmented local sovereignty.

5.3 Overshoot and Collapse: Synthetic CI/CD Sandboxes vs. Hardware Fleet Entropy

Applying Donella Meadows’ (2008) and John Sterman’s (2000) system dynamics frameworks reveals the phenomenon of Overshoot and Collapse within rapid automation paradigms, particularly the uncritical integration of generative AI models and autonomous agents into software delivery pipelines.

The carrying capacity of an operational engineering system is bounded by human cognitive verification throughput ($V_{cognition}$). When an organization deploys autonomous code generation, the velocity of code generation and state transformation ($V_{gen}$) accelerates exponentially:

$$V_{gen} \gg V_{cognition}$$

As long as $V_{gen} \le V_{cognition}$, human operators maintain supervisory control through deliberate System 2 verification. However, because commercial platforms design these pipelines to be frictionless, $V_{gen}$ outpaces human cognitive throughput.

When verification becomes cognitive friction that constrains throughput, organizations systematically strip away verification forcing functions. The system enters an overshoot regime: the human-in-the-loop is reduced to an automated rubber stamp operating via System 1 approval. Situational awareness degrades as the codebase accumulates latent architectural debt, hallucinated dependencies, and brittle edge-case assumptions.

Critically, modern software engineering compounds this fragility through an institutional delusion: testing exclusively within idealized, homogeneous server environments.

Development teams routinely execute test suites inside pristine, 64-core cloud CI/CD containers equipped with unbounded RAM and predictable network throughput. In doing so, the testing regulator ($R_{test}$) possesses near-zero dimensional variety:

$$H(R_{test}) \approx 0$$

In the physical world, the target deployment environment is a chaotic zoo of hardware entropy:

• Severely throttling mobile chipsets under elevated ambient temperatures.
• Fragmented OEM Android kernels running aggressive out-of-memory (OOM) killer daemons.
• Unpredictable USB-C port physical contact oxidation and impedance variance.
• Unstable cellular handshakes characterized by 90% packet drops and carrier proxy mutilation.

When code vetted only inside pristine synthetic sandboxes encounters real-world entropy, the system suffers non-linear failure. The platform is forced into a state of chronic, high-stress emergency response: developers spend hundreds of engineering hours deploying panicked, live-production hotfixes to patch architectural holes that should never have reached master.

To re-establish Ashby’s condition, software development must adopt Intentional Engineering Friction (Heterogeneous Hardware Verification):

• Mandating automated testing pipelines across physical bare-metal testbenches comprising over 100 geographically and architecturally diverse consumer devices (legacy laptops, degraded mobile units, diverse hardware revisions).
• Intentionally injecting latency, thermal limits, and physical peripheral disconnections into the deployment gate.

While this hardware-in-the-loop friction increases initial capital expenditure and lengthens deployment cycles, it permanently curtails the catastrophic loop of continuous production firefighting.

---

6. Tangible Computing & Hardware-Enforced Security Ergonomics

6.1 Tangible User Interfaces as Deterministic Cognitive Boundaries

Tangible User Interfaces (TUIs), formalized by Ishii and Ullmer (1997), couple digital information directly to physical, graspable artifacts. In high-assurance security ergonomics, physical tokens serve as active cognitive and architectural boundaries rather than passive credential containers.

A physical artifact provides unambiguous cognitive affordances: unlike a cryptographic certificate stored invisibly in an OS registry or an ephemeral session cookie in browser cache, a physical smart card or USB token possesses discrete spatiality: it is either mechanically connected to the interface or it is absent.

This physical boundary is enforced in operating system kernel architectures through explicit hardware removal policies. Within Microsoft Windows enterprise environments, this mechanism is governed by the Smart Card Removal Policy service (ScardSvr) and Group Policy configurations:

• Mandated Smart Card Logon: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption = 1. When enabled, this key disables interactive password logon across the Local Security Authority Subsystem Service (LSASS), mandating physical token attestation.
• Deterministic Removal Behavior: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scremoveoption. A setting of 1 executes LockWorkStation(), securing the desktop session the moment physical continuity is broken; a setting of 2 forces user logoff, terminating all active user processes; and 3 disconnects active Remote Desktop Protocol (RDP) sessions.

By binding session state to the physical continuity of the token (scremoveoption = 1), the operating system maps session duration directly to the physical presence of the human body. An operator cannot depart the terminal while leaving an active administrative session exposed; departing the physical space necessitates retrieving the card, which deterministically locks the machine.

Crucially, this architecture explicitly counters operator evasion:

• Non-administrative users lack local privilege escalation paths to modify ScardSvr service registry hives.
• If an operator attempts to bypass physical friction by permanently leaving a security token plugged into an unattended external USB hub, this constitutes an overt, auditable breach of operational protocol rather than a system design flaw.
• The system refuses to accommodate negligence: it establishes deterministic technical guardrails and assigns unequivocal personal operational liability to the authenticated individual.

Furthermore, hardware-enforced ergonomics leverage silicon-level monotonic lockout counters. In cryptographic microcontrollers conformant to Common Criteria EAL6+ and FIDO2 specifications, credential verification executes entirely inside the isolated silicon die. Failed authentication attempts trigger a physical, non-volatile monotonic counter written to one-time programmable (OTP) memory or flash. This counter enforces hardware-level exponential backoff delays and permanently invalidates cryptographic keys upon reaching a terminal threshold (typically 8 to 10 attempts). Crucially, this execution path is immutable: host CPU malware, regardless of kernel privilege elevation, cannot reset, bypass, or intercept the internal hardware counter.

6.2 Empirical Error Rates and the Fallback Paradox: Why Recovery Must Be Anchored Physically

Empirical evaluations across human-factors security demonstrate structural failure modes inherent to ephemeral, software-based credentials relative to physically bounded media:

• Memory Decay and Cognitive Strain: Complex password policies force users to offload entropy onto external media, insecure local files, or predictable substitutions (e.g., appending calendar years), degrading password entropy.
• Exfiltration Susceptibility: Software credentials reside in OS memory buffers where they are vulnerable to memory scraping via tools like Mimikatz targeting LSASS, info-stealer malware (such as RedLine and Racoon), and session hijacking through cross-site scripting (XSS).
• Absence of Origin Binding: Software OTPs are completely vulnerable to real-time adversary-in-the-middle reverse proxies (such as Evilginx2). The operator cannot reliably discern whether a prompt is being entered into a legitimate application or an adversary’s reverse proxy.

Physically bounded media (FIDO2 security keys, PIV/CAC smart cards) resolve these failure modes through physical and cryptographic isolation: the private key $K_{priv}$ cannot be exported across the bus interface; it executes operations exclusively within the secure cryptoprocessor. The user is relieved of maintaining high-entropy credentials in working memory, eliminating password fatigue while requiring deliberate mechanical intervention (capacitive touch, button press, or card insertion) that directly binds human intent to the cryptographic assertion.

The Fallback Paradox and In-Person Physical Identity Anchoring

A critical systemic vulnerability threatens hardware-enforced architectures: The Account Recovery Fallback Paradox.

A security architecture is only as resilient as its weakest recovery mechanism. If an enterprise deploys FIDO2 hardware keys across its entire employee base, but provides a remote, seamless fallback channel when a key is misplaced—such as:

• Submitting a remote support ticket to an outsourced IT Helpdesk;
• Requesting an automated recovery link via secondary corporate email;
• Answering knowledge-based verification questions over an unauthenticated VoIP line;

then the cryptographic strength of the hardware key is entirely bypassed. An external adversary will not waste resources attempting to extract $K_{priv}$ from hardened EAL6+ silicon; they will execute voice phishing (vishing) or social engineering against the tier-1 support operator (precisely as demonstrated in the 2022 Uber and Cisco breaches) (NCC-CSIRT, 2022; Uber Newsroom, 2022). Seamless recovery channels reduce a multi-million-dollar cryptographic perimeter back to a vulnerable 1-bit human gatekeeper.

To resolve this paradox, intentional friction must govern credential provisioning and lifecycle revocation through In-Person Physical Identity Anchoring:

1. Strict Deprovisioning of Remote Account Resets: Administrative and critical infrastructure accounts must systematically disable unauthenticated remote self-service recovery channels.
2. In-Person Cryptographic Handshake: In the event of a lost, destroyed, or compromised hardware token, re-issuance mandates physical presence. The operator must physically appear before an authorized security administrator or notary, authenticate their identity using verified government credentials (passport, national biometric ID), and receive an in-person provisioned cryptographic token. The old credential revocation certificate is broadcast synchronously across internal directory authorities.
3. Operational Trade-Off Analysis: While in-person re-issuance introduces non-trivial administrative friction (temporal delay, physical travel), hardware token loss is a low-frequency tail event (empirically occurring once every 24 to 36 months per user). Spending two hours of logistical labor to remediate a rare failure event completely closes an existential corporate attack surface, converting catastrophic systemic risk into a predictable, minor operational cost.

Security and Ergonomic Dimension	Ephemeral Software Credentials (Passwords / SMS / App OTP)	Physically Bounded Media (FIDO2 Keys / PKCS#11 Smart Cards)
Phishing Resistance	Zero; susceptible to real-time AitM reverse proxies	Absolute; cryptographically bound to origin TLS channel
Exfiltration Resistance	Low; vulnerable to OS memory dumping and info-stealers	Absolute; private keys non-exportable from secure element
Cognitive Memory Load	Severe; requires high-entropy memorization or manager software	Near-Zero; physical possession coupled with local PIN/touch
Vulnerability to ATS Trojans	Extreme; Accessibility APIs capture and auto-fill credentials	Immune; requires localized physical electromechanical touch
Unattended Terminal Risk	High; session remains open indefinitely upon departure	Near-Zero; token removal locks console automatically
Mean Time to Authenticate	$13.6\text{ s}$ (SMS) to $22.7\text{ s}$ (Mobile App OTP)	$5.3\text{ s}$ (FIDO2 / U2F Hardware Touch)
Recovery Fallback Vulnerability	Critical; remote self-service recovery trivially phished	Closed; recovery bounded strictly by in-person physical attestation

6.3 Transition from Digital Feudalism to Local Data Sovereignty

The contemporary digital ecosystem is characterized by Digital Feudalism: an economic regime wherein users do not own computational hardware, software, or data. Instead, they exist as digital tenant farmers on centralized corporate platforms. Under this Access-as-a-Service model, operational access is leased under unilateral end-user license agreements. The platform retains operational sovereignty, reserving the right to revoke access, alter features, inspect private communications, and monetize user behavioral telemetry.

The psychological consequence of digital feudalism is the erosion of personal efficacy and operational agency: users operate with the chronic awareness that their digital environments can be modified or terminated by an automated platform decision.

To counter this enclosure, an architectural and regulatory movement is establishing frameworks for Local Data Sovereignty:

• The Local-First Software Movement: Pioneered by Kleppmann et al. (2019), local-first computing re-architects software by ensuring data storage is physicalized on the user’s local hardware first, using Conflict-free Replicated Data Types (CRDTs) to synchronize across peer devices without requiring dependence on centralized cloud databases. Local-first software guarantees that applications continue to function indefinitely without active network connectivity or recurring subscription validations.
• Regulatory Mandates: The European Union Artificial Intelligence Act (EU AI Act, Regulation (EU) 2024/1689) mandates human oversight and intentional friction for high-risk AI deployments under Article 14, requiring architectural forcing functions that prevent automated execution without meaningful human verification. Similarly, the NIS 2 Directive (Directive (EU) 2022/2555) imposes supply-chain accountability and mandates phishing-resistant, hardware-based authentication for essential entities. Complementing these, Right to Repair legislation requires unbundled access to hardware diagnostics, schematics, and cryptographic pairing tools.
• Psychological Trust Dynamics: Empirical studies examining user trust demonstrate an emerging bifurcation: while novice consumers prioritize seamless onboarding, enterprise engineers and security-conscious users display greater long-term trust in systems that provide verifiable cryptographic autonomy, local data custody, and transparent operational friction.

Local data sovereignty physically re-anchors the human operator as an autonomous agent: cryptographic keys reside in user-owned silicon, bits reside on physical local storage, and systemic boundaries are protected by intentional, physical friction.

---

7. Synthesis: The Cybernetic Triad of Intentional Friction

The evidence across cognitive neurobiology, empirical breach analysis, behavioral game theory, cybernetics, and tangible computing indicates that seamlessness without boundary enforcement is an architectural pathology. When interfaces eliminate operational friction, they degrade cognitive agency, erode executive control, introduce platform moral hazard, and generate systemic fragility.

To engineer resilient socio-technical systems, computing architectures must implement the Cybernetic Triad of Intentional Friction:

1. Spatial-Motor Discontinuity: Critical state transformations—such as financial settlements, administrative privilege elevations, and production code deployments—must incorporate physical or modal discontinuities. Requiring an operator to shift from continuous on-screen interactions to an explicit physical action (such as inserting a hardware token, touching a capacitive contact, or typing structured command-line syntax) interrupts Kahneman’s (2011) System 1 autopilot, resets sensory gating, and engages System 2 prefrontal executive control. Systems must reject the infantilization of the operator: accountability is reinforced by pairing deterministic technical constraints with explicit procedural duties.
2. Orthogonal Dimensional Variety: Conforming to Ashby’s (1956) Law of Requisite Variety, verification channels must not share the logical substrate of the operational payload. Pure software confirmations executed within the same operating system, memory bus, and network stack lack sufficient dimensional variety to survive host compromise or biological sensory habituation. Verification mechanisms must operate across out-of-band physical media—relying on isolated silicon, human presence testing, and cryptographic channel binding. Crucially, this variety must govern account lifecycles: lost-key recovery paths must abandon remote software channels in favor of in-person, physically anchored attestation. Furthermore, engineering pipelines must subject code not to synthetic cloud sandboxes, but to the full entropy of heterogeneous, physical client hardware fleets.
3. Game-Theoretic Risk Symmetry and Non-Linear Friction: Platform incentives must be realigned through regulatory frameworks and architectural constraints to eliminate the asymmetric externalization of tail risk. Systems must abandon flat friction models in favor of non-linear risk scaling: while routine micro-transactions flow unhindered, irreversible high-value actions must be arrested by non-bypassable cognitive and temporal barriers. Aligning interface resistance with operational risk preserves deep user retention, curtails exponential customer support payroll explosion, and prevents platforms from converting short-term conversion gains into existential legal liabilities.

By physicalizing digital sovereignty and embedding intentional friction into interface architectures, computing environments can mitigate the failure modes of seamless UX, restoring cognitive agency, operational security, and systemic resilience.

---

References

• Ashby, W. R. (1956). An Introduction to Cybernetics. Chapman & Hall.
• Broadbent, D. E., & Berry, D. C. (1987). Non-verbal reasoning and control of complex systems. Cognitive Psychology, 19(1), 32–64. https://doi.org/10.1016/0010-0285(87)90004-2
• England and Wales Court of Appeal (Criminal Division). (2025). R v Kurtaj [2025] EWCA Crim 1163. Royal Courts of Justice.
• European Parliament and Council of the European Union. (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, L 333, 80–152.
• European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689.
• Festinger, L. (1957). A Theory of Cognitive Dissonance. Stanford University Press.
• Ishii, H., & Ullmer, B. (1997). Tangible bits: Towards seamless interfaces between people, bits and atoms. In Proceedings of the ACM SIGCHI Conference on Human Factors in Computing Systems (CHI ‘97) (pp. 234–241). ACM. https://doi.org/10.1145/258549.258715
• Jubur, M., et al. (2024). Push-fatigue and number matching in mobile MFA: Human factors and security bounds. In IEEE International Conference on Computing, Networking and Communications (ICNC).
• Kahneman, D. (2011). Thinking, Fast and Slow. Farrar, Straus and Giroux.
• Kleppmann, M., Wiggins, A., van der Linde, P., & Hardenberg, M. (2019). Local-first software: You own your data, in spite of the cloud. In Proceedings of the 2019 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Software (Onward! 2019) (pp. 154–178). ACM. https://doi.org/10.1145/3359591.3359737
• Lang, J., Czeskis, A., Balfanz, D., Schilder, M., & Srinivas, S. (2016). Security keys: Practical cryptographic second factors for the modern web. In Financial Cryptography and Data Security (LNCS 9604, pp. 422–440). Springer. https://doi.org/10.1007/978-3-662-54970-4_25
• Meadows, D. H. (2008). Thinking in Systems: A Primer. Chelsea Green Publishing.
• Nigerian Communications Commission Computer Security Incident Response Team (NCC-CSIRT). (2022, August 12). Yanluowang Ransomware: NCC-CSIRT Urges Stronger Security Measures. NCC Media Centre. https://www.ncc.gov.ng/media-centre/press-releases/yanluowang-ransomware-ncc-csirt-urges-stronger-security-measures
• Norton, M. I., Mochon, D., & Ariely, D. (2012). The “IKEA effect”: When labor leads to love. Journal of Consumer Psychology, 22(3), 453–460. https://doi.org/10.1016/j.jcps.2011.08.002
• O’Hara, K. P., & Payne, S. J. (1998). The effects of operator implementation cost on planfulness of problem solving and learning. Cognitive Psychology, 35(1), 34–70. https://doi.org/10.1006/cogp.1997.0676
• Payment Systems Regulator (PSR). (2024). Authorised Push Payment (APP) Scams: Mandatory Reimbursement Requirement (Policy Statement PS24/3). Bank of England / PSR UK.
• Sterman, J. D. (2000). Business Dynamics: Systems Thinking and Modeling for a Complex World. McGraw-Hill.
• Svendsen, G. B. (1991). The influence of interface style on problem solving. International Journal of Man-Machine Studies, 35(3), 379–397. https://doi.org/10.1016/S0020-7373(05)80134-8
• Trimmel, M., & Huber, R. (1998). After-effects of human-computer interaction indicated by P300 of the event-related brain potential. Ergonomics, 41(5), 649–655. https://doi.org/10.1080/001401398186810
• Uber Newsroom. (2022, September 19). Security update: An update on recent security incidents. Uber Technologies, Inc. https://www.uber.com/gb/en/newsroom/security-update/
• Wiener, N. (1948). Cybernetics: Or Control and Communication in the Animal and the Machine. MIT Press.