Audit-Trail Identity: Identity Economics Under Persistent Sensing

Abstract§

We extend classical identity economics to the regime of persistent passive sensing. When personal sensors continuously record behavior, identity utility migrates from category-narrative compliance to evidentiary consistency with the sensor stream, and the agent ends up gaming a metric whose only audience is her own future self — a regime we formalize as private intrapersonal Goodharting. We model this in two periods, with a noisy sensor signal $s = m(\theta, a) + \varepsilon$ that reduces to an audit score $q(s)$ — streak length, ring closure, time-in-range, focus score — that supplies identity utility $\varphi(q(s))$, while welfare depends on a distinct latent outcome $y(\theta, a)$. Identity utility is over the record, not over a downstream inference about latent type: the audit-score formulation sidesteps the perfect-recall objection to classical self-signaling and locates distortion in the gap between $q$ and welfare. The model yields three propositions:

• P1 — precision-induced welfare loss. Higher sensor precision amplifies a proxy-goal wedge $\delta = \partial q(m)/\partial a - \partial Y(y)/\partial a$ between the audit score $q(s)$ that supplies identity utility and the welfare-utility transformation $Y(y)$ of the latent outcome, distorting action away from the welfare-optimum.
• P2 — sensor-as-witness. The distortion persists in the absence of an external audience, with the sensor substituting functionally for the social witness in classical signaling models.
• P3 — precision-attenuated attribution bias. Under a diagnosticity-dominance condition, self-serving attribution from sensor evidence to type is decreasing in precision, generating a second comparative-static that runs opposite to P1.

The corollary that follows is the paper’s headline ambiguity: (C1) under a joint welfare functional admitting both wedge-driven action distortion and instrumental-accuracy benefits, the net welfare effect of precision is parameter-dependent in $\delta$ and the maximum attribution-bias weight $\beta_{\max}$, generating the cross-domain heterogeneity documented in fitness, glucose, and screen-time tracking that no single-channel account predicts.

A keystone empirical commitment in §5.3 — audience-asymmetric Goodharting — distinguishes the framework from existing belief-based identity and motivational-crowd-out accounts.

1. Introduction§

In 2005, the claim “I am an active person” was a narrative — held together by occasional memories of exertion, loose recall of a gym schedule, and the absence of contradicting evidence. In 2025, the same claim is audited, in five-minute increments, by a watch the speaker is wearing while they make it. The watch knows. More precisely, the speaker knows that the watch knows, and the act of asserting an identity has become an act of asserting consistency with a continuous evidentiary record. A widely-cited Fortune Well report from January 2025 describes a user pacing her living room at midnight to close her Apple Watch move ring: “This is not healthy. This is something that I’m consumed by.” The vignette is mundane but the structure is new: behavior is being shaped not by a category-narrative or a social audience, but by the sensor itself, in private, in service of an identity claim whose enforcement is now mechanical.

The thesis of this paper can be stated as a four-step chain. (i) Before persistent passive sensing, identity was maintained through narrative — selectively remembered actions, motivated interpretation of ambiguous evidence, and verification (when it happened at all) by sporadic social attention. (ii) Persistent sensors expose that maintenance to a continuous evidentiary stream and make the narrative contestable in real time, by an object exogenous to the agent’s cognitive accounting. (iii) Identity utility therefore migrates from “do I believe I am the kind of person who does X?” to “does my record certify that I am?” — and the sensor itself functions as a private evidentiary witness, displacing the social audience that classical signaling models require. (iv) When the record measures a proxy rather than welfare, the agent defends identity by distorting the behavior the sensor records, not by distorting beliefs about that behavior. The distortion appears in private, in service of a record only the agent reads, and grows with the sensor’s precision.

This paper argues that the rise of persistent passive sensing — fitness trackers, sleep monitors, continuous glucose monitors, screen-time logs, location histories — is a qualitative shift in the economics of identity, not a quantitative tightening of self-knowledge. Classical identity economics, following Akerlof & Kranton (2000, 2010), treats identity as a category claim whose utility depends on action–category consistency, and whose enforcement is socially mediated. The belief-based extension developed by Bénabou & Tirole (2004, 2011), and recently synthesized by Bénabou & Henkel (2025), treats identity as a posterior belief about a latent type $\theta$, updated from noisy and forgettable signals, and protected by motivated cognition: information avoidance, motivated memory, and action-as-self-signal. Both literatures share a common architecture in which the agent’s access to her own history is imperfect — either because category-fit is privately uncertain, or because signals decay and recall is costly.

The audit-trail regime is the regime in which some forms of act-level uncertainty shrink. Sensors are exogenous to the agent’s cognitive accounting; they are continuous, low-cost to access in retrospect, and externally recorded — costly to narratively revise rather than literally tamper-proof, since users can and do remove or game devices in well-documented ways. Bénabou & Henkel (2025) are explicit (p. 12) that perfect recall of past actions collapses their self-signaling channel to a no-op. We take this not as a degenerate corner but as the regime that an increasing share of behavior now inhabits. The question this paper asks is what fills the vacuum.

Our answer is that identity utility migrates from category-narrative compliance to evidentiary consistency with the sensor stream, and that this migration introduces a structurally new failure mode. We call it the proxy-goal wedge: when the sensor signal $s = m(\theta, a) + \varepsilon$ reduces to an audit score $q(s)$ that supplies identity utility, while welfare depends on a latent outcome $y(\theta, a)$, the agent’s identity-driven action optimizes the audit score at the expense of welfare-utility. We formalize this in a two-period model (§3) and prove three propositions and a corollary.

Proposition 1 (precision-induced welfare loss): as sensor precision rises, the agent’s optimal action diverges from the welfare-optimum in proportion to the wedge $\delta = \partial q(m)/\partial a - \partial Y(y)/\partial a$, producing the comparative-static that paternalist welfare is decreasing in precision past a threshold. This reverses the comparative-static of the belief-based literature.

Proposition 2 (sensor-as-witness): the precision effect persists in the absence of any external audience. The sensor substitutes functionally for the social witness that classical signaling models require — an isolation that existing frameworks do not put at the center of their analysis, since both social-signaling and self-signaling collapse when their respective witness conditions are removed.

Proposition 3 (precision-attenuated attribution bias): even when the agent has perfect introspection over her own action, her posterior over $\theta$ given audit-trail evidence is systematically biased toward favorable type-attribution; under a diagnosticity-dominance condition (the Mezulis-channel-dominates regularity introduced in §3.5), sensor precision shrinks this attribution wedge. The bias is anchored in the self-serving attribution literature (Miller & Ross 1975; Mezulis et al. 2004) and gives the framework a second precision channel that runs in opposition to Proposition 1.

Corollary 1 (ambiguous net effect): under a joint welfare functional that admits both wedge-driven action distortion and instrumental-accuracy benefits, the sign of the precision effect is parameter-dependent in $\delta$ and the maximum attribution-bias weight $\beta_{\max}$, generating the cross-domain heterogeneity documented in fitness, glucose, and screen-time tracking — heterogeneity that single-channel accounts do not naturally produce.

A natural concern is whether the phenomenon we describe is simply Etkin (2016)‘s finding that personal quantification crowds out intrinsic motivation, dressed in different language. It is not. Etkin’s mechanism is affective: measurement reframes an enjoyable activity as work. Our mechanism is structural: it operates through the alignment between the measured proxy and the latent welfare object, and is silent when $\delta = 0$. A second concern is the contracting literature on sensors and verifiability (Bakos & Halaburda 2019), which runs a structurally similar precision comparative-static in the interpersonal contracting context. We import the verifiability-expansion insight but operate in a regime they do not: intrapersonal, no court, identity utility rather than trade surplus. A third concern is the surveillance-studies treatment of self-tracking (Whitson 2013), which is the closest concept-precursor in spirit but does not isolate the no-audience case and does not formalize the wedge.

2. Related Work§

This paper draws on and distinguishes itself from five literatures.

Identity economics. The foundational treatment is Akerlof & Kranton (2000, 2010), in which agents derive utility from action–category consistency. Bénabou & Tirole (2004, 2011) develop a belief-based extension in which identity is a posterior belief about a latent type $\theta$, protected by motivated cognition. The recent handbook synthesis of Bénabou & Henkel (2025) catalogs this lineage. Across both branches, the agent’s access to her own history is imperfect. We differ by studying the signal regime they exclude: audit-trail sensors push the agent’s effective recall toward the limit case classical self-signaling treats as degenerate.

Quantified self and personal informatics. Li, Dey & Forlizzi (2010) propose a stage-based model of personal informatics; Epstein et al. (2015) revise this into a “lived informatics” model that admits self-understanding-without-action as a legitimate end state. Whitson (2013) provides the closest concept-precursor, arguing in the surveillance-studies tradition that quantified-self users gamify their own behavior. Rapp & Tirassa (2017) explicitly theorize the self as actively reconstructed through self-tracking. Munson (2018) identifies the empirical proxy-goal wedge as a design problem (“data-first vs. goal-first”). Clawson et al. (2015)‘s analysis of wearable resale ads supplies an empirical correlate of the wedge: device abandonment correlates with users’ recognition that $m$ and $y$ have diverged. We differ by formalism, by the isolation of the no-audience case, and by the framing of identity utility as an economic primitive.

Sensors as evidence in contracts. Bakos & Halaburda (2019) develop the closest formal neighbor: smart contracts restrict the strategy space (commitment) while connected sensors expand the verifiable state space (better information), with welfare non-monotone in enforcement cost. The commitment-devices literature proper (Bryan, Karlan & Nelson 2010; Ariely & Wertenbroch 2002; Beshears et al. 2015) treats enforcement as illiquidity or temporal asymmetry rather than continuous monitoring. We differ by importing the verifiability-expansion insight into an intrapersonal context with no court, no counterparty, and identity utility rather than trade surplus as the protected quantity. Proposition 2 is the intrapersonal analog of Bakos and Halaburda’s verifiability result.

Multitask agency, Goodhart, and metric corruption. The proxy-goal wedge has its closest formal ancestor in Holmström & Milgrom (1991): when an agent allocates effort across multiple tasks and only a subset are measured, optimal incentives shift effort toward the measured tasks at the expense of unmeasured ones, with welfare losses scaling in the divergence between measurement weights and welfare weights. The wedge $\delta$ is the one-agent restriction of their multitask result, with identity utility substituting for the principal’s incentive contract. The descriptive Goodhart/Campbell tradition makes the same observation at the institutional scale — Campbell (1979)‘s law: “the more any quantitative social indicator is used for social decision-making, the more subject it will be to corruption pressures and the more apt it will be to distort and corrupt the social processes it is intended to monitor”; the Goodhart (1975)/Strathern formulation that any measure becoming a target ceases to be a good measure; and Muller (2018) extending the critique to institutional metric fixation. The classical Holmström-Milgrom/Goodhart setting is interpersonal: a principal imposes a metric and an agent games it. We differ by internalizing the principal. In the audit-trail regime the agent is both evaluator and evaluated; the metric is voluntarily adopted and becomes consequential through identity utility rather than through an employer, school, state, or platform’s enforcement. The contribution is to formalize private intrapersonal Goodharting — the agent gaming a metric whose only audience is her own future self — and to derive the precision comparative-statics (P1, P3) that distinguish it from the institutional case Holmström-Milgrom and Campbell describe.

Affective costs of quantification. Etkin (2016) shows across six experiments that measurement increases output but reduces enjoyment via overjustification-style affective reattribution. We differ by mechanism. Etkin’s account is precision-invariant and operates through affective crowding-out; ours is precision-graded and operates through identity utility coupled to a proxy-goal wedge. Three theoretical distinctions separate the accounts independently of any future experiment. (i) Precision dependence: Etkin’s affective penalty is approximately constant across measurement instruments of different sensor precision, whereas our welfare loss in P1 scales with $1/\sigma^2$. (ii) Wedge dependence: Etkin’s penalty is silent on whether the measured proxy aligns with the latent welfare object; ours collapses to zero when $\delta = 0$. Measuring an activity the agent already wants to perform should produce no welfare loss in our model and the same enjoyment penalty in hers. (iii) Audience asymmetry: Etkin’s mechanism is audience-invariant; ours predicts the private case produces more distortion than the public case (§5.3). All three are observable in a design that orthogonally varies presence-of-measurement, wedge magnitude, and audience visibility — a design Etkin’s six experiments do not run.

Synthesis. The five literatures intersect at the question this paper asks but no single literature contains the answer. Identity economics provides the welfare framework but not the signal regime; quantified-self studies provides the phenomenology but not the formalism; contracting theory provides the precision comparative-statics but not the identity utility or the no-audience case; the Goodhart/Campbell tradition supplies the proxy-distortion logic but assumes an external principal who sets the metric; consumer research provides the affective downside but not the structural-substitution mechanism. The contribution is to occupy the intersection: to formalize identity utility under exogenous persistent evidence, derive precision comparative-statics in both directions (P1 and P3), and propose a keystone empirical test (§5.3) that distinguishes the framework from each of the five neighbors.

3. Model§

3.1 Setup§

Time runs over two periods. In period 1 the agent has prior beliefs over a latent type $\theta \in \Theta \subseteq \mathbb{R}$ (e.g., athleticism, diligence, healthfulness). She chooses action $a \in \mathbb{R}_+$. Two things result:

• A latent welfare-relevant outcome $y(\theta, a)$, mapped to utility units by a smooth, weakly concave transformation $Y(\cdot)$ with $Y' > 0$.
• A sensor signal $s = m(\theta, a) + \varepsilon$ with $\varepsilon \sim \mathcal{N}(0, \sigma^2)$, observed by the agent.

In period 2 the agent reads $s$ and reduces it to an audit score $q(s) \in \mathbb{R}$ — a deterministic, monotone summary the agent uses to certify the record (streak length, ring closure, time-in-range, focus score, sleep regularity). Identity utility is $\varphi(q(s))$ with $\varphi' > 0,\ \varphi'' \le 0$. Per-period payoff in period 1 is $u(a) - c(a)$ with $u' > 0,\ c' > 0,\ c'' > 0$. The agent does not observe $\theta$ at the decision stage and chooses $a$ under her period-1 prior $\Pi(\theta)$. Her ex-ante utility is therefore taken in expectation over both $\theta$ (through her prior) and $\varepsilon$ (through the sensor):

with identity weight $\lambda > 0$. Where expectations are unambiguous below we suppress the subscript.

3.2 The proxy-goal wedge§

The load-bearing assumption is that the action’s marginal effect on the audit score exceeds its marginal effect on welfare-utility. Stated in dimensionally comparable utility-gradient units:

Assumption 1 (Proxy-goal wedge). $\frac{\partial}{\partial a} q(m(\theta, a)) > \frac{\partial}{\partial a} Y(y(\theta, a)) \ge 0$ for all $(\theta, a)$ in the relevant range.

Both sides are in the same units: marginal change in utility-relevant value per unit action. Define the wedge

Walking laps inflates the closed-ring audit score more than it raises welfare-utility from cardiorespiratory fitness; reading short articles inflates page-count more than comprehension. The reformulation in terms of $q(m)$ and $Y(y)$ — rather than the raw $m$ and $y$ — closes the dimensional gap the earlier draft glossed over (steps minus fitness is not a meaningful subtraction); both objects now denote utility-marginal gradients. The model is interesting iff $\delta > 0$ on a set of positive measure; the $\delta \equiv 0$ case removes the distinctive audit-trail distortion and the framework reduces to a precision-graded version of standard belief-based identity economics. The wedge is closely related to the “data-first vs. goal-first” design problem identified empirically by Munson (2018) in personal informatics.

3.3 Precision-induced welfare loss§

The agent’s first-order condition is

where the audit-score sensitivity decomposes as $\partial q(m)/\partial a = q'(m) \cdot \partial m/\partial a$ and the welfare-utility sensitivity as $\partial Y(y)/\partial a = Y'(y) \cdot \partial y/\partial a$. Define paternalist welfare as the ex-ante non-identity components in utility units, $W(a) := u(a) - c(a) + \mathbb{E}_\theta[Y(y(\theta, a))]$, and let $a^\dagger := \arg\max_a W(a)$. Let $a^*(\sigma^2)$ denote the agent’s optimum.

Proposition 1 (Precision-induced welfare loss). Under Assumptions 1 and 2 with $W''(a) < 0$ and $V_{aa}(a;\sigma^2) < 0$ on the relevant range, there exists $\bar\sigma^2 > 0$ such that for all $\sigma^2 < \bar\sigma^2$, $a^*(\sigma^2) > a^\dagger$, and paternalist welfare $W(a^*(\sigma^2))$ is strictly decreasing in precision $1/\sigma^2$.

Proof sketch. At $a = a^\dagger$ the welfare FOC $u'(a) - c'(a) + \mathbb{E}_\theta[\partial Y(y)/\partial a] = 0$ holds. The agent’s FOC adds a strictly positive identity-incentive term $\lambda \cdot \mathbb{E}[\varphi'(q(s)) \cdot \partial q(m)/\partial a]$, whose marginal-utility magnitude rises with precision $1/\sigma^2$ by Assumption 2. Under the wedge $\delta > 0$ (Assumption 1), the agent’s FOC over-weights $\partial q(m)/\partial a$ relative to $\partial Y(y)/\partial a$, so $a^*(\sigma^2) > a^\dagger$ whenever the identity-incentive at $a^\dagger$ exceeds the local marginal-welfare gradient. Concavity of $V$ delivers a unique interior optimum, and the implicit function theorem applied to the agent’s FOC yields $d a^*/d(1/\sigma^2) > 0$. Past $a^\dagger$, $W$ is decreasing in $a$ by definition of the welfare-optimum, so $\frac{d W(a^*(\sigma^2))}{d(1/\sigma^2)} = W'(a^*) \cdot \frac{d a^*}{d(1/\sigma^2)} < 0$. ∎

The key structural point: the agent does not need to misread $q$ as $\theta$ to produce this distortion. With $\varphi(q(s))$ as identity utility, the distortion comes from the wedge between marginal effects of action on the audit score and on welfare-utility — and is silent on whether $s$ also licenses an inference about $\theta$. Section 3.4 leans on this to isolate the no-audience case; section 3.5 reintroduces type-inference as an additive second channel.

This reverses the precision comparative-static of the belief-based identity literature, where higher precision improves welfare by tightening identity beliefs. The wedge is what breaks the equivalence. In a contracting context, Bakos & Halaburda (2019) obtain a structurally similar precision-on-welfare comparative-static with non-monotonicity in enforcement cost; our result is the intrapersonal analog.

3.4 Sensor as witness§

The model above contains no social-image term: the agent derives $\lambda\varphi(q(s))$ purely from her own audit score. To make the comparison to social-signaling models transparent, consider the augmented utility

where $q_{\text{social}}(s)$ is the audience’s reading of the (publicly observed) audit score and $\gamma \ge 0$ is the social-image weight. Setting $\gamma = 0$ recovers the original model.

Proposition 2 (Sensor-as-witness). Under Assumptions 1 and 2 with $\gamma = 0$ — no audience and no social-image utility — the agent’s optimal action still departs from the welfare-optimum in the direction of the proxy:

• No-sensor regime ($\sigma^2 \to \infty$): $a^* \to a^\dagger$ (the expected identity-utility gradient vanishes as the audit score becomes uninformative about $a$).
• With-sensor regime: $a^*(\sigma^2) > a^\dagger$ for $\sigma^2 < \bar\sigma^2$ per Proposition 1.

The result is that audit-score identity utility $\lambda\varphi(q(s))$ alone — with no audience, no $\psi$, no contractual stake — is sufficient to generate the precision-driven distortion. This distinguishes the framework from social-signaling models, in which the distortion vanishes once $\gamma = 0$. It also clarifies the relationship to Bénabou & Tirole (2004) self-signaling: their framework requires imperfect introspection (noisy recall of own action) because identity utility there is over the posterior $\mathbb{E}[\theta \mid s]$, and that posterior degenerates under perfect recall (the agent simply subtracts her action out). Our framework keeps introspection over $a$ perfect and routes identity utility through an external object — the audit score $q(s)$ — that the agent cannot subtract her action out of. The witness role is filled exogenously by the sensor record itself.

3.5 Precision-attenuated attribution bias§

Propositions 1 and 2 derive the main distortion without requiring the agent to form any belief about her latent type $\theta$: identity utility there attaches to the audit score $q(s)$, not to a posterior over $\theta$. Empirically, however, agents do also form type-beliefs from sensor evidence — “the record says I closed 200 rings this year, so I am an athletic person” — and those beliefs are themselves a source of utility, separately from the audit score. This section adds that as a second, additive channel of identity utility, and shows that this channel runs in the opposite precision direction from the audit-score channel.

Formally, augment the period-2 identity term with an additional posterior-based component:

with $\lambda_\beta \ge 0$ controlling the weight of the type-belief channel relative to the audit-score channel. Setting $\lambda_\beta = 0$ recovers §3.1–§3.4 exactly; setting $\lambda = 0$ and $\lambda_\beta > 0$ collapses the framework toward the classical posterior-based identity model. The realistic case is both weights positive: agents care both about the certified record and about what the record implies for their type.

In line with the self-serving attribution literature (Miller & Ross 1975; Mezulis et al. 2004), agents systematically over-attribute favorable outcomes to type and under-attribute them to own-action — so the type-posterior they actually use, $\hat\mu$, is biased toward favorable attribution relative to the rational posterior $\mu^*$. The Mezulis meta-analysis of 266 studies establishes the bias as large ($d \approx 0.96$) and universal, and critically establishes that the bias is attenuated by feedback unambiguity.

Formalize. Let $\mu^*(s, a) := \mathbb{E}[\theta \mid s, a]$ be the rational posterior, conditioning on both signal and own action. Let $\tilde\mu(s) := \mathbb{E}[\theta \mid s, a = \bar a_{\text{pop}}]$ be the population-baseline counterfactual posterior — the inference one would draw treating the action as if it had been the population average. The agent’s biased posterior is a convex combination:

where $\beta: \mathbb{R}_{>0} \to [0, \beta_{\max}]$ is the attribution-bias weight with $\beta(0) = 0$, $\beta'(\sigma^2) > 0$, $\lim_{\sigma^2 \to \infty} \beta(\sigma^2) = \beta_{\max} \in (0, 1]$.

When the agent acts at $a > \bar a_{\text{pop}}$, her biased posterior exceeds her rational posterior — she takes credit for her effort as if it reflected type rather than choice.

Convention. We reserve “attribution wedge” for the formal object $A(\sigma^2) := \hat\mu - \mu^*$ defined below; “attribution bias” refers to the empirical phenomenon documented by Mezulis et al. that motivates the construction.

Proposition 3 (Precision-attenuated attribution bias). Under the biased-posterior equation above with $a > \bar a_{\text{pop}}$:

1. $\hat\mu(s, a;\sigma^2) \ge \mu^*(s, a)$, with strict inequality for $\sigma^2 > 0$ and $\beta(\sigma^2) > 0$.
2. Write $A(\sigma^2) = \beta(\sigma^2)\,\Delta(\sigma^2)$ with $\Delta := \tilde\mu - \mu^* \ge 0$. Under the diagnosticity-dominance (Mezulis-channel-dominates) condition — $\beta'(\sigma^2)\,\Delta(\sigma^2) + \beta(\sigma^2)\,\Delta'(\sigma^2) > 0$ — the attribution wedge $A(\sigma^2)$ is increasing in $\sigma^2$, i.e. decreasing in precision $1/\sigma^2$. Without this condition $A$ can be hump-shaped: $\beta$ rises with noise (less diagnostic evidence permits more self-serving attribution) while the action-conditioning gap $\Delta$ typically rises with precision (more diagnostic evidence makes the correction larger when omitted), so the product is not monotone in general.
3. When (2) holds, the type-belief channel of identity utility $\lambda_\beta \mathbb{E}[\varphi_\beta(\hat\mu)]$ is decreasing in sensor precision, in opposition to Proposition 1.

Proof sketch. Claim 1: when $a > \bar a_{\text{pop}}$, $\tilde\mu(s) \ge \mu^*(s, a)$ — conditioning out the agent’s above-average action removes a downward correction on the type-attribution — so the convex combination exceeds $\mu^*$, strictly whenever $\beta(\sigma^2) > 0$. Claim 2: write $A(\sigma^2) = \beta(\sigma^2)\cdot \Delta(\sigma^2)$ with $\Delta := \tilde\mu - \mu^* \ge 0$. The bias weight $\beta(\sigma^2)$ is increasing in $\sigma^2$ by Mezulis’s diagnosticity moderator: less ambiguous evidence attenuates self-serving attribution. In the Gaussian-linear specification with bounded prior support, $\Delta(\sigma^2)$ is bounded above for all $\sigma^2$ and $\Delta \to 0$ as $\sigma^2 \to \infty$, so the $\beta$-channel dominates and $A'(\sigma^2) > 0$. Outside that specification, monotonicity holds whenever $\beta'\Delta + \beta\Delta' > 0$ — a Mezulis-channel-dominates regularity condition. Claim 3 follows from $\varphi_\beta' > 0$ and the monotone fall of $\hat\mu$ toward $\mu^*$ as $A \to 0$. ∎

Act-level vs. type-level self-deception. Propositions 2 and 3 together resolve a tension implicit in the claim that audit trails “raise the cost of self-deception.” Audit trails raise the cost of act-level self-deception — the agent can no longer privately distort her recall of whether she exercised — because the sensor record is exogenous. They do not eliminate type-level self-deception: the agent retains a residual freedom over how to interpret the recorded action as evidence about her latent $\theta$, and Proposition 3 quantifies the size of that residual. The economic substance of the audit-trail shift is therefore a substitution of one channel of self-protection for another, not a wholesale elimination of motivated cognition. §3.8 develops the substitution explicitly.

Corollary 1 (Net precision effect under joint welfare). Let $\pi := 1/\sigma^2$ denote precision. Define the joint welfare functional

$$W^*(a, \pi) := W(a) - \rho\,\mathbb{E}\!\left[A(a, \pi)^2\right],$$

where $W(a) = u(a) - c(a) + \mathbb{E}_\theta[Y(y(\theta, a))]$ is paternalist welfare as defined in §3.3 and $A(a, \pi) := \hat\mu(s, a; \pi) - \mu^*(s, a)$ is the attribution wedge of §3.5. The second term is an instrumental-accuracy penalty in the spirit of Bénabou & Henkel (2025) p. 14’s instrumental self-image channel. Evaluated at the agent’s equilibrium $a^*(\pi)$, the total derivative decomposes as

$$\frac{d\,W^*(a^*(\pi), \pi)}{d\pi} \;=\; \underbrace{W'(a^*(\pi))\,\frac{d a^*}{d\pi}}_{\text{action-distortion term (P1)}} \;-\; \rho\,\underbrace{\frac{d\,\mathbb{E}[A(a^*(\pi), \pi)^2]}{d\pi}}_{\text{accuracy term (P3)}}.$$

Under Proposition 1 with $a^*(\pi) > a^\dagger$, $W'(a^*) < 0$ and $d a^*/d\pi > 0$, so the action-distortion term is negative. Under Proposition 3 with the diagnosticity-dominance condition, $\mathbb{E}[A^2]$ falls in $\pi$, so the accuracy term contributes a positive $-\rho \cdot (\text{negative}) = \text{positive}$ component. The sign of the total derivative is therefore parameter-dependent in $\delta$, $\beta_{\max}$, and $\rho$. For small $\delta$, large $\beta_{\max}$, or large $\rho$, precision improves joint welfare; for large $\delta$, small $\beta_{\max}$, or small $\rho$, precision hurts joint welfare.

Corollary 1 predicts the cross-domain heterogeneity documented in §4: domains with high proxy-goal wedges (move-ring closure, post-prandial spikes) should show net welfare loss from precision; domains with low wedges and high baseline self-serving bias (self-reported productivity, sleep self-perception) should show net welfare gain. The qualitative ambiguity is robust to $\rho > 0$ — it is the relative magnitude of the two opposing terms, not the presence of either, that determines the sign.

3.6 The audit-trail limit§

Define the audit-trail limit as $(\sigma^2 \to 0,\ \kappa \to 0)$, where $\kappa$ is the period-2 recall cost of accessing the period-1 signal. In Bénabou & Henkel (2025) (their §3.4, p. 12), self-signaling requires $\kappa > 0$; as $\kappa \to 0$ their motivated-cognition channel goes silent. In our framework the opposite happens. As $\sigma^2 \to 0$, the sensor channel intensifies:

The three regimes are points in the cube $(\lambda, \sigma^2, \kappa)$: the rational benchmark zeroes out identity utility itself, B&H switches identity utility on but routes it through introspective recall ($\kappa > 0$), and our regime routes it through exogenous sensor evidence ($\sigma^2 \to 0$, $\kappa \to 0$). The B&H and audit-trail regimes are complementary, not nested: classical identity economics has studied one quadrant; we open the diagonal one.

3.7 Alignment with Bénabou–Henkel§

§2 distinguishes the framework from Akerlof–Kranton, Bénabou–Tirole, Etkin, and Bakos–Halaburda along signal regime, mechanism, and welfare object; we do not restate those distinctions. The relationship to Bénabou & Henkel (2025) warrants additional development because two of the model’s results map onto channels they name but leave unformalized — and because the audit-score formulation $\varphi(q(s))$ above is the formal mechanism by which the audit-trail regime escapes their “perfect recall collapses self-signaling” boundary.

Their framework requires recall friction $\kappa > 0$ precisely because identity utility over the type posterior $\varphi(\mathbb{E}[\theta \mid s])$ degenerates when the agent can subtract her own action ($\mu^*(s, a) = \mathbb{E}[\theta \mid s, a]$ does not respond to the marginal action via the channel they need); ours does not degenerate because $\varphi(q(s))$ asks for no inference about $\theta$ at all. The audit-score channel and theirs are therefore complementary rather than nested.

Alignment 1: our paternalist welfare criterion is theirs; they accept that hedonic self-image utility can be welfare-decreasing through over-investment (the “identity treadmill”). Alignment 2: our two precision channels correspond to their two flavors of identity utility — P1 (audit-score channel) formalizes the hedonic over-investment they describe verbally, and P3 (attribution-bias channel, our §3.5 additive layer) formalizes the instrumental self-confidence channel by which more accurate self-belief raises welfare. Extension: they name the hedonic-vs.-instrumental tension but leave its net effect indeterminate; Corollary 1 resolves the indeterminacy parametrically in $\delta$ and $\beta_{\max}$, and predicts the cross-domain heterogeneity documented in §4 that no single Bénabou–Henkel channel produces.

3.8 Substitution between belief- and action-distortion§

P1–P3 taken together imply an inter-regime substitution between two self-protective strategies. In the pre-audit-trail regime (Bénabou & Tirole 2002), the agent who wishes to maintain a flattering posterior $\mu$ over her type does so by distorting beliefs: choosing what to remember, what to look up, and how to interpret ambiguous evidence. Belief-distortion is the load-bearing channel because $\mu$ is the agent’s identity object and her access to her own history is imperfect. In the audit-trail regime, the act-level inputs to that calculus — did I exercise, how much, when — are exogenously recorded, and the identity object migrates from $\mu$ to the audit score $q(s)$ (§3.1). Equilibrium self-protection migrates with it: P1 says the agent’s equilibrium response is to over-invest in actions that raise $q(s)$ (the action-distortion margin); P3 says a residual belief-distortion channel survives in the form of self-serving attribution, attenuating in precision rather than vanishing.

The substitution carries a normative implication that does not appear in either parent literature. The motivated-cognition literature treats belief-distortion as the dominant self-protective channel; the metric-fixation literature treats Goodharting as a response to externally imposed incentives. Our model says the two are competing equilibrium margins of the same self-protective project under different signal regimes, and that the audit-trail regime redistributes self-protective effort from the belief-distortion margin (B&T 2002) to the action-distortion margin (our P1) — raising the cost of one channel by removing its cognitive degree of freedom (act-level recall) and raising the level of the other by giving it an exogenous evidentiary anchor ($q(s)$). This is the mechanism that produces the welfare loss in P1: it is not that sensors make people less honest with themselves but that they shift the form that dishonesty takes — from cognitive to behavioral.

4. Worked Examples§

Three sensor regimes chosen to span the relevant precision–wedge–audience configurations. The table below summarizes the cross-domain comparison that Corollary 1 turns into a prediction; the subsections that follow develop the empirical evidence for each cell. The figure below positions all three §4 examples plus two §3.5 counter-examples on the (δ, β_max) parameter plane.

4.1 Closing the rings (Apple Watch activity rings)§

The canonical case for P1. Sensor signal $s$: active calories, exercise minutes, stand hours. Audit score $q(s)$: a binary daily indicator (rings closed or not) and the longitudinal streak length — exactly the objects Apple’s design surfaces and Apple’s notifications enforce. Latent type $\theta$: cardiometabolic fitness. Latent welfare $y$: $\mathrm{VO_2}$ max, insulin sensitivity, mortality risk. Wedge $\delta$: large — $q$ jumps discontinuously at the close threshold while $Y(y)$ moves continuously and slowly, so the action that closes the ring on a near-miss day raises $q$ far more than it raises $Y(y)$. Precision: high. Audience: typically none.

Etkin (2016)‘s six experiments establish the empirical mechanism directly: tracking increases output of the measured activity (steps walked) but reduces enjoyment and continued engagement. The vignette from Fortune Well (2025) — a user pacing her living room at midnight to close her move ring — illustrates the proxy-goal wedge in its limit form. Documented gaming behaviors include pet-mounted Fitbits, drill-attachment, and metronome inflation (HuffPost 2019), and Strava itself maintains automated filters for GPS spoofing on KOMs. A 2026 preprint reports runners openly modifying workouts against injury-risk in response to Strava social-proof (Grüning & Richlan 2026). Clawson et al. (2015)‘s analysis of ~1,600 Craigslist wearable-resale ads surfaces a “discomfort with data” theme that maps onto a wedge detection event: users abandon the device only after recognizing the divergence between $m$ and $y$.

4.2 Continuous glucose monitors in non-diabetic populations§

The cleanest demonstration of identity collapse under sensor evidence. Sensor signal: continuous glucose, ~5-minute resolution. Audit score $q(s)$: time-in-range (typically 70–140 mg/dL), the “clean trace” indicator surfaced by consumer CGM apps and shared on social media, and post-prandial peak height. Latent type: metabolic health. Latent welfare: long-run HbA1c, beta-cell function, cardiovascular risk.

Rodriguez et al. (2025, Diabetes Technology & Therapeutics) — a cohort study of $n = 972$ adults spanning normoglycemia, prediabetes, and type-2 diabetes — establishes that CGM-derived metrics in non-diabetic populations are largely unrelated to HbA1c: the correlation, robust within the T2D subgroup, weakens in prediabetes and disappears in normoglycemia. The wedge in literal biological form. The accompanying press release (Mass General Brigham 2025) translates the finding for a general audience. The community-cohort analysis in Spartano et al. (2025, JCEM) reports time-in-range distributions across glycemic strata in $n > 1000$ normoglycemic adults — the kind of reference distribution the field has lacked — and underscores how far consumer-CGM marketing has run ahead of validated non-diabetic norms. Qualitative reports document the canonical substitution: “low-fat foods like fruit and oats suddenly become labeled as foods to avoid at all costs, while a bowl of ice cream may lead to a lower spike than a piece of fruit” (Hormachea 2025; Qina.tech 2024). The mixed-methods cross-sectional study of Richardson et al. (2025) — adults using CGM for lifestyle change — finds CGM-related distress concentrated among younger users, those with obesity, and those with elevated eating-disorder symptom scores; the qualitative arm reports that distress often coexists with behavior change and may operate as both motivator and barrier. Consistent with P1 operating on a high-precision sensor with no clinically validated welfare anchor.

The case also demonstrates sensor-as-witness with no audience (P2): most consumer CGM users do not share data. Food choices reorganize around the trace because the trace is the witness.

4.3 Screen-time and the focused-person identity§

The case where paternalist welfare loss is most visible through substitution. Sensor signal: Screen Time daily totals. Audit score $q(s)$: phone-only screen-time hours (a single salient number iOS surfaces weekly), and category breakdowns (“social”, “entertainment”, “productivity”). Latent type: capacity for sustained attention. Latent welfare $y$: depth of thought, work output. Wedge: large and structurally interesting — $q$ counts only phone use, so the action that moves doom-scrolling from phone to laptop reduces $q$ without changing the attention substrate that $Y(y)$ depends on.

The headline empirical anchor is Zimmermann (2021) in the Journal of the Association for Consumer Research: a longitudinal field study showing that screen-time tracking improves digital self-awareness but does not reduce mobile usage, especially in heavy users. This is the wedge appearing as null-effect on $y$ while $m$ (self-reported awareness) rises. Ellis (2019) and Sewall et al. (2020) sharpen the interpretation by showing that self-reported smartphone use is at best modestly correlated with objectively logged use ($r \approx 0.38$ in the recent meta-analytic literature) and that the error is systematically related to user well-being, age, and usage volume — the wedge in reverse, with self-report as the proxy that tracks the identity-relevant construct and the device log as the latent quantity. Substitution behaviors — moving doom-scrolling to laptop or tablet — are widely reported but under-studied empirically. As a boundary case, Grüning, Riedel & Lorenz-Spreen (2023, PNAS) report a substantial reduction in target-app opens over six weeks of a friction-based intervention (the “one sec” app), suggesting that interventions which close the wedge ($\delta \to 0$) can recover welfare without inducing substitution.

The connection to anti-Goodhart sensor design is developed in §6.2.

5. Testable Predictions§

5.1 Domain-asymmetric identity update§

Self-reported identity claims (“I am a runner,” “I eat well,” “I sleep enough”) track external evidence more tightly in domains where the respondent owns an always-on sensor for that domain, and the gap is larger the longer the sensor has been owned. Cross-sectional test predicts an interaction, not a main effect — which separates from selection effects. Distinguishes from Bénabou & Henkel (2025): their motivated-cognition framework predicts no systematic differential between sensed and unsensed domains.

5.2 Identity rebound under sensor removal§

Forced removal of a long-owned sensor produces an identity-rebound: self-report drifts back toward pre-sensor narrative-self within weeks, even when behavior change persists. Predicts the dissociation of (a) sustained behavior and (b) identity-claim retreat, which standard motivational accounts do not predict. Distinguishes from Etkin (2016), whose post-measurement effect is a behavioral dropoff via affective crowding-out.

5.3 Audience-asymmetric Goodharting (keystone test)§

The wedge $\delta$ is more aggressively exploited when the sensor data is private than when it is socially visible to an audience that can judge context. This inverts the standard signaling prediction. A four-cell design pins down the prediction by orthogonally varying who can see what:

The directional prediction the framework hinges on is

which inverts the social-signaling prediction (where audience visibility raises distortion) and falsifies the affective-crowd-out prediction of Etkin (2016) (which is audience-invariant). The intermediate prediction $\text{Gaming}_{\text{public aggregate}} \approx \text{Gaming}_{\text{private}}$ separates context-aware audience deterrence from the mere fact of visibility — and is itself a useful diagnostic for which mechanism is doing the work.

The cleanest implementation is between-subjects randomization of social visibility of an otherwise identical sensor stream (Strava activity exposed to a public follower set vs. kept private; Apple Watch ring data paired with a partner vs. unpaired; screen-time logs shared with a roommate vs. private), with gaming behaviors as pre-registered outcomes — short walk-loops on rest days, manipulation of context (treadmill incline, GPS position) to inflate signal, end-of-day spikes timed to ring-closure thresholds, or substitution of measured-device-usage to unmeasured devices in the screen-time case. A within-subjects design is unattractive because the act of switching from private to public sharing changes future data: agents who anticipate visibility re-optimize behavior and any post-switch measurement of “private-mode” gaming is contaminated.

A natural-experiment analog exploits policy-induced variation in audience visibility: Strava’s February–March 2018 simplification of its heatmap-opt-out default following the Pentagon-base controversy that month (Engadget 2018), the regional rollout of Apple Watch competitions, or platform-specific privacy defaults that vary across markets. A difference-in-differences on user-level gaming proxies before/after a privacy-default reform would test the same prediction in observational data without running the within-subject design.

This prediction is the unique empirical commitment that distinguishes the framework from every social-signaling model (which predicts MORE distortion under audience) and from the affective-crowding-out account of Etkin (2016) (which is audience-invariant). If this prediction fails, the audience-replacement claim in P2 requires revision.

5.4 Precision × wedge interaction§

From Corollary 1: in domains with large $\delta$ (move-ring closure, CGM curves), increases in sensor precision should produce net welfare loss (P1 dominates); in domains with small $\delta$ and high baseline self-serving bias (sleep self-perception, productivity self-rating), increases in precision should produce net welfare gain (P3 dominates). The sign-flip across domains is itself a prediction of the joint model and is not derivable from any single-channel account.

6. Design and Policy Implications§

The framework’s central design claim is that the audit-trail limit is not always the welfare-optimum. For sensor regimes with a non-trivial proxy-goal wedge, the standard engineering instinct — collect more data, more precisely, more often — is exactly inverted by Corollary 1: pushing $\sigma^2 \to 0$ amplifies the welfare loss from wedge exploitation faster than it removes attribution noise. Three implications follow.

6.1 Sensor-as-contract design§

The audit-trail regime makes feasible a class of self-binding contracts in which the sensor is the enforcement mechanism rather than the goal-setter. Existing commitment platforms (Stickk, Beeminder) require a third-party referee — a friend who confirms whether the contract has been satisfied. The audit trail eliminates this requirement: a contract conditioned on continuous sensor evidence can self-enforce. Bakos & Halaburda (2019)‘s formal analysis of smart-contract-plus-sensor enforcement maps directly. The design implication runs through the audit score: a contract is written on $q(s)$ (the audit object the user actually responds to), and the welfare consequences are determined by how $q(s)$ tracks $Y(y)$ — i.e., by the wedge $\delta$. Designs that conceal the wedge — choosing a $q$ whose relationship to $Y(y)$ is opaque or platform-determined — produce welfare losses users cannot forecast and cannot price into the contract they sign.

6.2 Anti-Goodhart sensor design§

The most consequential design implication is the deliberate engineering of the audit score $q(s)$ to shrink or randomize $\delta = \partial q(m)/\partial a - \partial Y(y)/\partial a$. Under Option A the model identifies $q$ as the platform’s design choice, not a mathematical convenience: Apple chooses ring closure as the daily $q$; Dexcom chose time-in-range as the CGM $q$; iOS chose phone-only hours as the screen-time $q$. The platform’s $q$ is the lever. Three strategies follow.

Multi-metric aggregation of $q$. A $q$ that fuses several weak signals (step count + heart rate variability + sleep latency + reported subjective state) into a single identity-relevant summary is harder to game than any single-channel $q$. Proxy-gaming requires simultaneous distortion of all components — a cost that scales superlinearly in the dimensionality of the fusion — and the resulting $\partial q/\partial a$ is a weighted average of channel-level gradients, which damps the worst-case wedge. The current Apple Watch ring design ranks worst on this dimension: three near-independent channels, each game-able on its own.

Randomized summarization. A $q$ that reports different aggregations on different days frustrates targeted gaming because the user cannot anticipate which subspace of behavior will be measured on a given day. The action that maximizes today’s $q$ is not the action that maximizes tomorrow’s, so the agent’s best response approaches the welfare-optimizing action $a^\dagger$ as the variance of the daily $q$-rule grows. Grüning et al. (2023)‘s “one sec” friction intervention demonstrates that even small randomizations in the sensor–user interaction can shift behavior toward $Y(y)$ without inducing substitution.

Deliberate sensor noise. Counterintuitively, increasing $\sigma^2$ (reducing precision) can be welfare-improving when $\delta$ is large. The audit-trail limit is not always the welfare-optimum. Corollary 1’s parameter-dependent net effect implies that for high-wedge domains, a less precise sensor would produce less Goodharting (P1’s loss shrinks faster than P3’s gain grows). The Apple Watch ring-closure design — a single, precise, high-salience binary outcome — is precisely the architecture our model predicts will maximize wedge exploitation. A deliberately noisy ring that closes probabilistically on the basis of a multi-component health summary would be theoretically preferable.

6.3 Regulatory exposure when devices author identity§

When a sensor adjudicates identity in domains with welfare or contractual consequences, the regulatory exposure of the device manufacturer becomes nontrivial.

• Medical. Consumer CGM products marketed to non-diabetic populations function as identity-authoring devices in a regime where no validated normative range exists (Rodriguez et al. 2025; Spartano et al. 2025). Users adopt the “metabolically healthy” or “pre-diabetic” identity on the basis of a metric whose welfare-correlate is unknown.
• Insurance. Wearable-linked premium structures (Vitality, John Hancock) make insurance pricing conditional on $m$, not $y$. The wedge becomes a pricing distortion: users with low cardiometabolic risk who do not generate the proxy face higher premiums than users who game the proxy and carry higher true risk.
• Employment. A non-trivial share of large U.S. firms condition some component of workplace wellness benefits on wearable-tracked behavior (KFF 2025), with gaming widely reported in trade press (HuffPost 2019). The model predicts these programs will produce $m$-improvement without $y$-improvement.

In all three contexts, the policy intervention is not to prohibit sensor-based contracting or pricing but to require disclosure of the wedge. $\delta$ should become a regulated quantity that designers must estimate and report — analogous to nutritional labeling for foods or fuel-economy disclosure for vehicles.

7. Limitations§

Exogenous audit score. $q(s)$ is treated throughout as a primitive of the sensor regime, not as a strategic choice. In reality, platforms design $q$ — Apple chose ring closure as the daily audit object; Dexcom chose time-in-range as the CGM audit object; iOS chose phone-only hours as the screen-time audit object — and the design choice is itself the locus of much of the welfare action this paper attributes to “the wedge.” A natural extension is to model $q$ as the output of a platform optimization problem (engagement, retention, signaling, or paternalist welfare) and study the equilibrium $q$ under each objective. §6.2’s design strategies are a partial sketch of this in the paternalist case.

Single-agent. Social comparison, peer monitoring, and the role of audit-trail visibility within reference groups are out of scope. A full treatment of social comparison under audit-trail regimes is left for follow-up work.

Stipulated attribution-bias form. The function $\beta(\sigma^2)$ in P3 is stipulated rather than micro-founded. Bayesian-with-bias mechanisms (Möbius et al. 2022; Coutts 2019) could supply a microfoundation but would substantially extend the model. Our results require only the monotonicity property $\beta'(\sigma^2) > 0$, which is the empirical regularity Mezulis et al. document.

Illustrative empirical anchoring. The cases in §4 are illustrative; we do not estimate the model or quantify $\delta$ in any specific domain. The audience-asymmetry test in §5.3 is the planned empirical commitment.

Domain heterogeneity. Sensor regimes differ in precision, wedge magnitude, and audience structure. The cross-domain heterogeneity Corollary 1 predicts is a feature, but aggregate empirical claims about “the effect of wearable adoption on health” should be domain-decomposed before being interpreted through this framework.

Multi-dimensional type. Real sensors measure narrow slices of a possibly multi-dimensional latent type. Step count is a proxy for cardiometabolic fitness in one coordinate but uninformative about others. The wedge sharpens in a multi-dimensional treatment; we leave the formalization as a future extension.

8. Conclusion§

Personal sensors are reshaping the economics of identity from the bottom up. The shift from narrative to evidentiary identity claims is documented across the quantified-self literature; what has been missing is a formal treatment that integrates this empirical phenomenon into the welfare-theoretic apparatus of behavioral economics. This paper supplies that treatment.

The core conceptual move is that identity utility no longer attaches to a posterior over latent type but to an audit score $q(s)$ — an exogenous summary the sensor stream certifies. Once identity utility is routed through $q(s)$, three results follow that classical identity economics does not produce. P1 says higher sensor precision amplifies a proxy-goal wedge $\delta = \partial q(m)/\partial a - \partial Y(y)/\partial a$ and drives a wedge-proportional distortion of action away from the welfare-optimum. P2 says this distortion survives without an audience: the sensor itself functions as the witness that classical signaling models require. P3 says a residual type-belief channel — the agent’s self-serving attribution of audit evidence to type — runs in the opposite precision direction under a diagnosticity-dominance condition, generating the corollary that the net precision effect on welfare is parameter-dependent and cross-domain heterogeneous.

The core empirical commitment is the audience-asymmetric Goodharting test in §5.3, which inverts the standard signaling prediction: distortion should be larger under private sensing than under context-rich public sensing — falsifying both social-signaling and affective-crowd-out accounts in a single design.

The framework’s design implication is that the audit score $q(s)$ is the platform’s design lever, not a mathematical convenience: anti-Goodhart sensor design (§6.2) is the engineering of $q$ to shrink or randomize the wedge, and is theoretically feasible and welfare-improving in high-wedge domains. The policy implication is that sensor manufacturers may eventually be required to disclose $\delta$ in regulated contexts — analogous to nutritional or fuel-economy labeling. Neither implication is straightforward, and we have presented both at the level of a sketch.

Four open questions follow. First, can the attribution-bias channel of P3 be micro-founded rather than stipulated? Second, can the audit score $q(s)$ be endogenized as the output of a platform optimization problem, with equilibrium $q$ studied under engagement, retention, signaling, and paternalist objectives (§7)? Third, how does the precision-driven welfare ambiguity of Corollary 1 interact with the social-comparison channels we have set aside? Fourth, does the audience-asymmetry prediction of §5.3 survive empirical contact? The first three are theoretical; the fourth is the empirical commitment on which the framework stands or falls.

References§

42 entries, alphabetized by first-author surname. Each citation is linkable in-text via its anchor.

↑ Back to top