How Trust Gets Built
Why institutional trust is built through survived failure, not perfect performance
The Stages of Institutional Cooperation
In an earlier essay, I argued that the deeper layers of inter-institutional trust - admissibility and accountability - are not problems of capacity. They are problems of definition and allocation. Settling them means deciding whose records count and who answers when they are wrong, and institutions do not surrender those decisions lightly. The conclusion was that before trust can travel between institutions, governance has to.
This essay is about how that governance actually gets built. Because it does, sometimes. India has examples of institutional cooperation that worked, and they share a shape worth naming. The clearest case is the Goods and Services Tax.
The Stages Made Visible
Tax authority in India is constitutionally divided between the Union and the States. A national tax system required every state and union territory to treat a centrally-operated record as authoritative for its own revenue, and to accept a dependency on a process it did not solely control. The technology to do this was never the hard part. The hard part was the politics. That politics was not resolved in one act. It was resolved in stages.
The first stage was negotiated cooperation. The GST Council was created - a constitutional body in which the Union and the States sit together and decide rates, rules, exemptions, and dispute resolution. The Council is not a venue for harmonising software. It is a venue for harmonising authority. Each member is willing to accept a dependency only because the others are accepting one as well, and because the terms of that dependency are jointly governed.
Negotiation should not be confused with unanimity. Even the Council required a constitutional amendment to make it possible. States accepted dependency on a centrally-operated network in exchange for guaranteed compensation if their revenue fell short of an agreed baseline. The Centre conceded a permanent constitutional forum in which states could outvote it on most decisions.
Durable cooperation between institutions with real interests is rarely produced by goodwill alone. It is produced by some combination of constitutional authority, financial incentives, political bargaining, regulatory pressure, and credible dispute mechanisms - arrangements that make dependence safer than fragmentation.
The second stage was encoded cooperation. GSTN was built - the network on which returns are filed, invoices matched, credits reconciled, and revenue apportioned. Encoding matters because it makes the agreement durable and machine-checkable. A rule the Council settles becomes a workflow inside GSTN. The agreement no longer depends on the memory of the officials who negotiated it.
But encoding does not, by itself, produce reliance. A working tax network on day one is a declaration that states may treat its records as authoritative. It is not yet the state actually doing so under fiscal consequence. That comes in the next stage, and it cannot be skipped.
The third stage is operational confidence. This is where every state’s revenue department, month after month, year after year, has to actually rely on GSTN’s records to settle real money. Each filing cycle is a small test.
What gets built in this stage is easy to mis-describe. It is not the absence of failure. Institutions do not trust each other because nothing goes wrong; they trust each other because things go wrong and get resolved. A state learns that GSTN can be relied upon not because every reconciliation has been perfect, but because disagreements have occurred, the dispute path has held, and the apportionment has eventually settled correctly.
When the compensation guarantee itself came under strain in 2020, the disagreement was serious enough that a state finance minister called the Centre’s non-payment a sovereign default. What mattered was not the absence of conflict but the presence of a mechanism to resolve it: through the Council, a legal clarification of who was empowered to act, and eventually the Centre borrowing the shortfall itself and passing it through, the guarantee was honoured. The lesson was not that the system never failed. It was that it could absorb failure without collapsing. A bank learns that UPI can be relied upon not because messages never fail, but because reversals, exceptions, and edge cases are handled predictably.
Operational confidence is built through repeated reliance under consequence, and strengthened through recovery. The recovery is the part that does the work, because that is where a downstream institution learns whether reliance on an upstream output is actually safe.
This is why the operational stage cannot be hurried. What is being built is not a rule or a system, but a history - a slowly accumulating record of failures survived. A new platform that has never failed has also never been tested. A platform that has failed, recovered, and continued to carry consequence has begun to earn its weight.
The municipality that has acted on the revenue department’s record ten thousand times and seen what happens when errors surface has something the municipality on day one of any new system does not, no matter how good the system is: a settled sense of where the record can be trusted and where it cannot. That sense is what admissibility practically becomes. It cannot be declared into existence.
This is also why a reformer’s instinct to start with a shared database is often the inversion of the order that works. The database is the encoded stage. Reaching it does not produce the operational history that makes it worth relying on.
The fourth stage is ambient trust. By now, no state revenue official wonders whether to act on the GSTN record. They simply do. The reliance has receded into routine, and the citizen who pays GST does not think about whether central and state systems are coordinating because the coordination is no longer visible enough to think about.
The four stages should not be read as a ladder that a system climbs once. They are recurring elements that appear whenever institutional cooperation becomes durable, and they can run in either direction. Institutions move forward when successful operation accumulates faster than failure without recovery. They move backward when failures pile up unresolved and downstream institutions begin to act on upstream records more cautiously, or stop acting on them altogether. The model is a cycle, not a finish line.
It is worth noting that none of these mechanisms are entirely new. Students of cooperation have long observed that durable coordination requires credible commitments, repeated interaction, and institutions that make dependence safe. What the Indian cases reveal is how these elements combine into a recognisable sequence, and how that sequence can reverse when confidence erodes.
The Same Shape Elsewhere
The shape is not unique to GST, and it does not always appear in a clean sequence. India’s other successful coordination systems show the same elements emerging in different orders and in different domains.
The Unified Payments Interface ran through the stages with banking as its substrate, but only because the substrate had already done most of the deep-layer work. Banks already relied on each other’s settlements through KYC rules, RBI regulation, deposit insurance, the banking ombudsman, and decades of inter-bank clearing. When a cheque drawn on one bank cleared against another, or when a disputed transaction was reversed through established settlement machinery, the reliance was being tested and was holding - long before any retail rail existed. The substrate was effectively admissibility-complete for retail payments between banks before NPCI laid a rail. What NPCI did was extend that pre-built trust to a mass coordination layer through participation rules, certification, dispute processes, and scheme governance.
UPI is essentially the operational and ambient stages layered onto a substrate that had already passed through the earlier stages over decades. It is also worth saying that this happened inside a regulatory hierarchy: banks did not voluntarily agree to interoperate; the RBI enabled and shaped the arrangement, and the rules were not optional.
Aadhaar is the most useful comparison, because its stages did not run in sequence at all. Operational reliance began accumulating in welfare delivery, banking KYC, and subsidy disbursal before the negotiated stage had closed. Questions about inclusion, privacy, the limits of authentication, and the boundaries of legitimate use were still being argued - sometimes in court - while departments and banks and state systems were already building actual reliance. Some of that reliance proved well-founded; some of it had to be unwound, painfully, when failures surfaced that the early operational stage had not anticipated.
Aadhaar illustrates an important asymmetry. Operational confidence can begin accumulating before admissibility and accountability are fully settled. But where the deeper layers remain contested, the confidence that accumulates above them remains fragile.
The stages, or close analogues of them, recur across successful cases. They are not always present in the same order. What every successful case does share is structure: a governance arrangement, often backed by regulatory or constitutional authority, that lets institutions safely accept dependency on one another; encoded infrastructure that makes the arrangement executable; years of operational reliance under consequence, including survived failure, that converts a declaration into a track record; and eventually, coordination that disappears into routine.
What none of them did was begin with a launched platform and hope institutional cooperation would catch up.
The Diagnostic Half
The reason this matters is that the model functions less as a theory of success than as a diagnostic of institutional readiness. It does not tell us which coordination efforts will ultimately succeed; institutions can do everything right and still be overtaken by politics. It tells us what work remains incomplete. It reveals whether governance has been negotiated, whether agreements have been encoded, whether institutions have accumulated operational confidence, and whether reliance has become routine enough to disappear into the background. That is its real use: to locate where an effort actually stands, and to name the work that no amount of better software will let it skip.
Where operational confidence has been allowed to accumulate, sometimes inside the new system, sometimes inherited from a regulated substrate beneath it, the rails carry weight. Where it has been skipped, because the rail was launched before institutions ever did the slow work of relying on one another and recovering from failure, the rails carry dashboards. The technology in both cases is often the same. The institutional history beneath it is not.
The implication for reformers is straightforward.
Begin where coordination costs are low and authority redistribution is minimal.
Standardise before centralising.
Enable verification before sharing raw data.
Build operational confidence before declaring interoperability complete.
Design for failure deliberately - but be precise about what that means. The trust-building event is not the failure; it is the recovery. So the instruction is not to ship something fragile and let it break, which builds nothing and erodes what little reliance exists. It is to build the recovery capacity first - the dispute path, the reconciliation process, the exception handling - and then expose the system to real consequence early enough that failures surface while they are still small and survivable. A system that has handled ten small failures well has earned more trust than one that has handled none, because no one yet knows what it does when something goes wrong.
It also means trust is not a finish line. When reliance becomes ambient, it becomes invisible, and what fades from view also fades from the political and budgetary attention that sustained it. A governance arrangement like the GST Council is not a monument; it is a standing negotiation. When citizens stop seeing the coordination, the people who fund and defend it eventually do too. The cycle can run backward as quietly as it once ran forward.
Back to the Buyer
Return for a moment to the flat buyer in the companion essay - the ordinary citizen who, in trying to register a property, ends up as the integration layer between the sub-registrar’s office, the revenue office, the municipal body, the bank, the utilities, and the tax authority, walking documents from one counter to the next because no institution will accept another’s record on its own.
The reason she carries those documents is not that the technology to move records between these institutions is missing. The reason is that the institutions have not, between themselves, traversed the stages.
There is no GST Council for the propagation of a property record between revenue and municipal systems. No NPCI-like scheme for handling accountability when records disagree. No accumulated operational history that lets the municipality act on the revenue record without asking her to walk it over, and no settled way of handling the failures that would arise if it did.
What the successful Indian DPIs have, and what her situation lacks, is exactly this: a history of institutional reliance under consequence, including survived failure. GST has it for tax. UPI has it for retail payments. The systems that touch her property purchase do not.
And so the cost does not disappear. It is displaced. Where institutions have not done the slow work of learning to depend on one another, the integration burden does not vanish - it transfers onto the citizen, who becomes the human connective tissue that the absent operational history would otherwise have provided.
The missing stages are not an empty space. They are a load, and someone is always carrying it. Which is the real answer to the question the companion essay opened. Before trust can travel, governance has to. And the way governance gets built is not by being declared. It is by being lived - by institutions agreeing to depend on one another, doing so under real consequence for years, surviving the failures that surface, and resolving them in ways the other party can come to count on.
The seamless digital state, when it comes, will not be the work of better software. It will be the work of institutions that spent a decade learning how to depend on one another, surviving the failures that dependence revealed, and building the confidence that lets a record cross a boundary on its own.
Trust does not move because information moves. Information moves because institutions have learned how to trust.