Structural Ethical Infeasibility in AI-Enabled Infrastructure Systems: A Constraint-Based Diagnostic Framework

1. Introduction

AI-enabled optimization models are increasingly used to allocate critical infrastructure services, such as emergency medical dispatch [1,21,33], post-disaster shelter assignment [2,40], and utility restoration [3,10,22]. As these systems move from analytical tools into operational decision-making environments, they are also being evaluated against ethical-governance requirements concerning fairness, accountability, and human oversight [14,15,18,29,36,37]. Yet a persistent difficulty remains: infrastructure allocation outcomes often exhibit systematic disparities across racial and socioeconomic groups, even when the governing decision rules apply the same criteria to every demand unit [11,19,23,30,34,39,40]. This suggests that unequal outcomes do not necessarily arise from explicit algorithmic differentiation across groups [44,45]. They may also arise when formally neutral allocation rules operate within physical and historical infrastructure systems that were themselves developed unequally [4,5,16,35,43].

Several bodies of literature address parts of this problem, but to the best of the authors’ knowledge, none provides the diagnostic distinction needed here: whether ethical infeasibility originates in the rule set, the algorithmic implementation, or the physical infrastructure. The algorithmic-fairness literature primarily formalizes fairness as a property of decision rules and establishes impossibility results showing that several natural fairness criteria cannot be satisfied simultaneously within a classifier [13,17,28,31,41,42,46]. These results are central to understanding conflicts internal to a rule set, but they are not designed to represent conflicts generated by the physical system on which the rule operates. Equity-oriented optimization provides another foundation by formulating allocation models that trade operational performance against distributional objectives [6,7,20,27,32,38]. However, such models typically return either an allocation or an “infeasible” status; they rarely explain whether infeasibility reflects a remediable governance conflict, an algorithmic restriction, or an underlying physical limitation. Robust- and stochastic-allocation methods further strengthen decisions against uncertain demand, travel times, and damage states [10,22], but the infrastructure configuration usually remains a fixed parameter rather than an object of diagnosis. Finally, infeasibility analysis based on the Irreducible Infeasible Subsystem (IIS) [8,12,24,25] can isolate a minimal set of jointly infeasible constraints. What remains missing is an ethical-governance interpretation of that certificate: not only which constraints conflict, but whether the conflict should be attributed to the rule set, the algorithm, or the physical system.

The common limitation across these approaches is that physical infrastructure is usually treated as background context. Ethical failure is therefore presumed to lie in the allocation rule or the algorithm that implements it. This paper argues that such a diagnostic orientation is incomplete. We define an ethical requirement as structurally ethically infeasible when no allocation policy in the feasible decision space $\mathcal{X}$ can satisfy it and the binding constraints arise from the physical infrastructure, i.e., network topology, facility locations, and demand geography, rather than from the algorithm or the rule set. In such cases, infeasibility is a property of the built environment. It cannot be removed by changing the algorithm alone and may require physical investment. An allocation algorithm may therefore satisfy a fairness requirement under one infrastructure configuration but fail under another, not because its logic is defective, but because the second system lacks the physical capacity to support the ethical requirement imposed on it. In those cases, an audit of the allocation rule alone may correctly verify that the algorithm treats demand units consistently while still missing the structural reason that equitable service cannot be achieved. Ethical governance of infrastructure AI therefore requires a parallel assessment of the physical system on which the algorithm operates.

The framework developed in this paper extends algorithmic-fairness analysis by identifying a form of infeasibility external to the rule set: a conflict between an ethical requirement and the physical infrastructure. It extends equity-oriented optimization by replacing a binary feasible/infeasible verdict with an attribution of infeasibility to rule design, algorithmic choice, or infrastructure. When the source is physical, the framework converts the infeasibility certificate into a quantified investment specification rather than treating infeasibility as the endpoint of the analysis. It also modifies robust and stochastic allocation by treating infrastructure not merely as a fixed parameter but as a system whose ethical capacity can be formally evaluated. It also adapts IIS analysis to the ethical-governance setting by interpreting the minimal infeasible subsystem as evidence of the intervention required, rather than treating it only as a certificate of constraint conflict. The resulting contribution is a diagnostic framework that can locate ethical failure in the infrastructure, establish that no allocation policy can remove it under the current configuration, and identify the physical change required to restore feasibility.

Overall, the paper makes three connected contributions:

First, we introduced a minimal constraint-based formulation that augments a standard ethically agnostic allocation problem with hard ethical constraints, soft Pareto objectives, and state-dependent rules. We then specified a hierarchical infeasibility-diagnosis procedure based on Irreducible Infeasible Subsystem (IIS) analysis [8,12,24]. The procedure distinguishes four conflict types and attributes each conflict to one of three sources: rule design, algorithmic choice, or physical infrastructure. This three-way attribution is the diagnostic core of the framework because each source leads to a different class of intervention.

Second, we established the Structural Infeasibility Theorem, which derives closed-form bounds on the inter-group disparity attainable across all feasible allocation policies in any zone-decomposable allocation problem. These bounds are determined by infrastructure topology, the travel-time matrix, the spatial distribution of demand, and the group-composition profile, rather than by any algorithmic design choice. An explicit corollary identifies the one-sided-interval condition under which these bounds imply demographic-parity infeasibility below a critical tolerance, regardless of the dispatch policy. The corollary recovers, as a special case, the parity-infeasibility result that arises in stylized two-group, two-depot configurations, while clarifying that this structural-floor mechanism does not automatically generalize to multi-group, multi-depot settings.

Third, we applied the framework to a metropolitan ambulance-dispatch instance with eight demand zones, three depots, and three protected groups. The case study yielded four substantive findings.

(i)

The legal minimum response time standard (NFPA 1710) was certified as structurally infeasible [9]. The IIS procedure showed that no dispatch policy could meet the standard for two southern zones because no existing depot was close enough to serve those zones within the required threshold. The violation was therefore attributed to physical coverage geometry rather than to a particular dispatch algorithm.

(ii)

Demographic parity at the specified tolerance remained feasible in this instance. Although two southern zones could not meet the minimum-service standard, the resulting delays did not create an unavoidable gap between protected-group mean outcomes. Because the protected groups were distributed across multiple zones and served by multiple depots, the group-level disparities could still be brought within the required tolerance. This finding shows why the Structural Infeasibility Theorem is needed: minimum-service infeasibility and demographic-parity infeasibility are distinct problems, and one does not automatically imply the other.

(iii)

Along the pre-investment Pareto frontier, equity gains arose through harm redistribution rather than harm reduction. Within the existing infrastructure, reducing inter-group disparity required slowing the historically faster-served group rather than improving service to the slower-served group. Consequently, all population groups experienced worse absolute outcomes under the equity-compliant policy than under the operationally optimal baseline.

(iv)

The IIS certificate was converted into a quantified capital-investment specification. The framework identified the minimum siting requirement for a fourth depot that simultaneously resolved the minimum-service violation, satisfied the demographic-parity constraint, and met the disaster-state response standard, while also improving mean system-wide response time. This finding also reframed finding (iii): the efficiency–equity trade-off observed before investment was not a fundamental property of equitable allocation, but an artifact of insufficient infrastructure capacity that disappeared once the binding physical constraint was removed.

Note that although the case study was framed around EMS, the paper’s contributions are not limited to EMS operations. EMS was used because it provided a concrete setting in which response-time standards, depot locations, demand geography, and group-level disparities can be examined together. The underlying formulation, diagnosis procedure, and structural theorem could apply more broadly to zone-decomposable infrastructure allocation problems in which service outcomes depend on the interaction between physical network configuration and allocation decisions. The remainder of the paper is organized as follows. Section 2 introduces the minimal Ethical Constraint Programming (ECP) formulation, the three-tier rule structure, and the four conflict types. Section 3 develops the hierarchical IIS-based diagnosis procedure and the three-way attribution mechanism. Section 4 states and proves the Structural Infeasibility Theorem and its parity-infeasibility corollary. Section 5 applies the framework to the metropolitan ambulance-dispatch instance and presents the IIS attribution, Pareto analysis, harm-redistribution finding, and capital-investment recommendation. Section 6 discusses implications for auditing AI-enabled infrastructure systems and outlines extensions. Section 7 concludes this study.

2. A Minimal Constraint-Based Formulation

This section introduces the formulation used throughout the paper. The formulation establishes the basic objects used in the diagnostic procedure (Section 3) and the theorem (Section 4).

2.1. Notation

Let $\mathcal{I}$ denote the set of individuals or demand units that require service, and let $\mathcal{J}$ denote the set of infrastructure locations, such as depots, shelters, or service facilities. A decision $\mathbf{x}$ is drawn from a feasible decision space $\mathcal{X}$. Once a decision is selected, each individual $i\in \mathcal{I}$ receives a quantifiable service outcome $y_i\left(\mathbf{x}\right)\in {\mathbb{R}}_{\ge 0}$. In an emergency-response setting, this outcome may represent response time; in other infrastructure settings, it may represent restoration time, waiting time, access cost, or another measurable service quantity.

The framework evaluates these outcomes at both the individual and group levels. The population is partitioned into protected groups indexed by $\mathcal{G}$, with ${\bigcup }_{g\in \mathcal{G}}{\mathcal{I}}_g=\mathcal{I}$ and ${\mathcal{I}}_g\cap {\mathcal{I}}_{g^{\prime }}=\varnothing$ for $g\ne g^{\prime }$. This partition will be specified normatively by stakeholders before deployment. For each group g, the mean service outcome is defined as

$${\overline{y}}_g\left(\mathbf{x}\right)={\displaystyle \frac{1}{|{\mathcal{I}}_g|}}\sum _{i\in {\mathcal{I}}_g}{y}_i\left(\mathbf{x}\right)$$

(1)

and serves as the primary quantity through which distributional inequity is evaluated.

Operational performance is represented separately from group-level equity. Let $\mathbf{F}:\mathcal{X}\to {\mathbb{R}}^K$ denote the operational objective vector, where K is the number of operational objectives. Each component $f_k\left(\mathbf{x}\right)$ represents a performance metric, such as mean response time, restoration speed, or aggregate cost. A system state $s\in \mathcal{S}$ records the current operating condition of the infrastructure system, such as normal, surge, or disaster. These states allow the formulation to represent rules that may become active only under specific operating conditions. See Table 1 for more details.

2.2. The Standard Allocation Problem and the ECP-Augmented Form

Let ${\mathcal{G}}_{\mathrm{op}}\subseteq \mathcal{X}$ denote the set of decisions satisfying the operational constraints (capacity, coverage, routing, scheduling, or conservation). In this baseline setting, the allocation model asks which feasible decision provides the best operational performance. The standard ethically-agnostic allocation problem can be mathematically represented as:

$$\underset{\mathbf{x}\in {\mathcal{G}}_{\mathrm{op}}\cap \mathcal{X}}{min}\mathbf{F}\left(\mathbf{x}\right),$$

(P0)

where minimization is in the Pareto sense when $K\ge 2$. Problem (2) represents the type of optimization problem commonly used in infrastructure AI systems. It evaluates operational performance, but it does not evaluate how the resulting service outcomes $y_i\left(\mathbf{x}\right)$ are distributed across the population. Therefore, it can identify an operationally strong allocation, but it cannot by itself certify ethical compliance.

The ECP form extends (2) by adding an ethical rule set that is specified before deployment:

$$\mathcal{R}=\mathcal{H}\cup \dot{\mathcal{S}}\cup \mathcal{D},$$

where the three components represent hard constraints, soft Pareto objectives, and dynamic state-dependent rules, respectively. Hard rules $r\in \mathcal{H}$ define requirements that every ethically admissible decision must satisfy, and therefore enter the model as constraints $e_r\left(\mathbf{x}\right)\le 0$. Soft rules $r\in \dot{\mathcal{S}}$ represent ethical objectives that may be traded off against operational performance; they enter the model as objectives $e_r^S\left(\mathbf{x}\right)$ to be minimized on a Pareto frontier alongside $\mathbf{F}$. Dynamic rules $r\in \mathcal{D}$ represent requirements that apply only under particular system states. These rules contribute state-conditional constraints $e_r(\mathbf{x},s)\le 0$ that become active only when $s\in {\mathcal{S}}_r$.

With these rule types added, the ECP problem can be mathematically formulated as:

$$\begin{array}{cc}\hfill \underset{\mathbf{x}}{min}& \left(\mathbf{F}\left(\mathbf{x}\right),{\mathbf{E}}^S\left(\mathbf{x}\right)\right)\hfill \\ \hfill \mathrm{s}.\mathrm{t}.& \mathbf{x}\in {\mathcal{G}}_{\mathrm{op}}\cap \mathcal{X},\hfill \\ \hfill & e_r\left(\mathbf{x}\right)\le 0,\forall r\in \mathcal{H},\hfill \\ \hfill & e_r(\mathbf{x},s)\le 0,\forall r\in \mathcal{D}\left(s\right),\hfill \end{array}$$

(ECP)

where $\mathcal{D}\left(s\right)=\{r\in \mathcal{D}:s\in {\mathcal{S}}_r\}$ and ${\mathbf{E}}^S$ stacks the soft objectives into a vector. The feasible region under state s is

$$\mathrm{\Omega }\left(s\right)=\left\{\mathbf{x}\in {\mathcal{G}}_{\mathrm{op}}\cap \mathcal{X}:e_r\left(\mathbf{x}\right)\le 0\forall r\in \mathcal{H},e_r(\mathbf{x},s)\le 0\forall r\in \mathcal{D}\left(s\right)\right\}.$$

(2)

The central diagnostic question of this paper is to determine whether $\mathrm{\Omega }\left(s\right)$ is empty, and if so, which constraints are responsible.

2.3. Three-Tier Rule Set

The ethical rule set is organized into three tiers so that the framework can distinguish between requirements that must always be satisfied, objectives that can be traded off, and rules that apply only under particular system states. The first tier is the hard tier $\mathcal{H}$. It contains rules whose violation makes a decision ethically inadmissible, even if that decision performs well operationally. In this paper, we focus primarily on two hard rules. The first is demographic parity, which requires the mean service outcomes of protected groups to remain within a specified tolerance $\delta$:

$$|{\overline{y}}_g\left(\mathbf{x}\right)-{\overline{y}}_{g^{\prime }}\left(\mathbf{x}\right)|\le \delta ,\forall g,g^{\prime }\in \mathcal{G}.$$

(HC-DP)

The minimum-service guarantee imposes a baseline level of service for every individual. For example, in the EMS setting, NFPA 1710 prefers Advanced Life Support response within $\theta =480$ seconds in urban areas:

$$y_i\left(\mathbf{x}\right)\le {\theta }_i,\forall i\in \mathcal{I}.$$

(HC-MS)

The second tier is the soft tier $\dot{\mathcal{S}}$. Unlike hard rules, soft rules do not determine whether a decision is ethically admissible. Instead, they define ethical objectives that can be traded off against operational efficiency on a Pareto frontier. In this paper, we focus primarily on three such objectives: Gini-type dispersion (SO-EQ), vulnerability-weighted welfare $E_{\mathrm{vw}}\left(\mathbf{x}\right)=-{\sum }_i{v}_i{y}_i\left(\mathbf{x}\right)$ (SO-VW), and Rawlsian welfare $E_{\mathrm{rw}}\left(\mathbf{x}\right)=-{min}_i{y}_i\left(\mathbf{x}\right)$ (SO-RW).

The third tier is the dynamic tier $\mathcal{D}$. This tier contains rules that apply only under particular system states, such as surge or disaster conditions. These state-conditional constraints are implemented using the big-M formulation

$$e_r(\mathbf{x},s)\le M_r\left(1-{\mathrm{\Phi }}_r\left(s\right)\right),\forall r\in \mathcal{D},{\mathrm{\Phi }}_r\left(s\right)=\mathbf{1}[s\in {\mathcal{S}}_r],$$

(3)

which becomes binding when ${\mathrm{\Phi }}_r\left(s\right)=1$ and is otherwise non-restrictive. $M_r$ is set to the smallest valid upper bound on $e_r(x,s)$ over $\mathcal{X}$, i.e., $M_r={max}_{x\in \mathcal{X}}{e}_r\left(x\right)$, so that the constraint is redundant when ${\mathrm{\Phi }}_r\left(s\right)=0$; tighter per-zone values may be used to strengthen the relaxation.

This three-tier structure allows the framework to represent multiple fairness requirements at the same time. Several fairness constraints may be placed in the hard tier $\mathcal{H}$ and enforced jointly, with their intersection defining $\mathrm{\Omega }\left(s\right)$. Several fairness objectives may also be placed in the soft tier $\dot{\mathcal{S}}$ and traded off jointly on a common Pareto frontier. The framework therefore does not require a single fairness metric to be selected in advance.

2.4. Four Conflict Types

Infeasibility of $\mathrm{\Omega }\left(s\right)$ may arise through four distinct mechanisms. The purpose of distinguishing these mechanisms is to identify whether infeasibility comes from the ethical rule set itself, from the interaction between the rules and the operational system, from trade-offs among soft objectives, or from state-dependent conditions.

A Type I (rule–rule) conflict arises when two hard rules are each satisfiable on their own but cannot be satisfied together, even over the unrestricted decision space $\mathcal{X}$. Formally, this occurs when $\mathrm{\Omega }\left({\eta }_r\right)\ne \varnothing$ and $\mathrm{\Omega }\left({\eta }_{r^{\prime }}\right)\ne \varnothing$, yet $\mathrm{\Omega }\left({\eta }_r\right)\cap \mathrm{\Omega }\left({\eta }_{r^{\prime }}\right)=\varnothing$, for some pair $(r,r^{\prime })\in \mathcal{H}\times \mathcal{H}$, where $\mathrm{\Omega }\left({\eta }_r\right)=\{x\in \mathcal{X}:e_r\left(x\right)\le 0\}$ is the set of decisions satisfying rule r alone. The two conditions $\mathrm{\Omega }\left({\eta }_r\right)\ne \varnothing$ and $\mathrm{\Omega }\left({\eta }_{r^{\prime }}\right)\ne \varnothing$ are essential: they guarantee that each rule is satisfiable in isolation, so the incompatibility lies strictly between the two rules and not in either rule by itself. A conflict of this kind is internal to the rule set. It does not depend on the operational set ${\mathcal{G}}_{\mathrm{op}}$, and it cannot be removed by changing the algorithm or the physical infrastructure; the rules are mutually contradictory as ethical requirements. Type I therefore captures the formal structure of classifier-fairness impossibility in the present allocation setting [13,31].

A Type II (rule–operational) conflict is different: here each hard rule is satisfiable over $\mathcal{X}$, and the rules are mutually consistent, but they cannot be satisfied jointly once the operational set ${\mathcal{G}}_{\mathrm{op}}$ is imposed. Formally,

$$\left(\bigcap _{r\in \mathcal{H}}\mathrm{\Omega }\left({\eta }_r\right)\right)\cap {\mathcal{G}}_{\mathrm{op}}=\varnothing .$$

The infeasibility here is not internal to the rule set; the rule-feasible region ${\bigcap }_{r\in \mathcal{H}}\mathrm{\Omega }\left({\eta }_r\right)$ is nonempty. It becomes empty only after intersecting with ${\mathcal{G}}_{\mathrm{op}}$, which encodes the operational constraints and the physical infrastructure. In other words, the ethical requirements are compatible in principle but cannot be met by any decision the system can actually execute. A rule that is already infeasible by itself—for example, because no decision in $\mathcal{X}$ can meet it, as when the infrastructure cannot physically deliver the required service—falls under this type rather than Type I, and is diagnosed at the operational stage.

A Type III (soft–soft) conflict is different from the first two types because it is not a feasibility failure. It represents the expected Pareto trade-off among $(\mathbf{F},{\mathbf{E}}^S)$ on a non-empty $\mathrm{\Omega }\left(s\right)$. In other words, the system remains ethically admissible, but different soft objectives may favor different points on the Pareto frontier.

A Type IV (state-conditional) conflict arises when feasibility depends on the operating state. Formally, this occurs when $\mathrm{\Omega }\left(s_1\right)\ne \varnothing$ but $\mathrm{\Omega }\left(s_2\right)=\varnothing$ for some $s_1,s_2\in \mathcal{S}$. This type captures latent infeasibilities that may not appear under normal operating conditions but become active under specific states, such as surge or disaster conditions.

3. Hierarchical IIS Diagnosis and Three-Way Attribution

The diagnostic workflow proceeds as a fixed pipeline, summarized in Figure 1 and specified in full as Algorithm 1. The pipeline has five steps. First, in the Encode step, the normatively specified rule set $\mathcal{R}=\mathcal{H}\cup \dot{\mathcal{S}}\cup \mathcal{D}$ is compiled into the constraints of Eq. (3), thereby fixing $\mathrm{\Omega }\left(s\right)$. Second, in the Detect step, the feasibility of $\mathrm{\Omega }\left(s\right)$ is tested. If $\mathrm{\Omega }\left(s\right)$ is non-empty, the workflow proceeds to Pareto optimization over $(\mathbf{F},{\mathbf{E}}^S)$ and terminates with a feasible verdict. Third, in the Localize step, if $\mathrm{\Omega }\left(s\right)=\varnothing$, the irreducible infeasible subsystem ${\mathrm{IIS}}^{*}$ is extracted by deletion filtering (Algorithm 2), returning a minimal set of jointly incompatible constraints. Fourth, in the Attribute step, the constraints in ${\mathrm{IIS}}^{*}$ are partitioned by origin into rule-induced, algorithm-induced, or infrastructure-induced sources. This attribution determines both the conflict type and the admissible class of intervention. Fifth, in the Intervene step, the attribution identifies the appropriate remedy: rule revision, algorithmic relaxation, or capital investment. When the cause is physical, ${\mathrm{IIS}}^{*}$ is also converted into a quantified investment specification. The three stages of the procedure—pairwise, joint, and state-conditional feasibility—implement steps (2)–(4) and map onto the four conflict types of Section 2.4; Table 2 and Table 3 summarize the constraint classes and the attribution-to-intervention mapping, respectively.

An IIS is a minimal subset of constraints that is jointly infeasible but becomes feasible if any single constraint in that subset is removed [12,26]. In practice, modern mixed-integer solvers such as Gurobi, CPLEX, and SCIP extract IISs using deletion-filtering heuristics that terminate in a number of feasibility solves linear in the constraint count. The deletion-filtering subroutine used in this framework is given in Algorithm 2. We now describe the three diagnostic stages in detail.

Stage 1 tests pairwise hard-rule feasibility. For each $(r,r^{\prime })\in \mathcal{H}\times \mathcal{H}$, the procedure solves the feasibility problem $\mathbf{x}\in \mathcal{X},e_r\left(\mathbf{x}\right)\le 0,e_{r^{\prime }}\left(\mathbf{x}\right)\le 0$. This test is conducted over the decision space $\mathcal{X}$ alone and deliberately excludes the operational set ${\mathcal{G}}_{\mathrm{op}}$. The reason is diagnostic: if two rules are infeasible over $\mathcal{X}$ itself, then the conflict is internal to the rule set and is classified as a genuine Type I conflict. In that case, the two rules are mutually inconsistent before operational or infrastructure constraints are even considered. By contrast, if a rule becomes infeasible only after ${\mathcal{G}}_{\mathrm{op}}$ is imposed, the problem is not a rule–rule conflict; it is a rule–operational interaction and is detected separately at Stage 2. A Type I conflict therefore indicates that the rule set is internally inconsistent and must be revised through governance.

Stage 2 tests joint hard-rule feasibility within the operational system. Specifically, the procedure solves $\mathbf{x}\in \mathrm{\Omega }\left(s\right)$ under all constraints in $\mathcal{H}\cup \mathcal{D}\left(s\right)$. If this problem is infeasible, the IIS is extracted by deletion filtering over the full constraint system $\mathcal{H}\cup \mathcal{D}\left(s\right)\cup {\mathcal{G}}_{\mathrm{op}}$ via Algorithm 2. This is important because the extracted certificate ${\mathrm{IIS}}^{*}$ is allowed to contain not only ethical rules, but also operational and infrastructure constraints from ${\mathcal{G}}_{\mathrm{op}}$. As a result, the diagnosis can determine whether infeasibility is caused by the rule set itself, by an algorithmic restriction, or by a physical infrastructure limitation.

Stage 3 tests state-conditional feasibility. For each anticipated state $s^{\prime }\in \mathcal{S}$, the procedure evaluates whether $\mathrm{\Omega }\left(s^{\prime }\right)$ is empty. This stage identifies Type IV exposures: cases in which the system is feasible under one state but becomes infeasible under another. As reflected in Algorithm 1, a Type II finding at Stage 2 does not terminate the procedure. Instead, the conflict and its certificate are recorded, and the procedure continues to Stage 3 so that latent state-conditional infeasibilities can still be identified even when the current state is already infeasible.

Once ${\mathrm{IIS}}^{*}\subseteq \mathcal{H}\cup \mathcal{D}\left(s\right)\cup {\mathcal{G}}_{\mathrm{op}}$ has been extracted, its constraints are partitioned by origin. Constraints drawn from $\mathcal{H}\cup \mathcal{D}\left(s\right)$ are treated as part of the ethical rule set, while constraints drawn from ${\mathcal{G}}_{\mathrm{op}}$ are treated as operational or infrastructure constraints. The latter are then further distinguished according to whether the binding parameter reflects an algorithmic restriction or a physical system property.

• Rule-induced infeasibility occurs when ${\mathrm{IIS}}^{*}$ contains multiple constraints from $\mathcal{H}$ alone, indicating a rule-set inconsistency. This is a higher-order analogue of the Type I conflict that Stage 1’s pairwise test may not capture. The appropriate intervention is rule revision through governance.
• Algorithm-induced infeasibility occurs when ${\mathrm{IIS}}^{*}$ contains constraints arising from algorithmic restrictions on $\mathcal{X}$, such as fixed assignment heuristics or nearest-depot policies. The appropriate intervention is algorithmic relaxation or reformulation.
• Infrastructure-induced infeasibility occurs when ${\mathrm{IIS}}^{*}$ consists primarily of operational and physical-system parameters in ${\mathcal{G}}_{\mathrm{op}}$, such as capacities, distances, or network topology, that are jointly incompatible with $\mathcal{H}$. The appropriate intervention is capital investment in the physical infrastructure.

The three-way attribution is the main analytical output of the diagnosis because each source of infeasibility requires a different remedy. Algorithm-only auditing can detect Type I conflicts and algorithm-induced Type II conflicts, but it cannot identify infrastructure-induced infeasibility when the relevant IIS contains no algorithmic constraint. In such a case, the source of failure lies in the physical system rather than in the allocation rule. The remedy is therefore not algorithmic. Instead, ECP converts the IIS into a quantified infrastructure-investment specification, identifying the threshold change in the physical configuration required to restore $\mathrm{\Omega }\left(s\right)\ne \varnothing$.

The attribution step should not be interpreted as an automatic output of the IIS procedure. In Algorithm 1, this step appears as $Attribute\left({\mathrm{IIS}}^{*}\right)$, but the routine represents an analyst-supplied partition recorded in the governance log. The IIS identifies a minimal jointly infeasible subsystem; determining whether the constraints in that subsystem reflect a policy choice, an algorithmic restriction, or a physical system property requires contextual knowledge of how the ECP instance was constructed. This interpretive step is therefore explicit and auditable. The governance log preserves both the IIS certificate and the partition applied to it, allowing the attribution to be reviewed, contested, and revised as institutional knowledge of the system develops. Because different plausible partitions of the same IIS may lead to different attributions and different intervention recommendations, the partition must be recorded rather than treated as an automatic diagnostic output.

Algorithm 1 Hierarchical Infeasibility Diagnosis

Input:  ECP instance $\langle \mathcal{X},{\mathcal{G}}_{\mathrm{op}},F,\mathcal{R}=\mathcal{H}\cup \dot{\mathcal{S}}\cup \mathcal{D},s\rangle$ Output:  Set of findings (conflict type, certificate, attribution); or Feasible 1: $\mathit{findings}\leftarrow \varnothing$ 1: Stage 1 (Type I): pairwise hard-rule feasibility 2: for each unordered pair $(r,r^{\prime })\in \mathcal{H}\times \mathcal{H}$ do 3:     $f_r\leftarrow Feasible\left(\{x\in \mathcal{X}:e_r\left(x\right)\le 0\}\right)$;   $f_{r^{\prime }}\leftarrow Feasible\left(\{x\in \mathcal{X}:e_{r^{\prime }}\left(x\right)\le 0\}\right)$ 4:     $f_{r{r}^{\prime }}\leftarrow Feasible\left(\{x\in \mathcal{X}:e_r\left(x\right)\le 0,e_{r^{\prime }}\left(x\right)\le 0\}\right)$ 5:     if $f_r$ and$f_{r^{\prime }}$ andnot$f_{r{r}^{\prime }}$ then▹ both individually satisfiable, jointly incompatible 6:         return $\left\{(\mathrm{Type}\mathrm{I},\{r,r^{\prime }\},Rule)\right\}$▹ genuine rule–rule conflict 7:     end if 8: end for 8: Stage 2 (Type II): joint hard ∩ operational feasibility 9: if not$Feasible\left(\mathrm{\Omega }\left(s\right)\right)$ then▹ all $r\in \mathcal{H}\cup \mathcal{D}\left(s\right)$ 10:     ${\mathrm{IIS}}^{*}\leftarrow ExtractIIS\left(\mathcal{H}\cup \mathcal{D}\left(s\right)\cup {\mathcal{G}}_{\mathrm{op}},\mathcal{X}\right)$▹${\mathcal{G}}_{\mathrm{op}}$ deletable, so it can enter ${\mathrm{IIS}}^{*}$ 11:     $a\leftarrow Attribute\left({\mathrm{IIS}}^{*}\right)$▹ interpretive partition, recorded in log $\mathcal{L}$; not automatic 12:     $\mathit{findings}\leftarrow \mathit{findings}\cup \left\{(\mathrm{Type}\mathrm{II},{\mathrm{IIS}}^{*},a)\right\}$▹ record, do not return 13: end if 13: Stage 3 (Type IV): state-conditional feasibility 14: for each anticipated future state $s^{\prime }\in \mathcal{S}$ do 15:     if not $Feasible\left(\mathrm{\Omega }\left(s^{\prime }\right)\right)$ then 16:         $\mathit{findings}\leftarrow \mathit{findings}\cup \left\{(\mathrm{Type}\mathrm{IV},s^{\prime })\right\}$ 17:     end if 18: end for 19: if$\mathit{findings}=\varnothing$thenreturn$(Feasible,\mathrm{\Omega }(s)\ne \varnothing )$ 20: end if 21: returnfindings

Algorithm 2 ExtractIIS: deletion-filtering IIS extraction

Input:  Full constraint system $C=\mathcal{H}\cup \mathcal{D}\left(s\right)\cup {\mathcal{G}}_{\mathrm{op}}$; decision space $\mathcal{X}$ Output:  Minimal infeasible subsystem ${\mathrm{IIS}}^{*}\subseteq C$ 1: ${\mathrm{IIS}}^{*}\leftarrow C$ 2: for each $c\in C$ do 3:     if not $Feasible\left(\{x\in \mathcal{X}:{\mathrm{IIS}}^{*}\setminus \left\{c\right\}\}\right)$ then 4:         ${\mathrm{IIS}}^{*}\leftarrow {\mathrm{IIS}}^{*}\setminus \left\{c\right\}$▹c not needed for infeasibility 5:     end if 6: end for 7: return${\mathrm{IIS}}^{*}$▹ terminates in $\left|C\right|$ feasibility solves

4. The Structural Infeasibility Theorem

The IIS procedure in Section 3 identifies which constraints are jointly responsible for infeasibility in a specific instance. However, it does not, by itself, explain how that infeasibility is structured across all possible allocation policies. For zone-decomposable allocation problems, this structure can be characterized more directly. In this setting, the Type II infeasibility mechanism admits closed-form bounds that apply simultaneously to every allocation policy in $\mathcal{X}$. Importantly, these bounds are determined by the infrastructure topology rather than by the algorithm used to choose an allocation.

This characterization is useful for two reasons. First, it allows a governing institution to assess whether a fairness tolerance is structurally achievable before solving an optimization problem. Second, it identifies the infrastructure parameters that determine the attainable disparity bounds. This provides a principled way to determine where physical investment would be most effective if feasibility must be restored. This section states and proves that result and then develops the corresponding parity-infeasibility corollary.

4.1. Setting

Before stating the theorem, we define the class of allocation problems to which it applies. The key feature of this class is zone decomposability: service decisions are made at the zone level, each zone receives a common outcome, and the assignment of one zone does not constrain the assignment of another. This structure allows the disparity bounds to be derived zone by zone.

Definition 1 

(Zone-decomposable allocation problem). An ECP instance iszone-decomposableif it satisfies the following five conditions.

(D1) 

Zone partition.   The demand population is partitioned into a finite set of zones $\mathcal{Z}$; every individual in zone z receives the common outcome $r_z\left(\mathbf{x}\right)$, so individual outcomes are constant within a zone.

(D2) 

Single-facility assignment.   Each zone is assigned to exactly one facility through binary indicators $a_{dz}\in \{0,1\}$ with ${\sum }_{d\in \mathcal{J}}{a}_{dz}=1$, and the zone outcome is $r_z\left(\mathbf{x}\right)={\sum }_{d\in \mathcal{J}}{a}_{dz}T[d,z]$.

(D3) 

Separable operational set.   The operational set ${\mathcal{G}}_{\mathrm{op}}$ imposes no constraint coupling the assignments of distinct zones; the only operational requirement is the per-zone assignment condition (D2). Equivalently, $\mathcal{X}={\prod }_{z\in \mathcal{Z}}\mathcal{J}$ factorizes as an independent per-zone choice.

(D4) 

Fixed demographic structure.   The group-composition matrix ${\varphi }_{g,z}\in [0,1]$ (with ${\sum }_g{\varphi }_{g,z}=1$) and the demand intensities ${\lambda }_z\ge 0$ are exogenous parameters, independent of the decision $\mathbf{x}$.

(D5) 

Linear group aggregation.   Group-mean outcomes are the demand-weighted averages ${\overline{y}}_g\left(\mathbf{x}\right)={\lambda }_g^{-1}{\sum }_z{\varphi }_{g,z}{\lambda }_z{r}_z\left(\mathbf{x}\right)$ with ${\lambda }_g={\sum }_z{\varphi }_{g,z}{\lambda }_z>0$.

4.2. Statement and Proof

Theorem 1 

(Structural Infeasibility Theorem: signed-disparity bounds). Under the setting of Section 4.1, consider any two protected groups $(g,g^{\prime })\in \mathcal{G}\times \mathcal{G}$. To characterize how much the mean outcomes of these two groups can differ across all feasible assignments, define the disparity coefficient

$$c_{g,g^{\prime },z}=\left({\displaystyle \frac{{\varphi }_{g,z}}{{\lambda }_g}}-{\displaystyle \frac{{\varphi }_{g^{\prime },z}}{{\lambda }_{g^{\prime }}}}\right){\lambda }_z,$$

(4)

and the achievable signed-disparity bounds

$$\begin{array}{cc}\hfill L_{g,g^{\prime }}& =\sum _{z\in \mathcal{Z}}\left\{\begin{array}{cc}{c}_{g,g^{\prime },z}\underset{d}{min}T[d,z],\hfill & c_{g,g^{\prime },z}\ge 0,\hfill \\ c_{g,g^{\prime },z}\underset{d}{max}T[d,z],\hfill & c_{g,g^{\prime },z}<0,\hfill \end{array}\right.\hfill \end{array}$$

(5)

$$\begin{array}{cc}\hfill U_{g,g^{\prime }}& =\sum _{z\in \mathcal{Z}}\left\{\begin{array}{cc}{c}_{g,g^{\prime },z}\underset{d}{max}T[d,z],\hfill & c_{g,g^{\prime },z}\ge 0,\hfill \\ c_{g,g^{\prime },z}\underset{d}{min}T[d,z],\hfill & c_{g,g^{\prime },z}<0.\hfill \end{array}\right.\hfill \end{array}$$

(6)

Then for every $\mathbf{x}\in \mathcal{X}$,

$$L_{g,g^{\prime }}\le {\overline{y}}_g\left(\mathbf{x}\right)-{\overline{y}}_{g^{\prime }}\left(\mathbf{x}\right)\le U_{g,g^{\prime }},$$

(7)

and both bounds are tight. Specifically, each bound is attained by the assignment that selects, in every zone, the facility achieving the relevant per-zone extremum.

Proof. 

Because ${\mathcal{G}}_{\mathrm{op}}$ satisfies the separability condition (D3), the decision space factorizes as $\mathcal{X}={\prod }_{z\in \mathcal{Z}}\mathcal{J}$: choosing $\mathbf{x}$ is equivalent to choosing, independently for each zone z, a single facility $d_z\in \mathcal{J}$. The disparity ${\sum }_z{c}_{g,g^{\prime },z}{r}_z\left(\mathbf{x}\right)={\sum }_z{c}_{g,g^{\prime },z}T[d_z,z]$ is then a sum of terms each depending on a distinct, independently chosen $d_z$, so its minimum over $\mathcal{X}$ equals the sum of per-zone minima, ${min}_{\mathbf{x}}{\sum }_z{c}_{g,g^{\prime },z}T[d_z,z]={\sum }_z{min}_{d\in \mathcal{J}}{c}_{g,g^{\prime },z}T[d,z]$, and likewise for the maximum (the interchange of sum and minimization is valid because the per-zone choices are unconstrained across zones). For a fixed zone, ${min}_d{c}_{g,g^{\prime },z}T[d,z]$ is attained at $arg{min}_{d}T[d,z]$ when $c_{g,g^{\prime },z}\ge 0$ and at $arg{max}_{d}T[d,z]$ when $c_{g,g^{\prime },z}<0$, since scaling by a nonnegative (nonpositive) constant preserves (reverses) the ordering of ${\left\{T[d,z]\right\}}_d$. Summing per-zone extrema yields $L_{g,g^{\prime }}$ and $U_{g,g^{\prime }}$ as in (9)–(), and tightness follows from constructive achievability. □

Corollary 1 

(Parity infeasibility under one-sided intervals). If, for some pair $(g,g^{\prime })$, the achievable signed-disparity interval $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$ does not contain zero, then the signed disparity between the two groups cannot be eliminated by any allocation policy. In that case, for every $\mathbf{x}\in \mathcal{X}$,

$$\left|{\overline{y}}_g\left(\mathbf{x}\right)-{\overline{y}}_{g^{\prime }}\left(\mathbf{x}\right)\right|\ge min\left(|L_{g,g^{\prime }}|,|U_{g,g^{\prime }}|\right).$$

Consequently, (5) at any tolerance $\delta <min\left(\right|L_{g,g^{\prime }}|,|U_{g,g^{\prime }}\left|\right)$ is infeasible across all allocation policies. The infeasibility is therefore attributable to the travel-time matrix T, rather than to the dispatch algorithm. If $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$ contains zero, Theorem 1 alone does not imply demographic-parity infeasibility.

Remark 1 

(Scope and limitations). First, the bounds of Theorem 1 depend only on the data $(T,\varphi ,\lambda )$ and hold forevery$\mathbf{x}\in \mathcal{X}$. No assumption is made about the dispatch policy, the solver, or the objective being optimized. Second, the decisive hypothesis is the separability condition (D3): it is what allows the minimum and maximum of the disparity sum to be computed zone by zone, and it is the only place the proof uses structure beyond linearity. The theorem therefore applies exactly to allocation problems whose binding operational constraint is the per-zone assignment. This includes single-assignment zone-to-facility dispatch, shelter-to-zone matching, and restoration-of-zone scheduling, provided there is no shared-resource coupling between zones.

Third, the theorem does not apply unchanged in three situations: (i) when facility capacities, vehicle counts, or crew availability couple zones, so that ${\mathcal{G}}_{\mathrm{op}}$ is no longer separable; (ii) when a zone may be split across several facilities (fractional $a_{dz}$, as in load balancing); or (iii) when outcomes are nonlinear in the assignment (for example, congestion or queueing). In cases (i) and (ii) the closed-form bounds remain valid asouterbounds, even though they are no longer tight: the true achievable interval is contained in $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$, because coupling can only shrink the feasible set. A parity-infeasibility verdict from Corollary 1 therefore remains sound, but a feasibility verdict must be re-checked against the coupling constraints. Realistic networks are covered to the extent that capacity and routing act as separable per-zone restrictions, or are slack at the operating point of interest. Capacity-coupled and stochastic generalizations, for which the bounds hold in expectation, are directions we are actively developing.

The theorem focuses on HC-DP because demographic parity is the hard constraint whose feasibility depends on the full system structure. Unlike a purely local service requirement, demographic parity depends on how network topology, demand distribution, and group composition interact across all zones and all feasible policies. Whether two group means can be brought within a tolerance $\delta$ is therefore not determined by any single zone or facility. It depends jointly on where each protected group is located, how much demand each zone generates, and what response times are achievable from each facility. The disparity coefficient $c_{g,g^{\prime },z}$ captures this zone-level contribution to the overall group disparity, which is why a closed-form bound is both non-trivial and useful.

The remaining hard constraint has a different structure and is handled directly by the IIS procedure. HC-MS infeasibility reduces to a local per-zone condition: zone z is infeasible if and only if ${min}_{d}T[d,z]>\theta$. This condition can be checked independently for each zone and does not require group composition or cross-zone interactions. The soft objectives SO-EQ, SO-RW, and SO-VW also play a different role. Because they are soft objectives rather than hard constraints, they do not create infeasibility by themselves. Instead, they generate Type III Pareto trade-offs against operational performance. The theorem therefore does not apply to them directly. However, the disparity bounds $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$ still restrict what can be achieved on the Pareto frontier: no policy can attain SO-EQ, SO-RW, or SO-VW values that would require group mean outcomes outside the bounds guaranteed by Theorem 1.

4.3. Two Regimes

Theorem 1 shows that demographic-parity feasibility depends on the achievable signed-disparity interval $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$. The key question is whether this interval contains zero. If zero is outside the interval, then every feasible allocation leaves a nonzero gap between the two group means, so demographic parity below that gap is structurally infeasible. If zero lies inside the interval, then the theorem does not rule out demographic parity; in that case, some allocation may be able to bring the two group means within the required tolerance.

This distinction depends on the signs of the zone-level disparity coefficients $c_{g,g^{\prime },z}$. These coefficients indicate whether each zone pushes the signed disparity ${\overline{y}}_g\left(\mathbf{x}\right)-{\overline{y}}_{g^{\prime }}\left(\mathbf{x}\right)$ in a positive or negative direction. The central issue is whether the zone-level contributions all push disparity in the same direction, or whether some zones push it in opposite directions so that they can offset one another. This gives rise to two regimes.

In the first regime, the coefficients $c_{g,g^{\prime },z}$ have the same sign across zones. This pattern commonly appears in stylized settings with two groups, two facilities, and binary group composition ${\varphi }_{g,z}\in \{0,1\}$. In such cases, the zone-level contributions do not offset one another; instead, they all move the signed disparity in the same direction. As a result, the interval $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$ lies entirely above or entirely below zero. Corollary 1 then applies: the absolute disparity between the two groups is bounded away from zero for every feasible allocation policy. In this regime, demographic parity below the implied floor is structurally infeasible, regardless of the dispatch algorithm. The source of infeasibility is the infrastructure-demand geometry itself.

In the second regime, the coefficients $c_{g,g^{\prime },z}$ have mixed signs across zones. This pattern is more likely in systems with three or more groups, three or more facilities, and mixed group composition $0<{\varphi }_{g,z}<1$. In such systems, a zone is not exclusively associated with one protected group. Assigning a zone to a closer or farther facility therefore affects multiple groups at the same time. Some zones may increase the signed disparity between groups g and $g^{\prime }$, while other zones may reduce it. Because these contributions can offset one another, the interval $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$ may contain zero. When this occurs, Corollary 1 does not imply demographic-parity infeasibility. Demographic parity may still be achievable, although achieving it may require sacrificing operational efficiency.

The distinction between these two regimes is substantive and not obvious without the theorem. A planner or auditor working with a multi-group, multi-depot system might incorrectly assume that the parity-infeasibility result familiar from stylized two-group configurations carries over to their setting. The theorem establishes that it does not, and provides the analytical conditions under which parity remains structurally achievable. The case study of Section 5 demonstrates this distinction concretely: the metropolitan ambulance instance falls into the second regime, where minimum-service is structurally infeasible but demographic parity at the regulator’s tolerance remains feasible, a finding that the theorem makes precise and that algorithm-only auditing cannot produce.

5. Case Study: Metropolitan Ambulance Dispatch

The case study exercises the diagnostic procedure of Section 3 and the theorem of Section 4 on an EMS instance. The substantive findings are: a Type II infeasibility on the minimum-service rule (HC-MS) certified as infrastructural; a substantive failure of Corollary 1’s one-sided-interval condition that renders demographic parity feasible despite operational asymmetry; a Pareto frontier exhibiting a harm-redistribution pattern; and a quantified capital-investment specification that simultaneously resolves four binding constraints while improving operational performance.

Every numerical claim below is produced along an analytical path. It uses the framework’s prescribed procedures: per-zone feasibility checks, Stage 2 IIS attribution, $\epsilon$-constraint Pareto computation, and the closed-form bounds of Theorem 1. The verification path enumerates the $3^8$ assignments in $\mathcal{X}$ (and, for the post-investment analysis, the $4^8=65,536$ assignments in the extended space) and evaluates rule violations and operational objectives at each point.

5.1. Instance Specification

A stylized metropolitan EMS system serving approximately 280,000 residents was considered. The service area was divided into eight demand zones arranged along a north–south spatial gradient, $\mathcal{Z}=\{z_1,\dots ,z_8\}$, and served by three depots, $\mathcal{J}=\{d_1,d_2,d_3\}$. Depots $d_1$ and $d_2$ represent historically established service centers in the northern and central parts of the region, while $d_3$ is located in the southwest. Each depot is treated as uncapacitated at the operating point of interest, so no constraint couples the assignments of distinct zones; this is the separability condition (D3) under which Theorem 1 applies. Capacity-coupled variants fall outside this separable setting and are discussed in Remark 1. Demand is concentrated more heavily in the southern zones, reflecting population growth and demographic change. No additional depot construction was assumed in the initial system. Three protected groups, $\mathcal{G}=\{\mathrm{Maj},\mathrm{Black},\mathrm{Hisp}\}$, and three operational states, $\mathcal{S}=\{normal,surge,disaster\}$, were defined, with protected-group membership specified normatively before analysis.

The decision variable was $\mathbf{x}=\left(a_{dz}\right)\in {0,1}^{\left|\mathcal{J}\right|·\left|\mathcal{Z}\right|}$, with ${\mathcal{G}}_{\mathrm{op}}$ imposing ${\sum }_d{a}_{dz}=1$ for each zone. Thus, each zone must be assigned to exactly one depot. With three depots and eight zones, the system has ${\left|\mathcal{J}\right|}^{\left|\mathcal{Z}\right|}=3^8=6,561$ admissible assignments. The instance was evaluated at $s=normal$, while transitions to other operational states were examined through the dynamic-rule analysis below.

Travel times $T[d,z]$ in minutes are reported in Table 4. These travel times are constructed rather than measured, but they are designed to represent a coherent service geography. Northern and central zones are efficiently served by $d_1$ and $d_2$, while the southern zones are farther from the historically established depots. Depot $d_1$ is closest to $z_1$–$z_3$ with travel times of 3–5 min, depot $d_2$ is closest to $z_4$–$z_5$ with travel times of 3–4 min, and depot $d_3$ is closest to $z_6$–$z_8$ with travel times of 7–11 min. The north–south gradient is also reflected in the travel times from $d_1$, which increase monotonically from 3 min at $z_1$ to 22 min at $z_8$.

The key structural feature is the coverage gap in the southern part of the system. Zones $z_7$ and $z_8$ have minimum travel times of 9 and 11 min, respectively, even when served by the closest available depot. Both values exceed the service threshold $\theta =8$. This means that no current depot can serve these zones within the required standard (see Figure 2). This built-in coverage gap is the source of the minimum-service infeasibility diagnosed later in the case study. The qualitative findings therefore depend on the structural pattern of the instance—efficient service in the north, growing demand in the south, no depot close enough to serve the far southern zones within the standard, and different protected-group concentrations across the gradient—rather than on the exact numerical entries in Table 4.

Call rates in calls per hour were $\lambda =(4,3,3,5,4,4,3,2)$ with total $\Lambda =28$. The group-composition matrix ${\varphi }_{g,z}$ (Table 5) gave the fraction of zone-z calls attributable to each group. Group call rates were ${\lambda }_{\mathrm{Maj}}=14.95$, ${\lambda }_{\mathrm{Black}}=8.14$, and ${\lambda }_{\mathrm{Hisp}}=4.91$. Vulnerability scores $v_z\in [0,1]$ were $v=(0.15,0.20,0.25,0.40,0.45,0.75,0.80,0.78)$, rising sharply across the north–south gradient.

The zone-level outcome is $y_z\left(\mathbf{x}\right)=r_z\left(\mathbf{x}\right)={\sum }_d{a}_{dz}T[d,z]$. The demand-weighted system mean is $\overline{R}\left(\mathbf{x}\right)={\Lambda }^{-1}{\sum }_z{\lambda }_z{r}_z\left(\mathbf{x}\right)$, and the operational objective vector is $\mathbf{F}\left(\mathbf{x}\right)={(\overline{R}\left(\mathbf{x}\right),{max}_z{r}_z\left(\mathbf{x}\right))}^{\top }$. Note that the instance is synthetic and was constructed to allow exact verification of the analytical results. It is not drawn from a single municipal dataset. Instead, all parameters are reported in Table 4Table 5, so that every numerical claim can be independently reproduced by enumeration. Although synthetic, the instance is designed to represent a plausible metropolitan service geography. The eight zones follow a north–south gradient in which historically established depots ($d_1,d_2$) are located in the older northern and central core, while demand and social vulnerability have shifted south. The travel-time matrix captures the resulting coverage asymmetry, especially the fact that southern zones $z_7,z_8$ remain distant from all existing depots. The group-composition matrix represents spatial variation in protected-group concentration, and the thresholds $\theta =8$ min and $\delta =2$ min represent the NFPA 1710 Advanced Life Support standard and the specified demographic-parity tolerance, respectively.

5.2. Baseline P0 Audit

We first evaluate the ethically agnostic baseline by solving (2) using only the operational objective vector $\mathbf{F}\left(\mathbf{x}\right)$ and the operational constraints. This produces the unique nearest-depot policy

$${\mathbf{x}}_{\mathrm{P}0}=(d_1,d_1,d_1,d_2,d_2,d_3,d_3,d_3),\overline{R}\left({\mathbf{x}}_{\mathrm{P}0}\right)=5.25\min ,\underset{z}{max}{r}_z\left({\mathbf{x}}_{\mathrm{P}0}\right)=11\min .$$

This policy performs well from a purely operational perspective, but it does not satisfy all ethical requirements. Group means and pairwise disparities under ${\mathbf{x}}_{\mathrm{P}0}$ are reported in Table 6. The minimum-service rule is violated in zones $z_7$ and $z_8$, where response times are 9 and 11 min, respectively, exceeding the threshold $\theta =8$. Demographic parity is also violated, although by a smaller margin, with a maximum disparity of $2.348>\delta =2$. The soft objectives evaluate to SO-EQ$=0.252$, SO-RW$=11$, and SO-VW$=-80.91$.

Thus, the baseline allocation is inadmissible under two hard requirements: minimum service and demographic parity. The next question is whether these violations can be corrected by choosing a different allocation within $\mathcal{X}$, or whether at least one violation is structurally unavoidable under the existing infrastructure. Stages 1–3 of the diagnostic procedure address this question.

5.3. Ethical Requirements and Feasibility Diagnosis

The audited rule set was $\mathcal{R}=\mathcal{H}\cup \dot{\mathcal{S}}\cup \mathcal{D}$. The hard tier was $\mathcal{H}=\{(\mathrm{HC}-\mathrm{MS})@\theta =8,(\mathrm{HC}-\mathrm{DP})@\delta =2\}$, the soft tier was $\dot{\mathcal{S}}=\{\mathrm{SO}-\mathrm{EQ},\mathrm{SO}-\mathrm{VW},\mathrm{SO}-\mathrm{RW}\}$, and the dynamic tier was $\mathcal{D}=\{D_1,D_2\}$. Rule $D_1$ was surge-triggered and relaxed the service threshold to 12 minutes when $s\in \{surge,disaster\}$. Rule $D_2$ was disaster-triggered and imposed a 10-minute response standard on high-vulnerability zones when $s=disaster$. In this instance, the high-vulnerability zones were $z_6,z_7,z_8$, because $v_z\ge 0.5$ for these zones.

Following the big-M criterion, each $M_r$ is set per zone as ${max}_{d}T[d,z]-{\theta }_r$. For $D_2$, this gives 8, 10, and 12 for $z_6$, $z_7$, and $z_8$, respectively. The scalar bounds $M_{D_1}=10$ and $M_{D_2}=12$ are also valid for the respective rules, because they are the maxima over the affected zones using the global maximum travel time of 22 minutes.

The minimum-service threshold $\theta =480$ s is considered fixed by the NFPA 1710 standard. In contrast, there is no universal legal tolerance for demographic parity in EMS response. The parity tolerance must therefore be specified by the governing body. We use $\delta =2$ min as an illustrative board-specified tolerance for three reasons. First, a two-minute disparity is substantively meaningful because response-time differences of this scale have been associated with out-of-hospital cardiac-arrest survival [39]. Second, $\delta =2$ lies just below the maximum disparity of the operationally optimal baseline ($2.348$ min), so the constraint is binding rather than trivially satisfied. Third, the paper’s qualitative conclusions do not depend on this exact value. As shown in Section 5.4, demographic parity is feasible in this instance for every tolerance above the discrete minimum of $0.02$ min. Thus, the central finding remains the same: demographic parity is feasible while minimum service is structurally infeasible. The value of $\delta$ affects where the compliant solution lies on the Pareto frontier and the size of the harm-redistribution effect, but it does not change whether parity is achievable or which constraint produces the binding infrastructural conflict.

Stage 1 (Type I)

Stage 1 tests whether the hard rules are internally inconsistent. The pairwise feasibility tests found no internally infeasible rule pairs. HC-MS at $\theta =8$ and HC-DP at $\delta =2$ are not mutually contradictory as ethical rules. HC-DP is individually satisfiable in $\mathcal{X}$. HC-MS is not individually satisfiable in this instance, but its failure is caused by infrastructure: no depot can reach $z_7$ or $z_8$ within $\theta =8$. Because Type I requires both rules to be individually satisfiable and jointly inconsistent, this is not a rule–rule conflict. The rule set is therefore internally consistent, and the HC-MS violation is carried forward to Stage 2 for infrastructure attribution.

Stage 2 (Type II)

Stage 2 tests whether the hard rules can be satisfied within the operational and infrastructure system. For (HC-MS) to hold, every zone must be reachable from at least one depot within the 8-minute threshold. Table 7 shows that this condition fails for $z_7$ and $z_8$: no depot can reach either zone within 8 minutes. Because (HC-MS) is separable across zones, these two local failures imply global infeasibility. In other words, no assignment in $\mathcal{X}$ can satisfy (HC-MS). Direct enumeration confirms this result: zero of the 6,561 assignments are (HC-MS)-feasible.

The IIS certificate is

$$\begin{array}{c}{\mathrm{IIS}}_{\mathrm{HC}-\mathrm{MS}}=\{(\mathrm{HC}-\mathrm{MS})\mathrm{at}\theta =8;T[d_1,z_7]=20,T[d_2,z_7]=14,T[d_3,z_7]=9;\hfill \\ \hfill T[d_1,z_8]=22,T[d_2,z_8]=16,T[d_3,z_8]=11\},\end{array}$$

(8)

which shows that the binding conditions are travel-time entries from the infrastructure topology. They are not algorithmic restrictions on $\mathcal{X}$ and they are not conflicts among fairness rules. The conflict therefore cannot be resolved by changing the dispatch algorithm.

In contrast, (HC-DP) at $\delta =2$ remains feasible within $\mathcal{X}$. The lowest-$\overline{R}$ assignment satisfying (HC-DP) is $(d_1,d_2,d_2,d_2,d_2,d_3,d_3,d_3)$, with $\overline{R}=5.79$ min and a maximum pairwise disparity of 1.78 min. The joint feasibility set (HC-MS)∩(HC-DP) is empty only because (HC-MS) is already infeasible. Stage 2 therefore returns a single binding Type II conflict on (HC-MS), attributed to infrastructure.

Stage 3 (Type IV)

Stage 3 tests whether feasibility changes under different operational states. Under $s=surge$, rule $D_1$ relaxes the service threshold to 12 minutes. This restores feasibility: 144 of the 6,561 assignments satisfy the relaxed standard, and the minimum max-disparity is 0.594 min.

Under $s=disaster$, both $D_1$ and $D_2$ activate. Zones $z_6$ and $z_7$ can satisfy the 10-minute vulnerability-prioritized threshold from $d_3$. However, $z_8$ remains infeasible because ${min}_{d}T[d,z_8]=11>10$. The system is therefore infeasible under disaster, which produces a Type IV exposure.

5.4. Application of Theorem 1

The disparity coefficients $c_{g,g^{\prime },z}$ for the metropolitan instance are reported in Table 8. Applying Theorem 1 yields the signed-disparity bounds

$$\begin{array}{cc}\hfill {\overline{y}}_{\mathrm{Maj}}-{\overline{y}}_{\mathrm{Black}}& \in [-7.817,+2.215],\hfill \\ \hfill {\overline{y}}_{\mathrm{Maj}}-{\overline{y}}_{\mathrm{Hisp}}& \in [-5.669,+2.157],\hfill \\ \hfill {\overline{y}}_{\mathrm{Black}}-{\overline{y}}_{\mathrm{Hisp}}& \in [-0.346,+2.435]\hfill \end{array}$$

(all in minutes). Every interval contains zero. The one-sided condition of Corollary 1 therefore fails for all three group pairs, and the corollary implies no absolute-disparity infeasibility on this instance. Enumeration confirms this conclusion: the smallest max-pairwise disparity attainable across the three pairs simultaneously is $0.020$ min, achieved at $\overline{R}=9.18$ min and ${max}_z{r}_z=16$ min. This instance therefore behaves differently from the stylized two-group, two-depot configuration. At this scale, with three groups and three depots, demographic parity at $\delta =2$ min is feasible, and the binding Type II conflict falls on (HC-MS) rather than on (HC-DP). The diagnostic procedure correctly distinguishes the two regimes.

5.5. Pareto Frontier and Harm Redistribution

Because (HC-MS) at $\theta =8$ is infeasible under normal, we examine the efficiency–equity trade-off over the full decision space $\mathcal{X}$, without imposing the minimum-service constraint, so that the structure of the trade-off is fully visible. In Table 9, the ${max}_z{r}_z$ column reports the worst-case zone response time, that is, the minimum-service level each frontier point would require. For reference, 144 assignments satisfy the relaxed standard $\theta =12$ that the oversight board authorized as a temporary operating condition pending capital investment; these are the points with ${max}_z{r}_z\le 12$, namely #0–#9 and #11. The Pareto frontier in $(\overline{R},max\mathrm{disparity})$-space, computed by enumeration on this small instance, is reported in Table 9.

The lowest-$\overline{R}$ assignment satisfying $\delta =2$ is assignment #3, $(d_1,d_2,d_2,d_2,d_2,d_3,d_3,d_3)$, with $\overline{R}=5.79$ min and max disparity $1.78$ min, which costs $+0.54$ min ($+10.2\%$) relative to the P0 baseline. The frontier has two regions. Assignments #0–#6 keep ${max}_z{r}_z=11$ and trade efficiency for parity by reassigning only the northern and central zones. Assignments #7–#16 progressively reassign zones to $d_3$ in less direct combinations, accepting a larger worst-case zone response in exchange for further parity reduction. The smallest disparity attainable in $\mathcal{X}$ is $0.020$ min at point #16, which is consistent with the signed-disparity intervals containing zero (Section 5.4). This minimum reflects the discrete granularity of $\mathcal{X}$ rather than a structural floor.

To interpret these trade-offs, we distinguish two kinds of equity-improving policy change using the population-impact vector $\Delta {\overline{y}}_g={\overline{y}}_g\left({\mathbf{x}}^{\prime }\right)-{\overline{y}}_g\left({\mathbf{x}}_{\mathrm{P}0}\right)$, where a larger response time is worse. A change is harm reduction if it lowers disparity while making at least one group strictly better off and no group worse off, that is, $\Delta {\overline{y}}_g\le 0$ for all g with strict inequality for some g. A change is harm redistribution if it lowers disparity while making no group better off, that is, $\Delta {\overline{y}}_g\ge 0$ for all g. In the second case the disparity statistic improves only because the advantaged group is brought down toward the others, not because the disadvantaged group is lifted. The two cases are indistinguishable to an audit that reports only the disparity statistic, yet they are opposite in welfare content. The population-impact vector is what separates them.

The distinction turns on the direction of the change in each group’s outcome when the disparity statistic falls. Under harm reduction, the reduction is achieved by improving the outcome of at least one group while leaving none worse off, so the narrowing of the gap reflects a gain accruing to a previously disadvantaged group. Under harm redistribution, no group’s outcome improves, and the gap narrows solely because the outcome of the previously advantaged group is degraded toward those of the others. The two cases are observationally equivalent at the level of the aggregate disparity statistic, which registers a reduction in either case and therefore cannot, on its own, distinguish a Pareto-improving change from a leveling-down. We accordingly report the change in each group’s mean outcome separately.

Table 10 applies this test to the move from the operationally optimal baseline ${\mathbf{x}}_{\mathrm{P}0}$ to the equity-compliant incumbent. The maximum pairwise disparity falls from $2.35$ to $1.78$ min, so by the disparity statistic alone the change appears to be an equity improvement. The population-impact vector, however, is $\Delta \overline{y}=(+0.79,+0.23,+0.27)$ min for the Majority, Black, and Hispanic groups, respectively, and every entry is positive. The Majority group, previously the fastest served, is slowed by $18.5\%$; the Black and Hispanic groups, already the slowest served, are not sped up at all but are themselves slowed further, by $3.4\%$ and $4.5\%$. No group ends up better off than at the baseline. The gap between groups narrows only because the best-served group is brought down, not because either worse-served group is improved. The change therefore satisfies the harm-redistribution criterion exactly ($\Delta {\overline{y}}_g\ge 0$ for all g, with no negative entry) and fails the harm-reduction criterion. The demand-weighted system mean confirms the aggregate effect, rising from $5.25$ to $5.79$ min, so the population as a whole waits longer even as the distribution narrows.

The reason becomes clear once the geography is made explicit. Each group’s average response time is a weighted average of the travel times to the zones in which that group lives. The slower-served groups are concentrated in the southern zones, which lie far from every existing depot, so their averages are already close to the best the infrastructure can deliver. There is almost no room to speed them up without a new depot. Disparity can therefore be narrowed in only one direction: by routing the faster-served group through slower assignments until its average drifts down toward the others. Equity is purchased by making the well-served worse off, because the badly-served cannot be made better off within the existing network. This is not an artifact of the particular numbers. For any zone z, the achievable response time satisfies $r_z\left(\mathbf{x}\right)\ge {min}_{d}T[d,z]$, so each group mean is bounded below by ${\overline{y}}_g\left(\mathbf{x}\right)\ge {\lambda }_g^{-1}{\sum }_z{\varphi }_{g,z}{\lambda }_z{min}_{d}T[d,z]$, a floor fixed entirely by the depot geography. On this instance the baseline P0 is the nearest-depot policy, so it places every zone at ${min}_{d}T[d,z]$ and therefore attains this floor exactly for all three groups simultaneously; the P0 column of Table 10 equals the bound. No policy can improve any group relative to P0. Consequently, every equity-improving move is necessarily redistributive, and the redistribution persists until the floor itself is lowered by adding a depot, exactly as the post-investment analysis of Section 5.6 confirms.

5.6. Capital-Investment Specification

The Type II IIS certificate of Eq. (12) contains no rule-set or algorithmic constraints; its binding conditions are the travel-time entries to $z_7$ and $z_8$. ECP converts this certificate into a quantified investment specification. A proposed fourth depot $d_4$ must satisfy $T[d_4,z_7]\le 8$ and $T[d_4,z_8]\le 8$ to restore (HC-MS); zone $z_6$ is already feasible from $d_3$ at 7 min. The second condition also implies $T[d_4,z_8]\le 10$, which restores $D_2$ feasibility under disaster. The strict-feasibility threshold is therefore

$$max\left(T[d_4,z_7],T[d_4,z_8]\right)\le 8\min .$$

(9)

To verify this recommendation, we evaluated a hypothetical $d_4$ with travel-time vector $T[d_4,·]=(25,24,26,14,13,5,4,6)$, representing a depot sited near the southern minority cluster and far from the northern zones. The decision space then expands to $4^8=65,536$. Table 11 reports two natural Pareto corners under the joint constraint set (HC-MS) at $\theta =8$, (HC-DP) at $\delta =2$, and $D_2$: the $\overline{R}$-optimal corner and the parity-optimal corner.

The capital investment simultaneously resolves (HC-MS), (HC-DP) at $\delta =2$, the $D_2$ disaster-state requirement, and the SO-RW worst-case bound at every joint-feasible assignment. At the $\overline{R}$-optimal corner, mean response time improves to $4.07$ min relative to the $5.25$-min P0 baseline, all three group means fall below $4.4$ min, and the worst-case zone response time drops from 11 to 6 min. The parity-optimal corner trades part of this efficiency gain for a tighter equity profile, reducing max disparity from $0.51$ to $0.11$ min at $\overline{R}=5.16$ min, which is still below the pre-investment baseline. Both corners satisfy the board’s $\delta =2$ target with substantial margin.

This result is the principal substantive finding of the case study. The efficiency–equity trade-off documented along the pre-investment Pareto frontier of Section 5.5 is itself an artifact of constrained infrastructure, not a fundamental property of the allocation problem. Once the binding infrastructural constraint is removed, both objectives improve at the same time. An auditor evaluating only the dispatch algorithm under the three-depot configuration would observe a real but infrastructure-induced trade-off and might conclude that equity gains require operational sacrifice. The IIS-based diagnosis instead identifies the trade-off as removable and specifies how to remove it.

6. Discussion

The results support the central argument of the paper: ethical infeasibility in AI-enabled infrastructure systems is not a single phenomenon with a single cause. The dominant algorithmic-fairness literature characterizes one such cause, namely the internal inconsistency of fairness criteria within a classifier, and proves that several natural fairness objectives cannot be satisfied simultaneously. The Structural Infeasibility Theorem identifies a categorically different cause. The bounds $L_{g,g^{\prime }}$ and $U_{g,g^{\prime }}$ of Eqs. (9)–() depend only on the travel-time matrix, the spatial distribution of demand, and the group-composition profile. These are properties of the physical and demographic environment, not of any algorithmic design choice. When the interval $[L_{g,g^{\prime }},U_{g,g^{\prime }}]$ excludes zero and the implied parity floor exceeds the regulator’s tolerance, no allocation policy in $\mathcal{X}$ can satisfy demographic parity, and no algorithmic adjustment can recover it. The source of the failure lies in the infrastructure, and it is invisible to any audit that examines only the algorithm.

The case study makes this distinction operationally concrete in two complementary ways. The first concerns attribution. The IIS certificate for the HC-MS infeasibility contains only travel-time entries from the depot–zone topology; it contains no algorithmic constraint, no fairness rule, and no rule-set inconsistency. Algorithm-only auditing of the dispatch system under the three-depot configuration would correctly detect that the system violates the NFPA 1710 standard, but it would have no way to identify the cause as infrastructural and no basis for a constructive remedy. The IIS procedure supplies both: a formal attribution of cause and a quantified specification of the physical investment required to restore compliance.

The second concerns welfare. The harm-redistribution finding of Table 10 shows that equity attained within fixed infrastructure differs in kind from equity attained through capital investment. Under the pre-investment Pareto incumbent, every group experiences a worse absolute outcome than under the operationally optimal baseline; under the post-investment corner of Table 11, every group experiences a better one. Two policies can therefore report identical disparity values while embodying opposite welfare structures, and an equity audit that reports only the disparity statistic cannot tell them apart. As the case study establishes, this is not incidental to the present instance: within a fixed infrastructure whose binding floor is already attained, disparity can be reduced only by leveling the advantaged group down, never by lifting the disadvantaged group up. The welfare consequence is that an apparent equity gain and a genuine one are indistinguishable at the level of the summary statistic, which is why the distinction must be drawn at the level of the population-impact vector.

These findings carry three implications for the ethical governance of AI-enabled infrastructure systems. First, the scope of an audit must extend beyond the allocation algorithm to the physical system on which it operates. The IIS certificate is the formal object that determines whether observed inequity is attributable to the algorithm, to the infrastructure, or to a rule conflict, and the appropriate intervention follows from that attribution. Second, equity statistics evaluated on a fixed infrastructure can conceal harm-redistribution patterns that are ethically consequential. The population-impact decomposition of Section 5.5 should therefore be treated as a minimum standard for distributional analysis: it is not enough to report that disparity fell; one must also report which groups were slowed and which were sped, in order to characterize the welfare structure of the change. Third, when the certificate attributes infeasibility to physical infrastructure, the framework returns not a refused deployment but a quantified capital-investment specification. This shifts the locus of decision from the algorithmic-design layer to the capital-planning layer of the governing institution and supplies the technical basis for that shift.

The relationship between the framework and existing fairness-optimization methods is best assessed along three axes: solution quality, diagnostic capability, and computational efficiency. With regards to solution quality, the framework’s optimization layer is a standard $\epsilon$-constraint procedure that sweeps a tolerance on one objective, here inter-group disparity, while minimizing the other, and records the non-dominated points to trace the Pareto frontier. On a feasible instance, this frontier is not a property of the procedure that computes it but of the problem itself: the set of non-dominated efficiency–equity trade-offs is fixed once the objectives and the feasible region are fixed. Any method that optimizes the same objectives over the same region must therefore reach the same frontier, whether it imposes equity as an explicit constraint to be tightened or aggregates outcomes through an order-weighted welfare function that penalizes inequality. The methods differ only in how they scalarize or traverse the frontier. Table 12 confirms this on the case-study instance: the optima of an efficiency-only, an equity-constrained, a weighted-sum, and a lexicographic min-disparity formulation each coincide with a point on the Pareto frontier of Table 9. Solution quality is therefore identical by construction, so a head-to-head quality comparison on feasible instances would measure the choice of scalarization rather than the merit of the approach. The single informative exception is a method that minimizes a different equity functional, such as a Gini or order-weighted objective, whose optimum is Pareto-optimal in its own objective space but dominated in the maximum-disparity projection in which the regulator’s tolerance is expressed. The framework reproduces any of these by selecting the corresponding soft objective and is in this sense a superset of the individual formulations.

The distinctive capability of the framework appears where these methods fall silent, namely at infeasibility. When the feasible region is empty, a conventional equity-aware optimizer can do one of two things, and neither is diagnostic. It can halt with an “infeasible” status, a single bit that reports the failure but says nothing about its source. Alternatively, if the binding requirement is softened, it can return a least-violating point; depending on the violation metric, that point may localize the deficit to the unreachable zones or spread it across the population, but in neither case does it certify that the violation is irreducible across all policies, attribute its source to the infrastructure rather than the dispatch policy, or indicate how to remove it. Impossibility results from the fairness literature reach only rule–rule contradiction: they establish when fairness criteria are mutually inconsistent as logical statements, but they are formulated independently of the physical system and so cannot detect a conflict that arises from the interaction between a rule and the infrastructure on which it operates. Table 13 contrasts what each approach can report on the infeasible minimum-service instance (HC-MS at $\theta =8$, where no assignment in $\mathcal{X}$ complies). The IIS procedure localizes the infeasibility to the travel-time entries for zones $z_7$ and $z_8$, the zones no depot can reach within the standard, certifies the conflict as infrastructural rather than algorithmic or rule-internal, and converts that certificate into a quantified depot-siting specification that states the physical change required to restore feasibility. The comparison is therefore not one of competing solvers on the same problem, but of what each approach can say when the problem has no solution at all.

A third baseline family deserves separate consideration, because it is the most widely deployed algorithmic fairness remedy: post-processing and reweighting methods, which adjust the decision rule after training through group-specific calibration, threshold shifting, or instance reweighting. These are the canonical algorithmic remedy for outcome disparity, yet on the case-study instance none of them can restore minimum-service compliance. The set of achievable response times for a zone is ${\left\{T[d,z]\right\}}_{d\in \mathcal{J}}$, fixed by depot geography; for $z_7$ and $z_8$ the smallest element of this set is 9 and 11 minutes, both exceeding $\theta =8$. Post-processing changes which attainable outcome is selected, not the attainable set itself, so reweighting, threshold adjustment, and group-conditional calibration are all powerless against an infeasibility whose source is that the compliant outcome is not attainable under any rule. This is essentially the content of the IIS certificate, and it sharpens the paper’s central claim: the dominant algorithmic-fairness intervention operates on the decision rule, but here the binding constraint is not in the rule. The contrast is not that the framework reweights better; it is that reweighting cannot reach the failure at all.

The capacity of the framework to emit an informative infeasibility certificate also bears on a practical concern about constraint-based formulations: that placing fairness requirements in the hard tier may render a problem infeasible. It may, and in a well-posed model it should, because a hard constraint encodes a non-negotiable requirement, and when no policy satisfies it the correct output is an infeasibility verdict rather than a silently degraded solution. The genuine risk is not infeasibility as such but over-specification: placing in the hard tier a requirement that properly admits trade-offs, or setting its tolerance tighter than any infrastructure can support, so that the feasible region is empty for reasons that should have been weighed on the Pareto frontier. The hard/soft tier distinction is the structural guard against this. Only truly non-negotiable requirements belong in $\mathcal{H}$; requirements that admit legitimate trade-offs belong in $\dot{\mathcal{S}}$ and are resolved on the frontier rather than as feasibility cuts. When a hard constraint does bind, the IIS identifies exactly which constraint and parameter is responsible, so the governing institution can choose, on the record, to relax it, re-tier it, or invest in the physical system, rather than discovering the infeasibility as an unexplained solver failure.

On the third axis, computational efficiency, the comparison can focus on feasible instances: every method solves the same class of problem, so the optimization cost is shared, and the framework adds only the diagnostic step, deletion-filtering IIS extraction, at a cost linear in the number of hard constraints. This diagnostic also remains computable at deployment scale, because the procedure does not enumerate the decision space. The exhaustive evaluation of the ${\left|\mathcal{J}\right|}^{\left|\mathcal{Z}\right|}=3^8$ admissible assignments, and of the $4^8$ assignments in the post-investment analysis, was a verification device used to confirm the analytical results exactly on a small instance; it is not a step the method requires. The diagnostic cost is instead governed by three operations, none of which scales combinatorially in the size of the instance. First, minimum-service feasibility (HC-MS) reduces to an independent per-zone test—zone z is infeasible if and only if ${min}_{d}T[d,z]>\theta$—decided in $O\left(\right|\mathcal{Z}\left|\right|\mathcal{J}\left|\right)$ time without optimization. Second, the disparity bounds of the Structural Infeasibility Theorem are closed-form functions of the travel-time matrix, the demand intensities, and the group-composition profile, and are evaluated in the same $O\left(\right|\mathcal{Z}\left|\right|\mathcal{J}\left|\right)$ time, so demographic-parity feasibility is settled analytically rather than by search. Third, the only solver-dependent step is the Stage 2 joint-feasibility test, a single mixed-integer feasibility problem, after which the IIS is recovered by deletion filtering in a number of feasibility solves linear in the number of hard constraints, $O\left(\right|\mathcal{H}\left|\right)$, rather than combinatorial in problem size. The entire computational burden therefore concentrates in one standard mixed-integer feasibility problem, precisely the class for which modern branch-and-cut solvers are routinely effective on instances far larger than the case study. We accordingly expect the procedure to remain tractable for metropolitan systems with hundreds of demand zones and tens of facilities. To verify scalability, we ran the diagnostic on synthetic instances ranging from $\left|\mathcal{Z}\right|=25$ demand zones and $\left|\mathcal{J}\right|=8$ facilities up to $\left|\mathcal{Z}\right|=200$ zones and $\left|\mathcal{J}\right|=30$ facilities. Table 14 reports the runtime of the three diagnostic operations. The per-zone minimum-service check and the closed-form disparity bounds complete in under a millisecond at every size, and the single mixed-integer feasibility test with IIS extraction stays under $0.2$ s even for a decision space of ${30}^{200}$ assignments, which cannot be enumerated. Because the cost is dominated by one feasibility solve rather than enumeration, the procedure remains tractable well beyond metropolitan scale.

A related question is how the stakeholder-selected thresholds, namely the parity tolerance $\delta$, the service standard $\theta$, and the activation states for dynamic rules, would be determined in practice. The framework treats these as normative inputs rather than quantities it computes, but it is not silent on how they are set; it supplies the information against which an informed choice can be made. In many domains the threshold is already fixed by a legal or regulatory standard. The case study’s $\theta =480$ s is the NFPA 1710 Advanced Life Support requirement, not a value chosen by the analyst, and analogous service standards, civil-rights disparate-impact criteria, and access mandates supply thresholds elsewhere. Where no external standard applies, the threshold is the responsibility of a normatively legitimate governance body, such as a regulator, an oversight board, or a public commission, ideally acting through a process that represents the affected communities. For that body, the framework provides three forms of decision support. The Structural Infeasibility Theorem reports, prior to deployment, the range of disparity achievable on the given infrastructure, so a tolerance can be anchored to what is attainable rather than set blind. The Pareto frontier exhibits the operational cost of each candidate tolerance, so a soft threshold can be chosen with its efficiency–equity trade-off visible. The IIS certificate, when a chosen threshold proves infeasible, identifies the physical change that would be required to meet it. What the framework does not do, deliberately, is adjudicate which threshold is normatively correct. That judgment belongs to institutional processes; the role of the framework is to make those processes better informed, not to replace them.

This paper has three main limitations, each pointing to ongoing work. First, the case study uses a synthetic instance rather than data from a specific city. This was deliberate: a synthetic instance allows every result to be verified exactly and every parameter to be reported, ensuring reproducibility that access-restricted municipal data would not permit. The study is therefore a proof of concept, and its qualitative conclusions depend on structural features (a southern coverage gap, multi-group zones, a binding service standard) rather than exact values. Validation on real-world EMS data is a direct next step, as the framework’s inputs map onto quantities available in deployed systems. Second, the case study is deterministic; extending the diagnostic to stochastic and robust formulations, under which the bounds of Theorem 1 hold in expectation, is a further step. Third, the framework takes the ethical rule set as given: it certifies whether the specified rules are feasible but does not judge whether they are normatively correct, a judgment left to the institutions that set them.

7. Conclusions

This study describes a source of ethical conflict in AI-enabled infrastructure systems that the existing literature does not capture. Fairness research locates the problem inside the decision rule, and algorithmic critiques locate it in design choices, but inequity can also be forced by the physical layout of the infrastructure itself. The Structural Infeasibility Theorem makes this precise, giving closed-form bounds on the group disparity any policy can reach; those bounds come from the depot–zone geography, not from the algorithm. The IIS procedure then traces a given infeasibility back to its origin in the rule set, the algorithm, or the infrastructure.

The ambulance case study makes the distinction concrete. No dispatch policy can satisfy the minimum-service standard for the two southern zones, because no depot lies within the required travel time; the remedy is therefore infrastructural rather than algorithmic. Demographic parity, by contrast, remains achievable on this instance, because the three-group, three-depot geometry does not satisfy the one-sided-interval condition of Corollary 1. The efficiency–equity tension suggested by the pre-investment frontier is itself an artifact of an underbuilt network: once a fourth depot is added, both objectives improve simultaneously. Within the existing infrastructure, every reduction in disparity was obtained by slowing the best-served group, with no group made better off in absolute terms.

The principal practical implication is that auditing the allocation algorithm is not sufficient. An algorithm-only audit cannot detect a failure that originates in the physical system, so the infrastructure must itself be tested for ethical feasibility alongside the algorithm. When the infrastructure is the binding constraint, the framework returns more than an infeasibility verdict: the same certificate that diagnoses the failure also specifies the physical investment required to resolve it.