The word architecture has been doing unstated work for six weeks, so it is time to make it explicit.
A preservation architecture is not an asset. It is a stack of layers through which value has to pass, and the stack, rather than the instrument, determines what arrives.
Ten layers, at minimum, are identifiable in any real arrangement. They organize into six domains that a reader can actually hold in mind.
The domain of value contains one layer: the instrument itself.
The domain of rights contains three: the legal wrapper, whose rules and tax treatment govern everything inside it; the ownership structure, meaning what the worker holds versus what is held on the worker's behalf; and custody, meaning who can touch the value and what has to remain true for access to survive.
The domain of funding contains two: the contribution mechanism, meaning how value enters, at what cadence, with what automation, and whether the flow itself is insured against interruption; and the default architecture, meaning what happens when the worker does nothing, which for most workers is what happens.
The domain of pooling contains one: the arrangements, if any, through which risk is genuinely reduced rather than reassigned.
The domain of continuity contains two: tax treatment, compounding without ceremony for decades in either direction; and portability provisions, meaning what crosses an employer boundary and what dies at it.
And the domain of arrival contains the last: the conversion machinery, meaning how a stock finally becomes the living it was saved for.
Notice how much of that list falls inside a compensation professional's authority, and how little of it is an investment decision.
Two Kinds of Weakness
The stack matters because of how its layers fail, and the claim needs more precision than the usual weakest-link slogan, which licenses far more alarm than the evidence supports.
Call the first kind compensable weakness: a deficiency in one layer that strength elsewhere can reasonably offset. Across normal operating ranges, layers substitute. An employer match can offset a mediocre menu. Automatic enrollment can more than compensate moderate fee drag. The literature measures exactly these trades.
Call the second kind non-compensable failure: a failure region beyond which excellence elsewhere cannot restore the worker's outcome. A cash-out at a job boundary destroys terminal value regardless of how low the fees were. A missing conversion path is not offset by brilliant accumulation. A custody failure is not cured by a perfect glide path.
The design implication is not that every layer has to be excellent. It is that no layer may enter its failure region. That is a cheaper and far more achievable standard, and it is the version of this argument I would defend in a benefits committee.
The arithmetic in the middle of the stack is not opinion. A one percent annual fee compounded across a forty-year accumulation consumes on the order of a quarter of terminal wealth. The finest instrument in the world, wrapped badly, becomes mediocre.
History's clearest demonstrations run in both directions, and the second direction is the one that changed my mind about what this profession should be working on.
An excellent asset, held through high fees, forfeiting vesting and a cash-out-inviting portability design, arrives diminished no matter what the asset did.
And a merely adequate asset, carried through automatic enrollment, sensible defaults, pooled pricing and clean portability, has repeatedly outperformed the theoretically superior asset that workers never actually bought, held or kept. The participation findings that made behavioral economics famous in this field are, read this way, evidence about the contribution and default layers rather than about instruments at all.
Layers That Choose and Layers That Happen
Take the behavioral findings all the way to their conclusion and they reorganize the stack itself.
For the median worker, every layer that asks for a choice, meaning participation, contribution rate, fund selection and conversion election, resolves to whatever the default chose. Which means the stack divides into two kinds of layer.
The choice layers collapse, for most workers, into the single decision of whoever set the defaults.
The structural layers, meaning fees, tax treatment, custody, portability terms, pooling access and conversion machinery, bind everyone regardless of choice. They are not surfaces a default bypasses. They are the terrain the default path crosses.
So the median worker's effective architecture is the default trajectory through the structural layers, and both halves of that sentence deserve design attention. The trajectory, because someone chooses it on the worker's behalf. The terrain, because it operates on chooser and non-chooser alike.
This is also why I resist the question "which asset preserves best" even as a matter of framing. Asked about assets, the question has no answer, because the same asset arrives or fails depending on the stack around it. Asked about architectures, it becomes tractable. A stack can be audited layer by layer against the liability it serves, and the audit will routinely find that the binding constraint is not the instrument but a fee, a forfeiture, a default, a custody term, or a missing conversion path.
Plan administration touches these layers one at a time. Almost nothing in current practice designs the stack as a system against a named liability. The qualifier is earned by a small set of exceptions, including Dutch collective schemes managing accumulation against income targets and managed-payout designs gesturing at the same discipline, which prove the discipline is feasible rather than utopian. It remains, everywhere, the exception.
The Decision Nobody Governs Like a Decision
One consequence lands on the employer, and I want to state it as plainly as I can manage.
Under the three transformations described last month, the selection of plan defaults has become one of the most consequential compensation decisions an employer makes. It determines more of the workforce's eventual preservation outcome than most of the decisions that receive a hundred times the governance attention.
Think about how a merit budget gets decided. Committee time, market data, modeling, board visibility, a documented philosophy. Now think about how your default fund and default contribution rate were last reviewed, by whom, against what stated objective, with what written record.
The defaults literature keeps this honest in both directions, which is the part usually left out when people cite it approvingly. Automatic enrollment raised participation to near-universal levels, and it also anchored many savers at the low contribution rate and conservative fund the plan happened to choose. A default is an exercise of design authority over other people's futures, and it harms when badly set with the same efficiency that it helps when well set.
Four Conditions That Make That Authority Legitimate
A power of that size requires a legitimacy standard, and the first paper's authorship principle extends naturally: the employer is accountable for the architecture of its increment, though never for the journey's outcome.
Four conditions make the exercise of default authority legitimate rather than merely powerful.
The default has to be set against the workforce's liability, rather than against the setter's convenience or the vendor's margin.
The setting has to be documented, with workings, so the choice can be examined by anyone it governs.
The setter's conflicts have to be disclosed, because the employer's incentives are not the worker's.
And the exit has to be preserved. A default the worker can leave is choice architecture. A default the worker cannot leave is choice abolition, and the difference between them is the entire moral warrant for the enterprise.
None of those four requires an actuary, a consultant, or a budget line. They require a meeting and a memo.
Where to Start, If You Want to Start
I am aware that a framework which cited forty years of behavioral evidence and then demanded effortful, expert, voluntary adoption would fail its own test. So here is the version that survives a real benefits budget.
Employer benefits spending is dominated by a rival that has to be named honestly: health coverage, whose premiums have risen faster than general inflation across two decades, and which wins the budget contest against every other benefit nearly every year in nearly every firm. Preservation improvements compete against that renewal. Which means the improvements that will actually spread are the ones with near-zero marginal cost.
The stack analysis says the highest-value repairs are exactly those. Closing cash-out pathways, renegotiating fees, repairing badly set defaults, and fixing portability terms are changes to plan documents and vendor contracts. They are not new line items.
The sequence I would suggest: name the plan's implicit liability posture in one page, which requires no actuary. Audit the structural layers already under your control against the failure regions. Close the free ones. And only then, when the tooling exists, move to liability bands and tranche communication, demanding that tooling from providers rather than building it internally. Documented demand is how tooling comes to exist.
Next week, the last one: six tests that apply to any preservation architecture, including ones that have not been invented yet, and the reason the framework refuses to crown a winner.