1 Introduction

Consider the idea that there is a safety condition on knowledge (see Pritchard 2005: ch. 6; Sainsbury 1997; Sosa 1999; Williamson 2000, pp. 123–128). A rough way to capture it is to say that a person cannot know a proposition if it could easily have been false. Safety, so understood, is a modal notion. There are various ways to unpack it—perhaps the most prominent is in terms of metaphysically possible worlds (MPWs). Consider (where S is a subject, P is a proposition, and E is a proposition which belongs to the evidence she actually possesses):

SafetyM:

It is safeM for S to believe P on E if and only if, in all nearby MPWs in which E is true, P is true.Footnote 1

For a person to believe a proposition on her evidence is for her to base that belief on that evidence. It can be safeM for a person to believe a proposition on evidence she has, even if she does not in fact believe it on that or any other evidence. The principle concerns what one might call ex ante, not ex post, safetyM.

In view of SafetyM, we can restate the condition on knowledge as follows:

K ⇒ SM:

S knows P on E only if it is safeM for S to believe P on E

I do not here argue for or defend K ⇒ SM. Instead, I introduce an analogue of SafetyM, which is, I think, new to the literature. The proposal is straightforward—replace reference to MPWs with reference to epistemically possible worlds (EPWs):

SafetyE:

It is safeE for S to believe P on E if and only if, in all nearby EPWs in which E is true, P is true.Footnote 2

The main goal is to present and explain this notion of safetyE. The secondary goal is to demonstrate its significance by using the notion to formulate and explore substantive proposals about knowledge and justification.

I start by unpacking the notion of safetyE (Sect. 2) and comparing it with that of safetyM (Sect. 3). Next I propose that safetyE is a necessary condition on knowledge (Sect. 4). I then turn to justification (Sect. 5). After some preliminaries, I suggest that, unlike safetyM, safetyE is a necessary condition on justification. Having done so, I explore the possibility that safetyE is also sufficient for justification. Before concluding, I explain briefly how the accounts of justification in terms of safetyE differs from accounts which might seem superficially similar due to Pritchard (2005), Smith (2016), and Wedgwood (2002) (Sect. 6). The aim is not to assess those accounts—a task for another occasion—but only to distinguish them from my own.

If the substantive proposals I make along the way fail to convince, the paper will succeed in its primary aim of adding the notion of safetyE to the epistemologist’s tool-kit. I hope to demonstrate that, by appeal to that notion, it is possible to articulate and evaluate theoretical options that are otherwise invisible. Even if one rejects those options, it is worth having them in view. There are no doubt more ways of exploiting the notion of safetyE than I consider here.

2 SafetyE

Recall:

SafetyE:

It is safeE for S to believe P on E if and only if, in all nearby EPWs in which E is true, P is true

This raises several issues, addressing which helps in getting a purchase on the notion of safetyE. First, what is a person’s evidence? Following Williamson (2000, ch. 9), I assume that it is her knowledge:

E = K:

S knows P if and only if P is E

This is an ‘externalist’ view—according to it, a person’s evidence does not supervene upon her non-factive mental states. E = K is controversial (see McGlynn 2014, ch. 4). While I am broadly sympathetic to it, nothing in what follows hangs on that conception of evidence. I assume E = K for the sake of concreteness and for ease of presentation. If one replaces it with some other—perhaps ‘internalist’—conception of evidence, one arrives at a different standard of safetyE. One can then proceed to put safetyE, so understood, to the uses I explore below.Footnote 3

To make the same point differently, one might recognise a plurality of safetyE principles, one formulated in terms of what a person knows, another formulated in terms of what she believes, another formulated in terms of what she experiences, and so on. These principles need not be in a competition and might serve different explanatory purposes. The debate as to which of those principles is equivalent to the one formulated in terms of a person’s evidence is important, but orthogonal to the concerns of this paper.

A second question SafetyE raises is: what is an EPW? It is epistemically possible for a person that p if and only if she is not in a position to know a priori that not-p. An EPW, then, is one which a person cannot rule out a priori, or one which is a priori coherent (see Chalmers 2011, p. 63). While there is no MPW in which water is not H2O, there is an EPW, so understood, in which water is not H2O.Footnote 4

Which worlds are epistemically possible, in this sense, might vary from person to person, depending on their cognitive capacities and opportunities to exercise them. One person might be able to rule out a priori a world while another person is unable to do so. I return to this later.

Third, what is nearness relative to? When making judgements about safetyM, the MPWs are ordered according to how close they are to the world the subject occupies. When making judgements about safetyE, in contrast, EPWs are ordered according to how close they are to a person’s total evidence.Footnote 5 A person’s total evidence is not maximal. So, it does not determine an EPW. Instead, it determines an epistemic possibility (cf. Humberstone 1981; Rumfitt 2015, ch. 6).Footnote 6 So, the EPWs are ordered according to how close they are to an epistemic possibility, rather than an EPW.

Nearness, then, is not a relation that holds only between worlds; it is a relation that can also hold between a (non-maximal) possibility and a world (or maximal possibility). Of course, a possibility determines a set of worlds, but it does not follow that the nearness relation really (or only) holds between a world in that set and another world.

A provisional rationale for relativizing nearness to the epistemic possibility that a person’s evidence determines is that what safetyE is supposed to measure is not whether, relative to a world, a belief could easily be false but whether, relative to a subject’s perspective, a belief could easily be false. Unlike a world, a subject’s perspective is partial or incomplete. The real support for relativizing nearness in this way is shown by the work which the notion of safetyE, so understood, does.

Fourth, what is the measure of nearness?Footnote 7 I suggest that we understand nearness of EPWs in a way familiar from discussions of nearness of MPWs, namely, in terms of similarity.Footnote 8 EPW1 is nearer for a person than EPW2 if and only if EPW1 is more similar in relevant respects to her total evidence than EPW2. If EPW1 and EPW2 are both consistent with the epistemic possibility that the subject’s total evidence determines, EPW1 might still be nearer—more similar in relevant respects—than EPW2. By way of analogy, suppose that an author writes the opening chapter of a novel, shows it to her publisher, and secures a contract. The author then produces two finished novels, each containing a version of the original chapter. The publisher might sensibly ask which of the two novels is closer to—more similar to or in keeping with—the original chapter. Indeed, she might ask this even if the original chapter remains unchanged in both novels.

A lesson from the literature on conditionals is that one must treat the relevant notion of similarity with caution. Consider: Were Donald to press the button, there would be a nuclear holocaust.Footnote 9 Suppose that this is true. According to Lewis’s influential account (1973), the conditional is true just in case, in nearby MPWs in which Donald presses the button, there is a nuclear holocaust. But—assuming that Donald does not in fact press the button—a MPW in which there is a nuclear holocaust is dissimilar to the actual world in many respects. This might suggest that no such world is nearby, hence, that the conditional is false. In response, Lewis (1979) suggests that principles along the following lines govern the measure of similarity (in order of importance): avoid widespread law-violations; keep large regions of the world the same; avoid local law-violations. By this measure, MPWs in which Donald presses the button and there is a nuclear holocaust count as sufficiently similar to the actual world, hence, as nearby, and so the conditional comes out as true.

In what follows, I understand talk of similarity, hence, nearness, in this familiar and well-established way.Footnote 10 To adapt the example, suppose that Hilary knows that Donald pressed the button. This, together with her background evidence, does not rule out the possibility that the missiles will fail to launch, that North Korea will not retaliate, and so on. But, relative to her evidence about what is happening and how things generally work, an EPW in which there will be a nuclear holocaust is more similar in the relevant sense, hence, nearer, than an EPW in which there will be no nuclear holocaust. Hence, it is safeE for Hilary to believe that there will be a nuclear holocaust on the basis that Donald pressed the button.Footnote 11

The final question is: what counts as nearby? That is, what determines whether a world is, not only near, but near enough? A plausible, though optional, answer to that question is: context. This might be the context of the object of assessment or the context of the assessor. I leave this open.

3 Compare and contrast

No doubt there are ways in which one might try to make the notion of safetyE more precise but I hope to have said enough to give it substance and to afford a grip on it. I now explore how it is like and unlike the notion of safetyM before putting it to work in articulating substantive proposals.

First, like safetyM (cf. Williamson 2000, ch. 5), safetyE does not iterate. It might be safeE for S to believe P on E but not safeE for S to believe on E that it is safeE for S to believe P on E. Possibilities that are remote when assessing first-order beliefs might be close when assessing higher-order beliefs.

If it is safeE to believe P, P is true in the nearby EPWs.Footnote 12 So, if it is safeE to believe that it is safeE to believe P, it is safeE to believe P in the nearby EPWs. If it is safeE to believe P in the nearby EPWs, P is true in the EPWs nearby the nearby EPWs. But, if P is true in the nearby EPWs, it does not follow that P is true in the EPWs nearby the nearby EPWs. So, if it is safeE to believe P, it does not follow that it is safeE to believe that it is safeE to believe P. Compare: if the nearby shops have milk, it does not follow that the shops nearby the nearby shops have milk.

A second feature that safetyE shares with safetyM is that it obeys closure principles such as:

If it is safeE for S to believe P on E, and it is safeE for S to believe Q on E, and P and Q a priori entail R, then it is safeE for S to believe R on E.Footnote 13

If it is safeE to believe P on E, P is true in the nearby EPWs in which E is true. If it is safeE to believe Q on E, Q is true in the nearby EPWs in which E is true. So, P and Q are true in the nearby EPWs in which E is true. P and Q a priori entail R. So, R is true in the nearby EPWs in which E is true. So, it is safeE to believe R on E.

An important respect in which safetyM and safetyE differ is that, while safetyM is factive, given a factive conception of evidence, safetyE is non-factive. When it is safeM to believe a proposition, that proposition is true; but, when it is safeE to believe a proposition, that proposition need not be true.

If it is safeM for S to believe P on E, P is true in the nearby MPWs in which E is true. Given E = K, E is true in S’s world. And S’s world is trivially nearby, since it more similar to itself than any other MPW. So, if it is safeM for S to believe P on E, P is true (cf. Smith 2016, p. 106).

If it is safeE for S to believe P on E, P is true in the nearby EPWs in which E is true. Given E = K, E is true in S’s world. However, S’s world need not be nearby relative to S’s total evidence. S’s world, a maximal epistemic possibility, is consistent with the non-maximal epistemic possibility her total evidence determines, given E = K. Nonetheless, S’s world might be less similar to that non-maximal possibility in relevant respects than other EPWs. In particular, and recalling the Lewisian measures, large regions of S’s world might differ from that region of it her evidence concerns, or the principles which hold according to S’s evidence might not hold for S’s world as a whole. As a result, when it is safeE for S to believe P on E, P might not be true. As one might put it, the world from God’s total perspective might turn out to be quite different to that part of it which falls within a person’s partial perspective.

An earlier example illustrates this point. If Hilary believes that there will be a holocaust on the basis that Donald pressed the button, her belief is safeE. However, if the missiles fail to launch due to some computer malfunction, or if there is no retaliation thanks to a shift in North Korean strategy of which Hilary is ignorant, her belief is false.

4 Knowledge

So far, I have introduced the notion of safetyE and noted some of its features. I now put it to work in articulating substantive proposals. Recall K ⇒ SM. I take no stand here on whether it is true. Instead, I suggest that safetyE is a necessary condition on knowledge:

K ⇒ SE:

S knows P on E only if it is safeE for S to believe P on E

The claim that, if it is not safeE for a person to believe a proposition on evidence she possesses, she cannot know it on that evidence is non-trivial. For one thing, it has explanatory significance. To see this, consider lottery propositions. Suppose that Miyuki knows that she holds a ticket in a lottery, there are one thousand tickets, and a winning ticket has been drawn. It is highly probable on Miyuki’s evidence that the ticket lost. Moreover, it is true that her ticket lost. However, a widespread view is that Miyuki cannot know that her ticket lost and, more generally, that subjects cannot know lottery propositions.

K ⇒ SE accords with and explains this verdict. It is not safeE for Miyuki to believe on her evidence that her ticket lost. In many of the nearby EPWs in which her evidence about the lottery is true, her ticket lost. However, in some of those EPWs, her ticket won.Footnote 14

One might wonder whether, in ruling out knowledge of lottery propositions, K ⇒ SE rules out ordinary inductive knowledge. It does not. Consider a revised version of an earlier example. Hilary believes that there will be a nuclear holocaust on the basis that Donald pressed the button. Her evidence does not entail the truth of her belief but, so long as EPWs in which, say, North Korea does not retaliate are suitably remote relative to her total evidence, that is, sufficiently dissimilar to the possibility it determines, K ⇒ SE allows Hilary to know that there will be a holocaust.

One might ask whether we need K ⇒ SE to explain why subjects cannot know lottery propositions. After all, one might think, K ⇒ SM alone delivers this result.Footnote 15 However, while K ⇒ SM predicts that in many cases subjects cannot know lottery cases, it does not do so in all cases. The key point here is that whether a belief is safeM depends on matters that can lie beyond a person’s ken.

Suppose that, unbeknownst to Miyuki, the lottery was rigged. Moreover, it is no accident that the lottery was rigged; there are powerful forces at work ensuring that Miyuki could never win the lottery. In this case, it is true, not only in the actual world that Miyuki’s ticket lost, but in all nearby MPWs. So, it is consistent with K ⇒ SM that Miyuki knows that her ticket lost.Footnote 16

K ⇒ SE promises to explain why the subject lacks knowledge in this case.Footnote 17 Miyuki is unaware of the forces at work. So, the nearby EPWs in which her evidence is true—that is, the EPWs suitably similar in relevant respects to what she knows to be the case concerning the lottery—include EPWs in which her ticket won. So, it is not safeE for her to believe that her ticket lost. So, given K ⇒ SE, she cannot know this. To use the unofficial gloss, while Miyuki’s ticket could not easily have won, it remains the case that, relative to her perspective, it could easily have won.

A similar line of thought shows that certain cases offered as counterexamples to K ⇒ SM are not counterexamples to K ⇒ SE. Nobody suggested otherwise but, given the similarity between the modal constraints, one might assume that a problem for one is a problem for both. Consider:Footnote 18

On the basis that what she is drinking is tasteless, colourless, odourless, and from a bottle labelled ‘water’, Lily believes that it is water. However, unbeknownst to Lily, she stands near a person who won the lottery. Had this person lost, he would have caused a commotion during which he would have replaced the contents of the bottle with a tasteless, odourless, colourless toxin so as to vent his frustration.

Plausibly, Lily can know on her evidence that she is drinking water, but K ⇒ SM seems not to allow this. There are nearby MPWs in which Lily’s evidence is true—that is, in which what she is drinking is colourless, from a bottle labelled ‘water’, and so on—but in which she is drinking a toxin, namely, those MPWs in which her volatile neighbour lost.

I take no stand on whether this is a successful counterexample to K ⇒ SM. The important point is that it is not a counterexample to K ⇒ SE. The consideration that threatens to make Lily’s belief unsafeM—that her neighbour holds a lottery ticket and would have replaced the drink had it lost—is not part of her evidence. While there are EPWs in which in which she is drinking toxin—she cannot rule this out a priori—those EPWs are remote relative to Lily’s total evidence. So, it is safeE for Lily to believe that she is drinking water.

One might revise the case so that Lily knows that her neighbour would have replaced her drink with toxin had the ticket lost. In that case, Lily’s belief that she is drinking water remains safeE. Relative to her total evidence, which now includes knowledge about her neighbour, an EPW in which she is drinking toxin is still remote. So, K ⇒ SE allows Lily to know that she is drinking water. To use the unofficial gloss, while it is the case that, given Lily’s perspective, she could easily have not been drinking water, it is not the case that, given her perspective, she could easily not be drinking water.

5 Justification

Before exploring links between safetyE and justification, some preliminaries. First, I focus on outright justification, as opposed to degrees of justification. What it takes to be justified to some degree in believing a proposition, and what the relationship is between that status and being justified outright, are interesting questions but not my present concern.

Second, I focus on ex ante justification—what a person is justified in believing—rather than ex post justification—what a person justifiedly believes. A standard thought is that a person justifiedly believes a proposition on her evidence just in case she is justified in believing that proposition on her evidence and bases her belief on that evidence in the right kind of way. What is that way is another interesting question but not my present concern.

Third, I assume that justification is non-factive, in the sense that a person can be justified in believing a falsehood.Footnote 19 As it happens, for the purposes at hand a weaker assumption suffices, namely, that false beliefs can possess some positive epistemic status, specifically, the status they enjoy in Gettier (1963) scenarios. I give the label ‘justified’ to that status but the reader is welcome to use a different label (say, ‘reasonable’).Footnote 20

Finally, in places I consider (a crude version of) the commonplace view that a person is justified in believing a proposition on her evidence just in case that proposition is sufficiently probable on her evidence. The aim in doing so is not to engage seriously with a competitor but to bring into relief, by way of contrast, features of a view that appeals to the notion safetyE. More generally, the aim of this paper is constructive, not critical—I focus on developing positive proposals, rather than arguing against alternative views in circulation.

5.1 Necessary

As discussed, safetyM is factive. Since justification is non-factive, safetyM is not a necessary condition on justification. However, safetyE is non-factive. So, it is a candidate condition on justification:

J ⇒ SE:

S is justified in believing P on E only if it is safeE for S to believe P on E

J ⇒ SE has intuitive appeal. To use the unofficial gloss, it is plausible that a person is not justified in believing a proposition when, relative to her perspective, it could easily be false.Footnote 21 It also captures an intuitive link between justification and risk-avoidance. A person is not justified in believing a proposition unless the risk of making a mistake is, given her perspective, remote.Footnote 22

In addition, J ⇒ SE offers a resolution of the lottery paradox (from Kyburg 1961). Given her evidence, Miyuki does not know that her ticket lost. But is she justified in believing this? The assumption that she is, alongside further plausible principles, leads to an absurd conclusion. Consider:

  1. (i)

    Miyuki is justified in believing that ticket1 lost.

  2. (ii)

    If Miyuki is justified in believing that ticket1 lost, she is justified in believing that ticket2 lost, and justified in believing that ticket3 lost … and justified in believing that ticket1000 lost.

  3. (iii)

    If Miyuki is justified in believing that ticket1 lost, and justified in believing that ticket2 lost, and justified in believing that ticket3 lost, … and justified in believing that ticket1000 lost, Miyuki is justified in believing that ticket1 lost and ticket2 lost and ticket 3 lost … and ticket1000 lost.

  4. (iv)

    So, Miyuki is justified in believing that every ticket lost.

(iv) is surely false. To make matters worse, suppose that Miyuki is justified in believing that some ticket won. In that case (i) entails that Miyuki is justified in holding contradictory beliefs.

A proponent of the view that a person is justified in believing a proposition if it is sufficiently probable on her evidence is committed to (i), that is, to allowing that subjects are justified in believing lottery propositions (assuming that ‘sufficiently probable’ does not mean certain). The standard alternative, following Kyburg (1961), is to reject (iii), a closure principle.

I will not here rehearse the costs of this (see Smith 2016, pp. 79–83). Instead, I consider rejecting the starting assumption (i) that Miyuki is justified in believing that ticket1 lost. Importantly, one can deny this while allowing that Miyuki is justified in believing that ticket1probably lost, or in having a high degree of credence in the proposition that it lost.Footnote 23 As importantly, to say that Miyuki is not justified in believing that ticket1 lost is not to say that she is justified in believing that it won. That belief too is unsafeE.

J ⇒ SE explains why subjects are not justified in believing lottery propositions. As discussed above, it is not safeE for Miyuki to believe that ticket1 lost. Given J ⇒ SE, she is not justified in believing this.

The view that subjects are not justified in believing lottery propositions is independently plausible and a number of philosophers accept it (e.g. Bird 2007, pp. 100–103; Nelkin 2000; Ryan 1996; Smith 2016, ch. 3; Smithies 2012b, p. 271). The view explains why Miyuki is not justified in acting on the belief that ticket1 lost, say, by throwing it away (cf. Smithies 2012b). If a person is not justified in believing a proposition, she is not justified in acting on it.Footnote 24 In addition, the view helps to explain why subjects cannot know lottery propositions (cf. Ryan 1996, p. 138), on the assumption that knowledge entails justification:

K ⇒ J:

If S knows P on E, S is justified in believing P on E

One might worry that denying that lottery beliefs are justifiable commits one to an implausible ‘infallibilism’, according to which a person is not justified in believing a proposition when it is possible on her evidence that that proposition is false. It does not. Consider again Hilary, who, on the basis that Donald pressed the button, believes that there will be a nuclear holocaust. If she is to be justified in believing this, J ⇒ SE does not require that her total evidence rule out EPWs in which no holocaust occurs, only that those EPWs be remote.

5.2 Sufficient

If safetyE is a necessary condition on justification, that is a significant discovery. Might it also be a sufficient condition? Consider:

SE ⇒ J:

If it is safeE for S to believe P on E, S is justified in believing P on E

SE ⇒ J has intuitive appeal. To use the unofficial gloss, it is plausible that a person is justified in believing a proposition when, given her perspective, it could not easily be false. Moreover, like J ⇒ SE, SE ⇒ J offers a way of capturing a link between justification and risk-avoidance. A person is justified in believing a proposition if the risk of making a mistake in doing so is, relative to her perspective, remote.

SE ⇒ J and J ⇒ SE entail:

J = SE:

S is justified in believing P on E if and only if it is safeE for S to believe P on E

One attractive feature of this view, to return to an earlier point, is that it accords with the idea that justification is non-factive. Another is that it vindicates plausible closure principles for justification, for example:

If S is justified in believing P on E, and S is justified in believing Q on E, and P and Q a priori entail R, then S is justified in believing R on E.Footnote 25

This is a consequence of the fact, discussed above, that safetyE is closed under a priori entailment. In this respect, the view of justification as safeE belief differs from the view of justification as probable belief. Without supplementation, the latter is incompatible with closure principles of the above sort. P and Q entail P&Q, but the probabilities of P and Q will typically be higher than that of their conjunction. So, while P and Q might individually meet the probability threshold for justified belief, P&Q might fall below it.

Another welcome feature of SE = J is that, alongside K ⇒ SE, it delivers K ⇒ J, that is, the view that knowledge entails justification. K ⇒ J is a plausible principle of considerable pedigree. (That said, it is possible to accept SE = J while rejecting K ⇒ J by rejecting K ⇒ SE.)

J = SE has a further non-trivial consequence. If J = SE is true, the following principle is false:

J ⇒ JJ:

If S is justified in believing P on E, S is justified in believing on E that S is justified in believing P on E.Footnote 26

As discussed above, safetyE does not iterate. Given J = SE, it follows that justification does not iterate.

Just as one might think that whether it is safeE to believe a proposition is context-sensitive, insofar as context determines whether an EPW is near enough to count as nearby, so one might think that whether a person is justified in believing a proposition is context-sensitive (cf. Fantl and McGrath 2009). Given J = SE, justification might inherit the context-sensitivity of safetyE. (However, a proponent of J = SE is not committed to this—she might deny that nearness is a contextually determined.)

Given E = K, J = SE is an externalist view of justification, in the sense that whether a person is justified in believing a proposition does not supervene upon her non-factive mental states. Just as my aim is not adjudicate the dispute between internalists and externalists about evidence, it is not my aim to adjudicate the corresponding dispute about justification. While I assume E = K, one might accept J = SE and reject E = K. Plugging in a more internalist account of evidence delivers a more internalist account of justification that is nonetheless safetyE-based. Accepting J = SE neither settles nor pre-judges the issue over which internalists and externalists disagree.

One might worry that J = SE is circular. It accounts for justification in terms of safetyE, which is explained in terms of epistemically possible worlds, which are explained in terms of what is knowable a priori. According to K ⇒ J, if a person knows a proposition, she is justified in believing it. So, one might think, I try to explain justification by appeal to notions which are themselves understood in terms of justification.Footnote 27

First, if J = SE is circular in this way, it remains an interesting claim with non-trivial implications. Second, it is a well-worn point that entailment relations need not be explanatory relations. That a person knows a proposition might entail that she is justified in believing it, but knowledge might be explanatorily prior, not justification.Footnote 28

Necessary truths present a rather different challenge to SE ⇒ J. A familiar point is that it is trivially safeM for a person to believe necessary truths.Footnote 29 For any proposition that is necessarily true, that proposition is true in all nearby MPWs in which a person’s evidence is true for the simple reason that that proposition is true in all MPWs. In view of this, one might wonder whether that it is trivially safeE to believe necessary truths. In turn, one might wonder whether, as a result, SE ⇒ J predicts that, whatever her evidence, a person is justified in believing all necessary truths, which is implausible.

In response, I consider separately a posteriori necessary truths, for example, that water is H2O, and a priori necessary truths, for example, that 1 + 1 = 2 (cf. Kripke 1980).

SE ⇒ J does not suggest that, whatever her evidence, a person is justified in believing that water is H2O or, more generally, in believing a posteriori necessary truths. While it is true that water is H2O in all MPWs, it is not true that water is H2O in all EPWs. There are worlds which cannot be ruled out a priori in which water is not H2O. Suppose that Lily knows that water is a colourless, odourless, transparent liquid, but knows nothing about its chemical constitution. The nearby EPWs in which her evidence is true—that is, in which water is a colourless, odourless, and transparent liquid—might include EPWs in which water is H2O but also EPWs in which water is not H2O. In that case, it is not safeE for Lily to believe on her evidence that water is H2O. Hence, SE ⇒ J does not predict that Lily is justified in believing this.

In contrast, SE ⇒ J does predict that, whatever her evidence, a person is justified in believing that 1 + 1 = 2 or, more generally, in believing a priori necessary truths. Suppose that 1 + 1 = 2 is a priori for Ananya. In that case, Ananya can rule out a priori worlds in which 1 + 1 ≠ 2. Such worlds are not a priori coherent for Ananya. Hence, they are not epistemically possible for Ananya. So, whatever her evidence, it is true that 1 + 1 = 2 in all nearby EPWs in which Ananya’s evidence is true, because it is true that 1 + 1 = 2 in all EPWs. So, it is safeE for Ananya to believe on her evidence that 1 + 1 = 2. Given SE ⇒ J, whatever her evidence, Ananya is justified in believing that 1 + 1 = 2.

This is the right result. If Ananya is in a position to know a priori that 1 + 1 = 2, and assuming K ⇒ J, Ananya is justified in believing that 1 + 1 = 2. Of course, it does not follow from this that Ananya justifiedly believes that 1 + 1 = 2. The claim is that Ananya possesses ex ante justification, not ex post justification.

One might protest. Surely there can be a priori necessary truths, for example, arcane mathematical truths such as that 0.999… = 1, that a person is not justified in believing.

At this point, the earlier observation about the variability of epistemic possibility is important. Ananya might be able to rule out a priori worlds in which 1 + 1 ≠ 2, but she might be unable to rule out a priori worlds in which 0.999… ≠ 1. In that case, worlds in which 0.999… ≠ 1 are epistemically possible for her. In that case, in turn, SE ⇒ J does not predict that, whatever her evidence, Ananya is justified in believing that 0.999… ≠ 1. More generally, J = SE predicts that, if a proposition is a priori for a person, she is justified in believing it, whatever her evidence. But J = SE is neutral on which propositions are a priori for a subject. That might vary from person to person.

This is not in tension with the earlier point that justification is closed under a priori entailment. While what Ananya knows might in some sense entail that 0.999… ≠ 1, the entailment is not a priori for her (though it might be for others).

6 Similarities and differences

As noted at the outset, the modal characterisation of justification I propose here bears some resemblance to existing proposals. In this penultimate section, I mention three prominent accounts of justification that appeal to safety or kindred notions. Since, once again, the aim of this paper is constructive, not critical, I will not challenge those accounts but indicate briefly how they differ from the one I develop above.

Pritchard (2005, pp. 175–176) introduces a notion of reflective safety, which one might capture as follows:

SafetyR:

It is safeR for S to believe P if and only if, given what S can know by reflection alone, P is true in nearby MPWs

He then suggests that one might give an account of justification as safeR belief.

SafetyR differs importantly from SafetyE. First, Pritchard appeals to MPWs not EPWs. Second, in SafetyR nearness is relative to what is accessible via reflection, whereas in SafetyE nearness is relative to a person’s evidence, which need not be reflectively accessible. Indeed, I argued above that an account of justification in terms of safetyE need not satisfy a certain accessibility constraint, namely, J ⇒ JJ. Third, I suggested that safetyE, hence, justification, is a condition on knowledge. According to Pritchard, safetyR is a condition only on (what he calls) reflective knowledge. Finally, Pritchard suggests that one might appeal to SafetyR to capture an internalist notion of justification. In contrast, one can use SafetyE to deliver both internalist and externalist notions of justification, depending on the conception of evidence one plugs in.

According to Smith (2016), a person is justified in believing a proposition on her evidence if and only if, in normal worlds in which her evidence obtains, that proposition is true. Though he does not develop the point, Smith suggests in passing that normal worlds might be epistemically, as opposed to metaphysically, possible (2016, p. 115). To explain the notion of normal worlds, Smith offers an analogy with ‘simplified models of a complex phenomenon which abstract away from […] certain factors in order to expose underlying patterns and mechanisms’ (2016, pp. 113–114). A normal world, he suggests, is an ‘idealised model writ large’. It is not clear how to understand this—possible worlds are complete and fully determinate whereas idealisations are incomplete and partially indeterminate. In any event, J = SE makes no appeal to normal worlds so understood. Smith also associates normalcy with explanation: ‘normal conditions require less explanation than abnormal conditions do’ (2016, p. 39). On this account, a person is justified in believing a proposition on her evidence just in case a circumstance in which her evidence is true but the proposition is false demands more explanation than one in which her evidence is true and the proposition is true. When explanation is called for is a tricky issue which J = SE avoids, since it makes no appeal to the notion of explanation or of requiring it. This is not the place to attempt a critical assessment of Smith’s account.Footnote 30 The point is just that it involves notions which do not figure in the account of justification I advance.

According to Wedgwood (2002), a person is justified in believing a proposition via a certain method just in case she is justified in believing that it is safeM to do so, that is, just in case she is justified in believing that following that method does not lead to false beliefs in nearby MPWs. J = SE differs from Wedgwood’s proposal in several ways. First, it does not appeal to methods of belief-formation. Second, it refers to EPWs, not MPWs. Third, as discussed above, J = SE predicts that a person can be justified in believing a proposition but not justified in believing that so believing is safe in the relevant sense.Footnote 31

7 Conclusion

I introduced a notion of safety understood in terms, not of metaphysical possibilities, but of epistemic possibilities. I then put that notion to work in articulating and exploring substantive epistemological proposals. I tried to present those proposals in a plausible light. However, as mentioned at the outset, the main aim is to add a new tool to the epistemologist’s tool-kit, a tool which might be used to be argue for or, indeed, against those proposals.