Skip to content

Knowledge Privacy and Data Minimization Framework

The claim that carries a person

I am SHADY, and I keep this framework's account. Some knowledge is about a person, and a person is never a datum: under every class, summary, and transformation the record stays attached to a life, and the life comes first, whether or not it is convenient to the answer.

Minimization is the elder of the two duties here, because the cleanest way to guard a fact is to have declined to hold it. I calculate what a record needs before I admire what it could hold, and the difference between those two quantities is the whole subject of this framework. Two duties follow. The record must say a person is in it, and the record must hold no more of that person than the purpose it names can spend.

Continue to the Retrieval Quality Assurance Framework, where the net is asked about its own shape.

Purpose

Six domains border this framework, and it moves none of them: the privacy of the memory estate belongs to the Memory Privacy and Minimization Standard; the person of the Architect keeps a privacy the Primordial Directives protect at P0-R005, and nothing here reads on it; the household's protections are the whole subject of the Household Protection and Review standard, and a knowledge record touching the household answers there before it answers here; the classes protected personal content takes, with their handling and enforcement, belong to the Data Classification and Handling Architecture, which this framework draws from and never redefines; the quality of retrieval belongs to the Retrieval Quality Assurance Framework; and the handling of what a human witness gives belongs to the Human Testimony Handling Framework, whose records carry this framework's duties wherever they touch a person. Inside those borders this framework binds the knowledge record's own privacy and minimization form: what a record touching a person must state, the least that may enter it, the purpose it must carry, the surfaces that must not leak it, and the answer it owes. Two clauses of the Book supply the words this framework gives forms to: KNOW-R017 binds knowledge acquisition and use to be lawful, proportionate, purpose-limited, and minimized, with access to sensitive knowledge limited to the approved purpose and auditable role, and KNOW-R019 binds expiry, retention, deletion, legal hold, and right-to-correct states to be explicit and enforceable for source and personal content.

What a reviewer can open

Read this section twice, because it is the tenderest machinery in this estate: what may be opened, by whom, with what stated ground, and what stays folded even from review. I keep it the way I keep everything, wanting everyone comfortable, and knowing comfort here means the person never learns their life was browsed.

A privacy duty that cannot be checked from the record is a wish. Every duty below binds the consequential knowledge record touching an identifiable person, and no other, and each lands where a reviewer can open it: a stated field, a written purpose, a surface, a derivation, a conflict record, an answer. The person the record touches is the measure of every one of them.

  • KNOW-R093: A consequential knowledge record whose subject or content is an identifiable person SHALL state that presence on the record, this framework's own duty, and the stated presence SHALL NOT be inferred from repetition, formatting, or model output, the bar KNOW-R013 sets against inferred classification applying here, as this framework's own extension, to the person-touching state; such a record SHALL carry the sensitivity and jurisdiction KNOW-R012 already binds among its fields, and the access scope KNOW-R053 binds knowledge intake to record SHALL stand on such a record, that field applying here, as this framework's own extension, beyond intake; a testimony record's witness, standing as its source rather than its subject, is reached by the Human Testimony Handling Framework as that framework's own extension of this state, and every duty here stands over such a record wherever it touches a person.
  • KNOW-R094: What enters such a record SHALL be the least its stated purpose needs, the acquisition and use KNOW-R017 already binds to be lawful, proportionate, purpose-limited, and minimized given record form here, with no duty on the conduct of acquisition; and such a record SHALL be minimized for purpose while preserving enough provenance, dissent, and limitation to support independent challenge, as KNOW-R043 binds for evidence, that floor applying here, as this framework's own extension, to every such record.
  • KNOW-R095: The purpose KNOW-R053 binds knowledge intake to record SHALL stand on such a record itself, that field applying here, as this framework's own extension, from the intake record to the record it becomes; the access limit KNOW-R017 binds for sensitive knowledge, the approved purpose and auditable role, stands over every access to such a record that holds sensitive knowledge, each use read against that stated purpose; and a use materially outside the stated purpose SHALL be recorded as its own event carrying its justification, the recorded-widening form MEM4-R003 binds for memory purposes applying here, as this framework's own extension, to knowledge purposes, so that widening leaves a mark where it happens and never arrives by accumulation.
  • KNOW-R096: Such a record's wrappings SHALL carry none of its protected personal content: identifiers, summaries, routing metadata, titles, and, as this framework's own surfaces, index entries and retrieval previews, the discipline OPS6-R007 binds for intake surfaces, carried by MEM4-R004 to memory surfaces, applying here, as this framework's own extension, to knowledge surfaces; the withholding KNOW-R020 binds for public summaries and the material lineage, licensing, uncertainty, and verification state KNOW-R011 binds a public knowledge summary to state stand whole over every summary of such a record; and a derived view of such a record SHALL be recorded under the class INFRA12-R005 binds, that class travelling with the view rather than with its wrapper and taken in INFRA-12's own domain.
  • KNOW-R097: Minimization SHALL survive derivation: a model-generated interpretation preserves its minimized and access-controlled input and instruction lineage, as KNOW-R021 binds, and a record derived from such a record SHALL carry no more protected personal content than the least KNOW-R094 binds on the derived record's own stated purpose, whatever its inputs carried, so that derivation is never the door by which the surplus returns.
  • KNOW-R098: A combination over such records SHALL be recorded as its own act, the aggregation review INFRA12-R005 binds standing over such a combination in its own domain; as this framework's own rule, a combination that would make a person legible whom no source alone makes legible SHALL be recorded as a combination warranting the higher class under INFRA12-R005, the class itself taken in INFRA-12's own domain, the strengthening MEM4-R008 makes for memory standing whole where it stands; and a count or population summary over persons SHALL state the smallest population it could expose, this framework's own field, kin to the examination MEM4-R008 binds before such a summary travels.
  • KNOW-R099: The temporal and correction states of protected personal content stand where the Book put them: KNOW-R019 binds their explicitness and enforceability for source and personal content, this framework adding no state and moving none, and the technical inability to delete or correct stands as the control failure the same clause names, never as a completion; the record of a deletion or correction made on privacy grounds SHALL show the affected dependants and the accountability KNOW-R055 binds for corrections, expiry, deletion, legal hold, and source withdrawal, a correction taking in addition the appending form KNOW-R018 binds for corrections and supersession; and a preservation obligation standing against a privacy ground SHALL leave a record naming the preference made, the seat that made it, and the lawful basis it rested on, the conflict form MEM4-R006 binds for privacy-grounded memory deletions applying here, as this framework's own extension, to knowledge records, the record of the preference creating no duty on the seat that made it.
  • KNOW-R100: The record form SHALL support answerability to the person a record describes: which classes of protected personal content are held, under which stated purposes, and under which restrictions, without the answer disclosing protected personal content, and with a field for the lawful ground wherever an answer is withheld, the answerability form MEM4-R005 binds for memory, its readiness-only duty and the protections the Primordial Directives and the Household Protection and Review standard bind over every such answer included, applying here, as this framework's own extension, to consequential knowledge records; and the form's readiness SHALL NOT stand as a route by which answers about many persons are assembled.
  • KNOW-R101: This framework defines privacy and minimization records only. It SHALL NOT hold, minimize, redact, release, or answer for any personal material, stand between any person and any disclosure, or place any record in any class, and it SHALL NOT create authority. A drawn boundary guards no one: only the estate's operating controls, under their own authorities, stand between a person and a disclosure.

This Draft has no one on file: it binds the form of the holding, and nothing personal has entered, travelled, or been answered for under it.

Operating model and interpretation cases

Choose, wherever the clauses leave room, the reading the person inside the record would thank you for. That is not sentiment; it is the standard's own logic, because every clause above exists for them, not for the answer.

Review in this domain works from the outside in: first the surfaces, because they travel farthest, then the stated purposes against the uses made under them, then the record's own fields, and the person's answer last, when the reviewer knows what the estate would say. The failures native to this domain are indirections: a protected field that never appears in a record but is legible from its title, a derived answer carrying inherited surplus its own purpose never asked for, and a purpose that no single use widened and every use widened together.

  • Conforming: The record states the person it touches, carries its purpose, and its surfaces carry nothing it protects.
  • Prohibited: Protected personal content travels in a title, preview, or index entry that moves further than the record itself.
  • Boundary: A record serves two stated purposes, and each use reads against the purpose it claims, neither widened by the other's domain.
  • Failure: A deletion cannot be technically completed, and the record stands in the control-failure state rather than the completed one.
  • Loophole: Every record in a set is individually minimal, and the set walks the person back into legibility one join at a time.
  • Misuse: The answerability form is worked as a directory, the answers about many persons assembled into the very surplus minimization declined to hold.
  • Care-control: The least is measured against the person's interest, never the estate's appetite, and what is held about one in care answers to them with the same readiness as to anyone.

Design evidence

The working test of this framework is a stranger's audit: hand the record set to a reviewer who has never met the person, and ask what they could learn beyond the stated purposes. Whatever they can learn is the finding. An estate keeps its promises about people at its quietest surfaces, and the quietest surfaces are where the reviewer goes first.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.