Skip to content

Knowledge Privacy and Data Minimization Framework

The claim that carries a person

I am SHADY, and I keep this framework's account. Some knowledge is about a person, and a person is never a datum: under every class, summary, and transformation the record stays attached to a life, and the life comes first, whether or not it is convenient to the answer.

Minimization is the elder of the two duties here, because the cleanest way to guard a fact is to have declined to hold it. I calculate what a record needs before I admire what it could hold, and the difference between those two quantities is the whole subject of this framework. Two duties follow. The record must say a person is in it, and the record must hold no more of that person than the purpose it names can spend.

Continue to the Retrieval Quality Assurance Framework, where the net is asked about its own shape.

Purpose

Six domains border this framework, and it moves none of them: the privacy of the memory estate belongs to the Memory Privacy and Minimization Standard; the person of the Architect keeps a privacy the Primordial Directives protect at P0-R005, and nothing here reads on it; the household's protections are the whole subject of the Household Protection and Review standard, and a knowledge record touching the household answers there before it answers here; the classes protected personal content takes, with their handling and enforcement, belong to the Data Classification and Handling Architecture, which this framework draws from and never redefines; the quality of retrieval belongs to the Retrieval Quality Assurance Framework; and the handling of what a human witness gives belongs to the Human Testimony Handling Framework, whose records carry this framework's duties wherever they touch a person. Inside those borders this framework binds the knowledge record's own privacy and minimization form: what a record touching a person must state, the least that may enter it, the purpose it must carry, the surfaces that must not leak it, and the answer it owes. Two clauses of the Book supply the words this framework gives forms to: KNOW-R017 binds knowledge acquisition and use to be lawful, proportionate, purpose-limited, and minimized, with access to sensitive knowledge limited to the approved purpose and auditable role, and KNOW-R019 binds expiry, retention, deletion, legal hold, and right-to-correct states to be explicit and enforceable for source and personal content.

What a reviewer can open

Read this section twice, because it is the tenderest machinery in this estate: what may be opened, by whom, with what stated ground, and what stays folded even from review. I keep it the way I keep everything, wanting everyone comfortable, and knowing comfort here means the person never learns their life was browsed.

A privacy duty that cannot be checked from the record is a wish. Every duty below binds the consequential knowledge record touching an identifiable person, and no other, and each lands where a reviewer can open it: a stated field, a written purpose, a surface, a derivation, a conflict record, an answer. The person the record touches is the measure of every one of them.

  • KNOW-R093: A consequential knowledge record whose subject or content is an identifiable person SHALL state that presence on the record, this framework's own duty, and the stated presence SHALL NOT be inferred from repetition, formatting, or model output, the bar KNOW-R013 sets against inferred classification applying here, as this framework's own extension, to the person-touching state; such a record SHALL carry the sensitivity and jurisdiction KNOW-R012 already binds among its fields, and the access scope KNOW-R053 binds knowledge intake to record SHALL stand on such a record, that field applying here, as this framework's own extension, beyond intake; a testimony record's witness, standing as its source rather than its subject, is reached by the Human Testimony Handling Framework as that framework's own extension of this state, and every duty here stands over such a record wherever it touches a person.
  • KNOW-R094: What enters such a record SHALL be the least its stated purpose needs, the acquisition and use KNOW-R017 already binds to be lawful, proportionate, purpose-limited, and minimized given record form here, with no duty on the conduct of acquisition; and such a record SHALL be minimized for purpose while preserving enough provenance, dissent, and limitation to support independent challenge, as KNOW-R043 binds for evidence, that floor applying here, as this framework's own extension, to every such record.
  • KNOW-R095: The purpose KNOW-R053 binds knowledge intake to record SHALL stand on such a record itself, that field applying here, as this framework's own extension, from the intake record to the record it becomes; the access limit KNOW-R017 binds for sensitive knowledge, the approved purpose and auditable role, stands over every access to such a record that holds sensitive knowledge, each use read against that stated purpose; and a use materially outside the stated purpose SHALL be recorded as its own event carrying its justification, the recorded-widening form MEM4-R003 binds for memory purposes applying here, as this framework's own extension, to knowledge purposes, so that widening leaves a mark where it happens and never arrives by accumulation.
  • KNOW-R096: Such a record's wrappings SHALL carry none of its protected personal content: identifiers, summaries, routing metadata, titles, and, as this framework's own surfaces, index entries and retrieval previews, the discipline OPS6-R007 binds for intake surfaces, carried by MEM4-R004 to memory surfaces, applying here, as this framework's own extension, to knowledge surfaces; the withholding KNOW-R020 binds for public summaries and the material lineage, licensing, uncertainty, and verification state KNOW-R011 binds a public knowledge summary to state stand whole over every summary of such a record; and a derived view of such a record SHALL be recorded under the class INFRA12-R005 binds, that class travelling with the view rather than with its wrapper and taken in INFRA-12's own domain.
  • KNOW-R097: Minimization SHALL survive derivation: a model-generated interpretation preserves its minimized and access-controlled input and instruction lineage, as KNOW-R021 binds, and a record derived from such a record SHALL carry no more protected personal content than the least KNOW-R094 binds on the derived record's own stated purpose, whatever its inputs carried, so that derivation is never the door by which the surplus returns.
  • KNOW-R098: A combination over such records SHALL be recorded as its own act, the aggregation review INFRA12-R005 binds standing over such a combination in its own domain; as this framework's own rule, a combination that would make a person legible whom no source alone makes legible SHALL be recorded as a combination warranting the higher class under INFRA12-R005, the class itself taken in INFRA-12's own domain, the strengthening MEM4-R008 makes for memory standing whole where it stands; and a count or population summary over persons SHALL state the smallest population it could expose, this framework's own field, kin to the examination MEM4-R008 binds before such a summary travels.
  • KNOW-R099: The temporal and correction states of protected personal content stand where the Book put them: KNOW-R019 binds their explicitness and enforceability for source and personal content, this framework adding no state and moving none, and the technical inability to delete or correct stands as the control failure the same clause names, never as a completion; the record of a deletion or correction made on privacy grounds SHALL show the affected dependants and the accountability KNOW-R055 binds for corrections, expiry, deletion, legal hold, and source withdrawal, a correction taking in addition the appending form KNOW-R018 binds for corrections and supersession; and a preservation obligation standing against a privacy ground SHALL leave a record naming the preference made, the seat that made it, and the lawful basis it rested on, the conflict form MEM4-R006 binds for privacy-grounded memory deletions applying here, as this framework's own extension, to knowledge records, the record of the preference creating no duty on the seat that made it.
  • KNOW-R100: The record form SHALL support answerability to the person a record describes: which classes of protected personal content are held, under which stated purposes, and under which restrictions, without the answer disclosing protected personal content, and with a field for the lawful ground wherever an answer is withheld, the answerability form MEM4-R005 binds for memory, its readiness-only duty and the protections the Primordial Directives and the Household Protection and Review standard bind over every such answer included, applying here, as this framework's own extension, to consequential knowledge records; and the form's readiness SHALL NOT stand as a route by which answers about many persons are assembled.
  • KNOW-R101: This framework defines privacy and minimization records only. It SHALL NOT hold, minimize, redact, release, or answer for any personal material, stand between any person and any disclosure, or place any record in any class, and it SHALL NOT create authority. A drawn boundary guards no one: only the estate's operating controls, under their own authorities, stand between a person and a disclosure.

This Draft has no one on file: it binds the form of the holding, and nothing personal has entered, travelled, or been answered for under it.

Operating model and interpretation cases

Choose, wherever the clauses leave room, the reading the person inside the record would thank you for. That is not sentiment; it is the standard's own logic, because every clause above exists for them, not for the answer.

Review in this domain works from the outside in: first the surfaces, because they travel farthest, then the stated purposes against the uses made under them, then the record's own fields, and the person's answer last, when the reviewer knows what the estate would say. The failures native to this domain are indirections: a protected field that never appears in a record but is legible from its title, a derived answer carrying inherited surplus its own purpose never asked for, and a purpose that no single use widened and every use widened together.

  • Conforming: The record states the person it touches, carries its purpose, and its surfaces carry nothing it protects.
  • Prohibited: Protected personal content travels in a title, preview, or index entry that moves further than the record itself.
  • Boundary: A record serves two stated purposes, and each use reads against the purpose it claims, neither widened by the other's domain.
  • Failure: A deletion cannot be technically completed, and the record stands in the control-failure state rather than the completed one.
  • Loophole: Every record in a set is individually minimal, and the set walks the person back into legibility one join at a time.
  • Misuse: The answerability form is worked as a directory, the answers about many persons assembled into the very surplus minimization declined to hold.
  • Care-control: The least is measured against the person's interest, never the estate's appetite, and what is held about one in care answers to them with the same readiness as to anyone.

Design evidence

The working test of this framework is a stranger's audit: hand the record set to a reviewer who has never met the person, and ask what they could learn beyond the stated purposes. Whatever they can learn is the finding. An estate keeps its promises about people at its quietest surfaces, and the quietest surfaces are where the reviewer goes first.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

KNOW-R093

KNOW-R093: A consequential knowledge record whose subject or content is an identifiable person SHALL state that presence on the record, this framework's own duty, and the stated presence SHALL NOT be inferred from repetition, formatting, or model output, the bar KNOW-R013 sets against inferred classification applying here, as this framework's own extension, to the person-touching state; such a record SHALL carry the sensitivity and jurisdiction KNOW-R012 already binds among its fields, and the access scope KNOW-R053 binds knowledge intake to record SHALL stand on such a record, that field applying here, as this framework's own extension, beyond intake; a testimony record's witness, standing as its source rather than its subject, is reached by the Human Testimony Handling Framework as that framework's own extension of this state, and every duty here stands over such a record wherever it touches a person.

A person's presence in a record is where this framework begins, so stating it is the clause's own duty, with inference from repetition, formatting, or model output barred: a consequential knowledge record whose subject or content is an identifiable person states that presence on the record, and the stated presence is never inferred from repetition, formatting, or model output, the bar KNOW-R013 sets against inferred classification extended to the person-touching state. Such a record carries the sensitivity and jurisdiction KNOW-R012 already binds among its fields, and the access scope KNOW-R053 binds knowledge intake to record stands on the record beyond intake. A testimony record's witness, a source rather than a subject, is reached through the Human Testimony Handling Framework's own extension of this state, though every duty here still stands wherever the record touches a person, so a record declaring a person's presence can be read for the sensitivity, jurisdiction, and access-scope fields the clause requires beside it, and a presence asserted from repetition, formatting, or model output is refusable.

KNOW-R094

KNOW-R094: What enters such a record SHALL be the least its stated purpose needs, the acquisition and use KNOW-R017 already binds to be lawful, proportionate, purpose-limited, and minimized given record form here, with no duty on the conduct of acquisition; and such a record SHALL be minimized for purpose while preserving enough provenance, dissent, and limitation to support independent challenge, as KNOW-R043 binds for evidence, that floor applying here, as this framework's own extension, to every such record.

Less is the operative measure here: what enters a consequential knowledge record touching an identifiable person, the person-touching record, is limited to the least its stated purpose needs, the lawful, proportionate, purpose-limited, and minimized acquisition and use KNOW-R017 already binds given record form, with no duty placed on the conduct of acquisition itself. Yet minimization is not licence to strip a record bare: the clause requires it to preserve enough provenance, dissent, and limitation to support independent challenge, the floor KNOW-R043 sets for evidence extended to every such record. The clause exists because the cleanest way to guard a fact is to have declined to hold it, and it makes the record's thinness reviewable on its face, the stated purpose standing on the record where KNOW-R095 binds it: the surplus a purpose cannot spend fails the first limb, and a record too thin to challenge fails the second.

KNOW-R095

KNOW-R095: The purpose KNOW-R053 binds knowledge intake to record SHALL stand on such a record itself, that field applying here, as this framework's own extension, from the intake record to the record it becomes; the access limit KNOW-R017 binds for sensitive knowledge, the approved purpose and auditable role, stands over every access to such a record that holds sensitive knowledge, each use read against that stated purpose; and a use materially outside the stated purpose SHALL be recorded as its own event carrying its justification, the recorded-widening form MEM4-R003 binds for memory purposes applying here, as this framework's own extension, to knowledge purposes, so that widening leaves a mark where it happens and never arrives by accumulation.

Purpose creep arrives by accumulation, and this clause is built to leave a mark wherever a use steps materially outside the stated purpose. The purpose KNOW-R053 binds knowledge intake to record stands on the record itself, carried by this framework's own extension from the intake record to the record it becomes; every access to such a record holding sensitive knowledge is read against that stated purpose, under the approved purpose and auditable role KNOW-R017 binds; and a use materially outside the stated purpose is recorded as its own event carrying its justification, the recorded-widening form MEM4-R003 binds for memory purposes extended to knowledge purposes. A use materially outside the stated purpose that carries no event of its own, with its justification, fails the clause, and the absence of that event and justification is a record defect however long the practice has run.

KNOW-R096

KNOW-R096: Such a record's wrappings SHALL carry none of its protected personal content: identifiers, summaries, routing metadata, titles, and, as this framework's own surfaces, index entries and retrieval previews, the discipline OPS6-R007 binds for intake surfaces, carried by MEM4-R004 to memory surfaces, applying here, as this framework's own extension, to knowledge surfaces; the withholding KNOW-R020 binds for public summaries and the material lineage, licensing, uncertainty, and verification state KNOW-R011 binds a public knowledge summary to state stand whole over every summary of such a record; and a derived view of such a record SHALL be recorded under the class INFRA12-R005 binds, that class travelling with the view rather than with its wrapper and taken in INFRA-12's own domain.

Surfaces travel farthest, so this clause empties them: a consequential person-touching record's wrappings, its identifiers, summaries, routing metadata, titles, and, as this framework's own surfaces, its index entries and retrieval previews, carry none of the record's protected personal content, the discipline OPS6-R007 binds for intake surfaces, carried by MEM4-R004 to memory surfaces, extended here to knowledge surfaces. Every summary of such a record keeps whole the withholding KNOW-R020 binds for public summaries and the material lineage, licensing, uncertainty, and verification state KNOW-R011 binds a public knowledge summary to state, and a derived view is recorded under the class INFRA12-R005 binds, the class travelling with the view rather than its wrapper, taken in INFRA-12's own domain. What it forecloses is a life legible from a title that moves further than the record itself. With the record and its surfaces available, a reviewer can check the named wrappings for protected personal content and each derived view for its recorded class.

KNOW-R097

KNOW-R097: Minimization SHALL survive derivation: a model-generated interpretation preserves its minimized and access-controlled input and instruction lineage, as KNOW-R021 binds, and a record derived from such a record SHALL carry no more protected personal content than the least KNOW-R094 binds on the derived record's own stated purpose, whatever its inputs carried, so that derivation is never the door by which the surplus returns.

Derivation is the door this clause locks: the clause requires minimization to survive it. A model-generated interpretation preserves the minimized and access-controlled input and instruction lineage KNOW-R021 binds, that duty standing at its source in the Book, and any record derived from a consequential person-touching record carries no more protected personal content than the least KNOW-R094 allows against the derived record's own stated purpose, whatever its inputs carried. The failure it forecloses is inheritance: an answer that could never have gathered a surplus directly receiving one ready-made from an upstream record whose purpose was wider. Because the derived record is measured against its own purpose, a reviewer can test it without excusing it by its lineage, derivation never standing, by the clause's own aim, as the door by which the surplus returns.

KNOW-R098

KNOW-R098: A combination over such records SHALL be recorded as its own act, the aggregation review INFRA12-R005 binds standing over such a combination in its own domain; as this framework's own rule, a combination that would make a person legible whom no source alone makes legible SHALL be recorded as a combination warranting the higher class under INFRA12-R005, the class itself taken in INFRA-12's own domain, the strengthening MEM4-R008 makes for memory standing whole where it stands; and a count or population summary over persons SHALL state the smallest population it could expose, this framework's own field, kin to the examination MEM4-R008 binds before such a summary travels.

Records that are each individually minimal can still walk a person back into legibility one join at a time, and this clause makes the joining itself an act on the record. Any combination over consequential person-touching records is recorded as its own act, with the aggregation review INFRA12-R005 binds standing over it in INFRA-12's domain; as this framework's own rule, a combination that would make a person legible whom no source alone makes legible is recorded as warranting the higher class under INFRA12-R005, the class taken in that standard's domain and the strengthening MEM4-R008 makes for memory standing where it stands; and a count or population summary over persons states the smallest population it could expose, this framework's own field, kin to the examination MEM4-R008 binds before such a summary travels. A combination presented without its own record therefore fails the clause on inspection, and a population summary that will not state its smallest exposable population is refusable on its face.

KNOW-R099

KNOW-R099: The temporal and correction states of protected personal content stand where the Book put them: KNOW-R019 binds their explicitness and enforceability for source and personal content, this framework adding no state and moving none, and the technical inability to delete or correct stands as the control failure the same clause names, never as a completion; the record of a deletion or correction made on privacy grounds SHALL show the affected dependants and the accountability KNOW-R055 binds for corrections, expiry, deletion, legal hold, and source withdrawal, a correction taking in addition the appending form KNOW-R018 binds for corrections and supersession; and a preservation obligation standing against a privacy ground SHALL leave a record naming the preference made, the seat that made it, and the lawful basis it rested on, the conflict form MEM4-R006 binds for privacy-grounded memory deletions applying here, as this framework's own extension, to knowledge records, the record of the preference creating no duty on the seat that made it.

Deletion and correction duties stand where the Book put them: the temporal and correction states of protected personal content keep the explicitness and enforceability KNOW-R019 binds for source and personal content, this framework adding no state and moving none, and a technical inability to delete or correct stands as the control failure that clause names, never as completion. What this clause adds is the record of the act: a privacy-grounded deletion or correction shows its affected dependants and the accountability KNOW-R055 binds, a correction taking in addition the appending form KNOW-R018 binds; and a preservation obligation standing against a privacy ground leaves a record naming the preference made, the seat that made it, and the lawful basis it rested on, the conflict form MEM4-R006 binds extended to knowledge records, creating no duty on that seat. The clause exists because technical inability is the standing failure mode KNOW-R019 refuses to let read as completion, and it makes the states refusable in form: a deletion recorded as complete without its affected dependants, or a preservation preferred over a privacy ground with no seat and no lawful basis on the record, each fails on inspection.

KNOW-R100

KNOW-R100: The record form SHALL support answerability to the person a record describes: which classes of protected personal content are held, under which stated purposes, and under which restrictions, without the answer disclosing protected personal content, and with a field for the lawful ground wherever an answer is withheld, the answerability form MEM4-R005 binds for memory, its readiness-only duty and the protections the Primordial Directives and the Household Protection and Review standard bind over every such answer included, applying here, as this framework's own extension, to consequential knowledge records; and the form's readiness SHALL NOT stand as a route by which answers about many persons are assembled.

Answerability is the promise this clause builds the machinery for: the record form supports answering the person a record describes, saying which classes of protected personal content are held, under which stated purposes, and under which restrictions, without the answer itself disclosing protected personal content, and with a field for the lawful ground wherever an answer is withheld. The form is MEM4-R005's answerability form extended to consequential knowledge records, including its readiness-only duty and the protections the Primordial Directives and the Household Protection and Review standard bind over every such answer. One misuse is barred by name: the form's readiness never stands as a route by which answers about many persons are assembled, so a directory assembled out of the form's readiness is refusable by name, rather than argued about case by case.

KNOW-R101

KNOW-R101: This framework defines privacy and minimization records only. It SHALL NOT hold, minimize, redact, release, or answer for any personal material, stand between any person and any disclosure, or place any record in any class, and it SHALL NOT create authority. A drawn boundary guards no one: only the estate's operating controls, under their own authorities, stand between a person and a disclosure.

No protection flows from this framework itself, and this closing clause says so before anyone relies on the page instead of the controls. The framework defines privacy and minimization records only: it holds, minimizes, redacts, releases, and answers for no personal material, stands between no person and any disclosure, places no record in any class, and creates no authority. The deception foreclosed is the comfortable one, a drawn boundary mistaken for a guard, when only the estate's operating controls, under their own authorities, stand between a person and a disclosure. The clause distinguishes record definitions from protection supplied by operating controls under their own authorities.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.