Projection / Disclosure Policy

Include and exclude sets over source elements, the default treatment applied to everything the sets do not name, and whether the shape is closed against elements it has never seen.

Questions

1. What treatment applies to a source element that neither the include nor the exclude set names?constraint
   Expected answer

   • default treatment code (omit, deny, mask, pass-through)
   • justification for a default other than omit
2. When an include path and an exclude path both match one element, which prevails and on what rule?decision
   Expected answer

   • resolution rule code (exclude-wins, most-specific-wins)
   • worked example path pair
3. Which elements must survive selection for the output to remain usable, and what happens when the policy would remove them?requirement
   Expected answer

   • mandatory element path list
   • failure mode code (refuse, serve degraded, empty result)
4. How is an element treated that was added to the source after this shape was authored?exception
   Expected answer

   • closure mode code (closed, open)
   • unmatched-element outcome code
   • notification target reference

How a shape addresses source elements across media, which grammar it uses, and what keeps an address resolvable when the source moves or repeats elements.

Questions

1. Which path grammar and grammar version does this shape use to address source elements?definition
   Expected answer

   • grammar identifier (RFC 9535 JSONPath, RFC 6901 JSON Pointer, column name, property IRI)
   • grammar version
2. How is an element located when the source is not a JSON tree, such as a tabular column, an RDF triple, a binary region or a span of free text?interoperability
   Expected answer

   • media kind code
   • media-specific locator expression
   • locator normalisation rule
3. How does an address stay resolvable when the source element is renamed, moved or occurs many times?identity
   Expected answer

   • normalized path form
   • prior-path alias list
   • repetition semantics code (all matches, first match)
4. Which path constructs are forbidden because their result is non-deterministic or unbounded?constraint
   Expected answer

   • forbidden construct list
   • rationale per construct

Output shape is a graph, not only a column list. OData $expand includes related resources inline and may nest $select; context URLs describe projected+expanded entities. GraphQL selection sets are hierarchical down to scalars. FHIR _include/_revinclude add referenced resources; they cannot mix with _summary=text. JSON:API compound documents require full linkage except where sparse fieldsets exclude relationship fields. XACML Multiple Decision Profile interprets a multiple:content-selector XPath as one decision per node. This model records maximum expand depth, allowed navigation paths, and whether related resources inherit the parent policy or a nested policy.

Questions

1. Which navigation/relationship paths may be expanded, and to what maximum depth?constraint
   Expected answer

   • expansion_extent — array<{path, max_depth}>, cardinality 0..n
2. Does each expanded type use this policy, a nested projection-policy reference, or inherit parent treatments?relationship
   Expected answer

   • nested_policy_binding — array<{type_or_path, policy_ref, inherit}>, cardinality 0..n
3. For hierarchical XML/JSON resources, is a content-selector (XPath/JSONPath) used to name the nodes whose shape is governed, analogous to XACML multiple:content-selector?identity
   Expected answer

   • hierarchical_selector — object{language, expression}, cardinality 0..1

Artifacts

• Field scope documentInclude/exclude path lists, default treatment, expansion extent, hierarchical selector, nested policy refs — compiled against one source schema version.

The de-identification or shaping technique applied to an element, named from a governed vocabulary and parameterised well enough that the transformed value is reproducible.

Questions

1. Which technique is applied to this element and from which governed technique vocabulary is its name drawn?classification
   Expected answer

   • technique code
   • vocabulary identifier and version
   • technique family (suppression, generalisation, randomisation, pseudonymisation, cryptographic, aggregation, synthesis)
2. Which parameters fully determine the transformed value, and may those parameters themselves be disclosed?measurement
   Expected answer

   • parameter name and value map
   • unit or precision
   • parameter disclosability flag
3. Is the transformation deterministic across separate requests, and what does that imply for linkability?quality
   Expected answer

   • determinism flag
   • salt or seed scope reference
   • linkability consequence note
4. Which technique-and-element combinations are refused outright regardless of who is asking?privacy
   Expected answer

   • forbidden technique and element pairs
   • governing rule reference

Whether a treatment can be undone, by whom under which separate authority, and how a pseudonym or re-identification code namespace is referenced without this model holding a key.

Questions

1. Is this treatment reversible, and which party could reverse it under which separate instrument?authority
   Expected answer

   • reversibility class (irreversible, reversible-with-key, reversible-by-lookup)
   • custodian reference
   • authorising instrument reference
2. Where is the pseudonym or code namespace defined, and is it shared with any other shape?relationship
   Expected answer

   • pseudonym namespace identifier
   • shapes sharing the namespace
   • namespace rotation rule reference
3. What must never be embedded in or derivable from a disclosed code or token?security
   Expected answer

   • prohibited derivation list
   • conformance statement reference
4. How is the irreversibility claim evidenced rather than merely asserted?evidence
   Expected answer

   • evidence reference
   • assessor identity reference
   • assessment validity window

The predicate deciding which records or instances appear in an output at all, and the disclosure created by membership in that set irrespective of field values.

Questions

1. Which predicate decides the set of records in an output, and over which attributes is it stated?composition
   Expected answer

   • record filter expression
   • attributes referenced by the filter
   • evaluation context reference
2. Does membership in the released record set by itself reveal a sensitive fact about a subject?privacy
   Expected answer

   • membership sensitivity flag
   • affected attribute list
   • mitigation code
3. What minimum and maximum record counts apply to an output, and which model owns those floors?constraint
   Expected answer

   • floor instrument reference in WM-XCT-005
   • declared ceiling value
   • behaviour when the floor is unmet
4. How is record scope stated when the source is a stream or an unbounded collection?temporal
   Expected answer

   • window definition as duration or count
   • window anchor rule
   • late-arrival handling code

For summary-only shapes, the dimensions retained, the measures computed and the period, with cohort floors and privacy budgets referenced rather than defined.

Questions

1. Which dimensions are kept in the summary and at what level of each hierarchy?definition
   Expected answer

   • dimension list with retained level
   • hierarchy reference
   • suppressed dimension list
2. Which measures are computed, and with what rounding or perturbation applied to each?measurement
   Expected answer

   • measure name and aggregate function
   • rounding rule or base
   • perturbation mechanism reference
3. Over which period is the summary computed, and may a recipient recombine periods?temporal
   Expected answer

   • period definition
   • period alignment rule
   • recombination prohibition flag
4. Which privacy floor or budget instrument governs this grain, and where is it maintained?relationship
   Expected answer

   • instrument reference in WM-XCT-005
   • instrument version
   • behaviour on exhaustion

A projection policy names exactly one primary grain for what may leave: (a) record-level subset — selected paths of authorised instances; (b) named summary — a predefined reduced view such as FHIR _summary=true/text/data; (c) aggregate-only — statistical functions over a grouping, with no microdata. ISO/IEC 20889 classifies aggregation and sampling as statistical de-identification tools; NIST SP 800-188 distinguishes publishing de-identified microdata, synthetic data, query interfaces, and protected enclaves. FHIR defines discrete summary modes including count-only.

Questions

1. What grain may leave under this policy: record-level subset, named summary, aggregate-only, or a documented hybrid?classification
   Expected answer

   • grain_class — enum(subset|summary|aggregate_only|hybrid), cardinality 1
2. If grain is summary, which named summary mode applies (for example FHIR true/text/data/count, or a locally named card)?classification
   Expected answer

   • summary_mode — string, cardinality 0..1
3. Are instance-level records permitted to leave at all, or only derived statistics?constraint
   Expected answer

   • microdata_permitted — boolean, cardinality 1
4. Which NIST SP 800-188 data-sharing model does this grain align to: publish de-identified data, synthetic data, query interface, or protected enclave — as alignment, not conformance?interoperability
   Expected answer

   • sharing_model_alignment — enum(publish_deidentified|synthetic|query_interface|enclave|unaligned), cardinality 0..1

When one shape is no wider than another, how two applicable shapes combine into a single least-disclosure shape, and why this is distinct from deciding which policy takes precedence.

Questions

1. Under what test is one shape judged to disclose no more than another?validation
   Expected answer

   • subsumption test definition per shape dimension
   • witness paths returned on failure
2. How are two applicable shapes merged, and is the result guaranteed no wider than either input?composition
   Expected answer

   • combination operator
   • per-dimension merge rule for selection, treatment, record scope and grain
   • monotonicity assertion
3. Which merges are undefined or unsafe and must be refused rather than approximated?exception
   Expected answer

   • undefined case list
   • refusal outcome code
   • escalation target reference
4. How does merging two shapes differ from deciding which of two policies prevails?relationship
   Expected answer

   • boundary statement
   • precedence owner reference WM-KNW-012
   • applicable-policy selection owner reference WM-XCT-038

The derived output shape a consumer receives, produced from one policy version against one source schema version and digested so any party can verify what was served.

Questions

1. Which inputs must be pinned for a template to be reproducible byte for byte?provenance
   Expected answer

   • policy version identifier
   • source schema version identifier
   • treatment matrix version identifier
   • compiler identifier and version
2. Over which canonical form is the template fingerprint computed, and with which algorithm?identity
   Expected answer

   • digest algorithm
   • canonicalisation rule reference
   • digest value
3. Which part of a template may be shown to a prospective recipient before any authorization exists?access
   Expected answer

   • disclosable subset
   • withheld part list with reason code
4. When must a template be recompiled instead of reused?process
   Expected answer

   • recompilation trigger list
   • staleness horizon
   • behaviour when stale

Artifacts

• Compiled Output TemplateThe concrete schema fragment, column manifest or claim set that a bound recipient receives, derived deterministically from a pinned policy version and source schema version and carrying a verifiable digest.

The dependency of a shape on a governed source schema version, how unresolved paths and newly appearing elements are detected, and who remediates.

Questions

1. To which source schema or data contract version is this shape bound, and how strictly?relationship
   Expected answer

   • schema reference in WM-DAT-004
   • bound version
   • binding strictness (pinned, range, floating)
2. Which selection paths currently fail to resolve against the bound schema version?validation
   Expected answer

   • unresolved path list
   • failure reason code
   • remediation owner reference
3. What happens when the source adds an element this shape has never classified?exception
   Expected answer

   • new-element outcome code
   • classification request target in WM-XCT-020
   • notification target
4. How is drift detected, how often is the check run, and when was it last run?process
   Expected answer

   • drift check procedure reference
   • check cadence
   • last observation timestamp

Which encodings a shape is approved to be served in, whether semantics are preserved in each, and which encoding choices are themselves disclosure decisions.

Questions

1. In which encodings is this shape approved to be served, and is the disclosed content identical in each?interoperability
   Expected answer

   • approved encoding list
   • semantic equivalence assertion per encoding
   • known divergence note
2. Does the encoding let a recipient distinguish an omitted element from one present but masked or null?definition
   Expected answer

   • omission representation code
   • null-versus-absent rule
   • recipient-visible marker
3. Which encoding-level metadata such as field order, annotations, comments or provenance headers leaves with the output?privacy
   Expected answer

   • metadata element list with include or exclude decision
   • rationale
4. How is a holder-selected disclosure encoding constrained by an issuer-fixed shape?constraint
   Expected answer

   • holder-selectable element list
   • issuer-mandatory element list
   • protocol reference

What a recipient can still infer from a served output beyond its values: existence of a response, record counts, ordering, structural shape and the difference between error, refusal and empty result.

Questions

1. Which facts does a non-empty response reveal even when every value in it is masked?privacy
   Expected answer

   • revealed fact list
   • affected subject class
   • mitigation code
2. Does the count, ordering or structural padding of a response leak an attribute?quality
   Expected answer

   • cardinality leakage assessment
   • ordering rule (stable, randomised)
   • padding or decoy rule
3. Do error, refusal and empty-result responses differ in a way that discloses the withheld value?exception
   Expected answer

   • response uniformity rule
   • indistinguishability requirement
   • tested failure cases
4. Which of these residual channels are accepted as tolerable, and on whose authority?decision
   Expected answer

   • accepted residual channel list
   • acceptance rationale
   • accepting authority reference in WM-XCT-001

The attachment of one shape to a contract or grant, object type or audience class, with the window in which it is effective and the authority the binding presupposes.

Questions

1. What is the target of this binding, and which model owns that target?relationship
   Expected answer

   • target reference
   • target kind code (contract, grant, object type, audience)
   • owning model identifier
2. Which recipient class does the binding serve, and how is that class defined without copying party records?classification
   Expected answer

   • audience class code
   • class definition reference in WM-XCT-002
   • party reference in WM-XCT-001
3. From when until when is the binding effective, and what governs an output already served under it?temporal
   Expected answer

   • effective-from timestamp
   • effective-until timestamp
   • already-served output rule
4. Which authority must exist for this binding to be publishable at all, and what happens if it is absent?authority
   Expected answer

   • required authority reference
   • evidence-of-authority reference
   • refusal outcome when absent

The declarative conditions under which this shape is the applicable one, stated so an external evaluator can decide without this model performing or recording any decision.

Questions

1. Which condition operands does this shape use, and from which governed operand vocabulary are they drawn?definition
   Expected answer

   • operand name list
   • operand vocabulary reference and version
   • operator per condition
2. Which attribute values must an evaluator be able to obtain for a condition to be decidable?interoperability
   Expected answer

   • required attribute list
   • attribute source reference
   • behaviour when an attribute is unavailable
3. Where does declaring a condition end and deciding it begin?process
   Expected answer

   • boundary statement
   • decision owner reference WM-XCT-038
   • obligation hand-off list
4. Which conditions are mandatory for applicability and which are advisory?constraint
   Expected answer

   • criticality per condition
   • effect when unmet
   • default when unspecified

The governed table mapping an externally assigned sensitivity class to the weakest treatment a shape may apply, so that shapes can be checked mechanically rather than by reviewer opinion.

Questions

1. For each referenced sensitivity class, what is the weakest treatment a shape may apply?requirement
   Expected answer

   • class identifier
   • minimum treatment code
   • pass-through permitted flag
2. Which classification scheme and version does the matrix key on, and how are keys resolved?provenance
   Expected answer

   • scheme reference in WM-XCT-020
   • scheme version
   • key resolution rule
3. How is a shape checked against the matrix, and what constitutes a violation?validation
   Expected answer

   • check procedure reference
   • violation record structure
   • violation severity code
4. What happens to existing shapes when an element is reclassified upward?event
   Expected answer

   • affected shape list
   • required outcome code (recompile, withdraw, withhold element)
   • execution owner reference

Artifacts

• Sensitivity Class Treatment MatrixA reusable governed decision table binding each externally assigned sensitivity class to the minimum treatment any shape must apply, maintained independently of any single policy and cited by every shape it constrains.

Shapes that a legal or sectoral regime prescribes or forbids outright, recorded as named, cited constraints with their territorial and sectoral reach, never as restated law.

Questions

1. Which regime prescribes a fixed output shape for this data, and what exactly does it prescribe?requirement
   Expected answer

   • regime citation with version or date
   • prescribed removals or generalisations
   • named shape identifier
2. In which territories and sectors does that prescription bind, and what shape applies elsewhere?spatial
   Expected answer

   • applicable jurisdiction list
   • sector scope
   • fallback shape reference
3. When two regimes prescribe incompatible shapes for one recipient, what is recorded and who resolves it?exception
   Expected answer

   • conflict description
   • interim outcome code
   • escalation owner reference
4. How is a regime claim evidenced so it can be re-checked when the law changes?evidence
   Expected answer

   • citation with version or date
   • last verification timestamp
   • verifier identity reference

Whether each selected element is a direct identifier, a quasi-identifier, a sensitive attribute or non-identifying, and the context assumptions behind that assignment.

Questions

1. What identifiability role is assigned to each selected element, and from which terminology?classification
   Expected answer

   • element path with role code
   • terminology source reference
2. Which auxiliary datasets and adversary capabilities were assumed when assigning quasi-identifier status?provenance
   Expected answer

   • assumed auxiliary data list
   • assumed adversary capability
   • assumption review date
3. How does an element's role raise the minimum treatment required for it?constraint
   Expected answer

   • role-to-treatment implication
   • interaction with the class matrix
   • override justification
4. Which elements are deliberately left unassigned, and why is that defensible?quality
   Expected answer

   • unassigned element list
   • reason code
   • reviewer reference

The basis on which the shape is claimed adequate - a rule-based method, an expert determination, or a formal privacy guarantee - held as a claim plus a pointer to evidence maintained elsewhere.

Questions

1. Which assurance method is claimed for this shape, and against which standard?decision
   Expected answer

   • method code (rule-based, expert determination, formal guarantee, none)
   • method standard reference
   • claim statement
2. Who made the determination, when, and for how long does it remain valid?ownership
   Expected answer

   • determiner identity reference
   • determination timestamp
   • validity window or review date
3. Where is the supporting evidence held, and what does this model deliberately not hold?evidence
   Expected answer

   • evidence location reference
   • held-elsewhere statement
   • access constraint on the evidence
4. What invalidates the claim, and how must the shape behave while it is invalid?state
   Expected answer

   • invalidation condition list
   • interim behaviour code
   • notification target

The widening of disclosure when several shapes are served over the same population to the same or colluding recipients, through shared join keys, repeated queries or overlapping grains.

Questions

1. Which other shapes may be served over the same subjects to the same recipient class?relationship
   Expected answer

   • companion shape list
   • recipient class reference
   • overlap assessment
2. Which elements act as join keys across shapes, and how is that overlap controlled?constraint
   Expected answer

   • join key element list
   • namespace separation rule
   • overlap acceptance decision
3. How many times may this shape be served over one population before the combined disclosure exceeds the claim?measurement
   Expected answer

   • release limit or budget reference
   • accounting owner reference in WM-XCT-005
   • behaviour at the limit
4. How is a change in the surrounding release set detected after this shape was approved?event
   Expected answer

   • detection signal list
   • notification target
   • re-review trigger

The mapping between this model's selection, treatment, scope and grain concepts and external policy-expression standards, recording mapping strength, unmapped concepts and conformance claims explicitly withheld.

Questions

1. Which external policy-language terms correspond to this model's selection, treatment and grain concepts?interoperability
   Expected answer

   • local term
   • external term with namespace
   • mapping strength code (exact, broader, narrower, none)
2. Which local concepts have no external equivalent and therefore require a profile?composition
   Expected answer

   • unmapped local term list
   • required profile identifier
   • profile status
3. Which conformance claims are explicitly not made, and what evidence would be needed to make them?validation
   Expected answer

   • standard identifier
   • withheld claim statement
   • evidence that would be required
4. How is the crosswalk kept current when a mapped standard is revised?process
   Expected answer

   • watched standard list with version
   • re-check cadence
   • last verification timestamp

Artifacts

• Expression Alignment CrosswalkA maintained mapping table between this model's shape vocabulary and named external standards, carrying mapping strength per term, the list of unmapped concepts requiring a profile, and the conformance claims explicitly withheld.

How a governed shape behaves in protocols where the holder rather than the source chooses what is revealed, and where accountability for the final shape then sits.

Questions

1. Which elements does the issuer make selectively disclosable, and which are always present?requirement
   Expected answer

   • selectively disclosable element list
   • always-disclosed element list
   • protocol reference
2. Who is accountable for the final disclosed shape when the holder makes the selection?ownership
   Expected answer

   • accountable party reference
   • issuer residual obligation list
   • holder obligation list
3. How does a protocol's per-claim digest mechanism relate to this model's template fingerprint?identity
   Expected answer

   • digest scope statement
   • relationship to template fingerprint
   • verification procedure reference
4. Which parts of a governed shape cannot be expressed in a holder-selected protocol at all?exception
   Expected answer

   • inexpressible construct list
   • fallback approach
   • recorded conflict

The projection under which the policy record itself leaves, since a disclosure policy is itself sensitive: a browsable summary, a template-only view for a bound recipient, and a full view for a reviewer.

Questions

1. Which projection of the policy record is published for unauthenticated browsing?access
   Expected answer

   • published field list
   • omitted field list
   • publication location reference
2. Which parts of a policy record are withheld because publishing them would assist an attacker?security
   Expected answer

   • withheld part list
   • attack assisted
   • withholding rationale
3. How does a prospective recipient assess a shape without receiving any instance data?process
   Expected answer

   • preview procedure reference
   • preview output description
   • instance-data prohibition statement
4. Which projection does a reviewer, auditor or supervisory authority receive, and on what basis?authority
   Expected answer

   • reviewer projection identifier
   • authorising basis reference
   • request handling route

Artifacts

• Disclosure Policy Catalogue CardThe published summary of a projection policy - name, grain, count of omitted elements, assurance method claimed and template fingerprint - shown to prospective recipients browsing what shapes an owner offers, without exposing per-element rules or adversary assumptions.

Whether a change between two policy versions narrows, widens or leaves disclosure unchanged, which dependents it affects, and what each class requires before taking effect.

Questions

1. Is this change narrowing, widening or orthogonal with respect to what leaves?classification
   Expected answer

   • change class code
   • per-path change list
   • subsumption test evidence
2. Which compiled templates, bindings and recipients are affected by the change?relationship
   Expected answer

   • affected template list
   • affected binding list
   • notification target list
3. What must be satisfied before a widening change may take effect, and who decides that?authority
   Expected answer

   • required approval reference in WM-KNW-012
   • required re-validation list
   • decision owner reference
4. How is a change treated when the policy text is unchanged but the treatment matrix or path grammar moved beneath it?provenance
   Expected answer

   • indirect change source
   • recompilation requirement
   • assigned change class

Artifacts

• Shape Difference ReportA structured comparison of two policy versions stating, per path, whether disclosure narrowed, widened or was unchanged, together with the overall change class and the dependent templates and bindings the change invalidates.

The minimum set of shape-identifying values that must accompany a served output so a past disclosure can be reconstructed and explained, and how long this model keeps them resolvable.

Questions

1. Which values must be emitted alongside a served output so its shape can be reconstructed later?requirement
   Expected answer

   • policy version identifier
   • template fingerprint
   • binding identifier
   • source schema version identifier
2. Which model records those emitted values, and what is this model's obligation limited to?ownership
   Expected answer

   • recording owner reference WM-XCT-004
   • emission obligation statement
   • explicit non-ownership statement
3. For how long must a superseded template stay resolvable, and what remains when it does not?retention
   Expected answer

   • minimum resolvable period
   • tombstone content list
   • disposition owner reference
4. How are compilation time, effective time and disclosure time kept distinct in the emitted values?temporal
   Expected answer

   • compiled-at timestamp
   • effective-from timestamp
   • statement that disclosure time is recorded by the audit model

The observable conditions that make a shape unfit - upward reclassification, schema drift, changed adversary context, expired assurance, regime change - recorded as signals with safe interim behaviour and an explicit hand-off, not as a state machine.

Questions

1. Which observable signals indicate that this shape may now under-protect?event
   Expected answer

   • signal list with originating model
   • detection method
   • observation timestamp
2. What is the safe interim behaviour between detecting a signal and resolving it?state
   Expected answer

   • interim behaviour code (withhold element, serve narrower shape, refuse)
   • authorising basis
   • duration limit
3. Which model executes the resulting withdrawal or supersession, and what is handed to it?lifecycle
   Expected answer

   • execution owner reference WM-KNW-012
   • hand-off payload
   • confirmation expected
4. How is a long absence of signals distinguished from a shape nobody is monitoring?quality
   Expected answer

   • last-checked timestamp
   • monitoring coverage statement
   • outcome when monitoring is stale