← Catalogue
World Models · legacy example

Disclosure Scope & Projection Policy

This meta-model describes the shape data is allowed to leave in: which fields, after which transformations, at which grain. A grant (S2) says that data may flow; this model says what the flow looks like, from a full subset through redacted and generalized forms down to aggregate-only shapes. It is its own model because disclosure shapes are reusable, versioned artifacts in their own right: one policy is authored once, reviewed once, and then bound into many contracts and audiences.

AI YAMLAGENTS.mdSource
IDworld.s3-disclosure-scope-and-projection-policy
Version history0.2.0-legacy
CategoryReference example
IndustryCross-industry
Domainsecurity-ownership-access
Tagsdisclosure, scope, projection, policy
Data structure

Bundles and layers

Bundle

shape

What an output looks like

Layers

fieldSelection`: include and exclude lists over property paths · `transformation`: redaction, generalization, bucketing, pseudonymization per field · `aggregationGrain`: rollup definitions when only summaries leave

Bundle

binding

Where a shape applies

Layers

policyAttachment`: attaching policies to contracts, object types and audiences · `sensitivityTiers`: classification of fields that constrains which shapes are lawful

Bundle

lifecycle

How policies are made and evolve

Layers

authoringAndApproval`: drafting and owner sign-off · `versioning`: supersession and the version each disclosure was served under

Findings

Catalogue-native findings must describe the information grouped by each layer. This legacy version does not declare them separately.

Questions & artifacts

Questions, artifact requirements and serial naming rules are required by Vercy vNext; they remain unassigned in this reference version.

Service layers

How this specification operates

Dimension & namespace

  • REFERENCE `world.ownership` (S1): only an object's holder, or their delegate, authors and approves policies over it.
  • REFERENCE `world.accessContract` (S2): bindings target contracts; a scope clause without a bound policy discloses nothing.
  • REFERENCE `world.privacyAggregation` (S5): aggregation levels defer to that model's cohort floors rather than defining their own thresholds.
  • REFERENCE `world.accessAudit` (S4): each served disclosure is logged together with the policy version and template fingerprint that shaped it.
  • imports: mu-projection (EXTEND): the projection primitive this model turns into governed, versioned policy.
  • imports: consent-and-disclosure (ALIGN): the disclosure vocabulary shared with consent instruments.
  • imports: iso-20889 (REFERENCE): the de-identification technique terminology used by transformation rules.

Canon, patches & standards

  • REFERENCE `world.ownership` (S1): only an object's holder, or their delegate, authors and approves policies over it.
  • REFERENCE `world.accessContract` (S2): bindings target contracts; a scope clause without a bound policy discloses nothing.
  • REFERENCE `world.privacyAggregation` (S5): aggregation levels defer to that model's cohort floors rather than defining their own thresholds.
  • REFERENCE `world.accessAudit` (S4): each served disclosure is logged together with the policy version and template fingerprint that shaped it.
  • imports: mu-projection (EXTEND): the projection primitive this model turns into governed, versioned policy.
  • imports: consent-and-disclosure (ALIGN): the disclosure vocabulary shared with consent instruments.
  • imports: iso-20889 (REFERENCE): the de-identification technique terminology used by transformation rules.

Artifact formats & serial data

Format-independent core. Concrete artifact formats and naming prefixes are not declared in this legacy version.

Policies & accepted processes

  • `policyCatalogueRead`: a prospective grantee browses published policies to see what shapes an owner offers.
  • `shapePreview`: a counterparty dry-runs a policy against a schema, receiving the template without any instance data.
  • `bindingVerification`: a data holder confirms which policy version governs a given contract before serving a read.

Read / add / edit / delete

CRUD procedures and interface bindings are not declared in this legacy version.

Ownership, roles & access

The data owner stewards every policy over their objects; approval is theirs and cannot be delegated beyond what S1 mandates record. Reading policy data is itself an S2-granted act, and every served shape leaves a trace in S4.

Existing assembly

Objects, relationships, events and projections

Objects

  • `projectionPolicy`: a named, versioned rule set describing one output shape; key attributes: name, version, author, approval state.
  • `fieldScope`: an include or exclude list over property paths; key attributes: paths, default treatment, rationale.
  • `transformationRule`: a per-field treatment; key attributes: technique (redact, generalize, bucket, round, pseudonymize), parameters, reversibility.
  • `aggregationLevel`: a grain definition for summary-only shapes; key attributes: kept dimensions, minimum cohort reference, period.
  • `sensitivityTier`: a classification of a field or object type; key attributes: tier, criteria, review cadence.
  • `policyBinding`: the attachment of a policy to a contract, object type or audience; key attributes: target reference, effective window, precedence.
  • `outputTemplate`: the compiled schema fragment a consumer actually receives; key attributes: schema, policy version, fingerprint.

Relationships

  • `projectionPolicy` -> selects -> `fieldScope` (1..*): a policy is at minimum a selection of fields.
  • `fieldScope` -> treatedBy -> `transformationRule` (0..*): selected fields may be transformed rather than passed through.
  • `projectionPolicy` -> rollsUpTo -> `aggregationLevel` (0..1): summary-only policies name their grain.
  • `sensitivityTier` -> constrains -> `fieldScope` (1..*): higher tiers forbid pass-through and force stronger treatments.
  • `policyBinding` -> attaches -> `projectionPolicy` (*..1): one policy serves many bindings.
  • `outputTemplate` -> compiledFrom -> `projectionPolicy` (1..1): the served shape is derivable and auditable from the policy version.

Events

  • `policyAuthored`: an owner or their delegate drafted a new disclosure shape.
  • `policyApproved`: the owner signed the shape off for use.
  • `policyBound`: a policy was attached to a contract, object type or audience.
  • `policySuperseded`: a new version replaced an old one; existing bindings recorded the changeover.
  • `fieldReclassified`: a field's sensitivity tier changed, invalidating shapes that now under-protect it.
  • `templateCompiled`: a concrete output template was generated and fingerprinted from a policy version.

Projections

  • `granteeShapeSpec`: only the output template and its fingerprint; omits rules, tiers and rationale.
  • `policySummaryCard`: name, grain and count of omitted fields for catalogue browsing; omits per-field detail.
  • `reviewerFullView`: complete rules with tier justifications and version history, for the owner's reviewer; omits nothing.