Boundaries
Privacy is a precondition for personhood.
A person who is comprehensively legible is not a user with preferences. They are an input. This page describes what stands between the two — the identity firewall.
Harm is a product, not a sum.
The usual privacy framing counts records: how many were exposed, to whom, for how long. That framing is not wrong, but it is not sufficient, because the damaging unit is not the record. It is the graph — the set of relationships that only becomes visible when records are joined.
Four properties multiply. None of them alone is remarkable. Together they are decisive, and you can usually remove only one or two of them at a time.
Observability
How much of a person is visible to the system at all. Reduced by not collecting, not by promising not to look.
Linkability
How reliably activity can be tied back to one person across contexts and over time. Reduced by join-key minimization.
Persistence
How long the record survives, and whether deletion is real. Reduced by short retention and by state the person holds.
Downstream decision power
What the record is actually used for. A record that cannot be acted upon is a far smaller problem than one that can.
Identity resolution is the attack.
Given enough fragments that are each individually unremarkable, a system can reconstruct a person. The fragments might be a location, a timestamp, a writing style, a device, a co-occurrence. None is identifying. The join is.
This is why per-record privacy policy is a weak defense. The dangerous operation is rarely the collection. It is the resolution — the moment scattered signals are decided to be the same person.
Facts about people travel through other people.
Relational leakage is the case where a record harms someone who was not the subject of it. Your calendar tells a colleague’s schedule. Your notes contain a third party’s name, health, or location. Your relationship to someone is itself a fact about that someone, and it is the hardest kind of fact to withdraw once it has been shared.
A privacy model that considers only first-party subjects will miss all of it. Consent is not a thing a person can grant on behalf of everyone their life touches.
Not all knowledge about a person is the same kind of knowledge.
Every piece of data a system holds about someone should carry its epistemic class with it, because the classes deserve different amounts of authority. The marker beside each name below encodes how much authority the class is owed.
Observed
Something the system witnessed directly. Narrow by construction: the sensor that produced it should be the only reason it exists.
User-asserted
Something the person stated about themselves. The person’s word, held at their authority, and correctable only by them.
Correlated
Derived by joining two or more records. Its confidence is a function of the join, and it should inherit none of the sources’ authority.
Inferred
Produced by a model. Possibly right, never certain, and never to be treated as a fact about the person. This is the class that does the most damage when it is laundered.
Durable identity
The composite a system builds by accumulating the above. The most dangerous class precisely because it is the one nobody created deliberately.
Inference quarantine.
The move that changes the most: an inference is not a fact until the person confirms it. Until then it is held apart — not displayed as fact, not used to make decisions about them, not allowed to join anything.
This is cheap to state and genuinely hard to implement, because it requires a system to distinguish what it knows from what it has guessed, and to be willing to be wrong in public.
Local-first substitution
When the computation can happen on the person’s own hardware, it should. The record that is never created is not a privacy control; it is the absence of a problem.
Egress mediation
Outbound traffic is inspected and constrained by the person’s own rules, not only by the destination’s. Leaving should be a switch.
Context compartmentalization
Work, home, and relationship contexts do not share a memory. Most of what feels like surveillance is a missing wall.
Sensor reduction
Collect less because it is less, not because a policy document promises to.
Temporal threat model
Ask what a record means in five years, to a person who did not collect it, under a legal regime that has not been written yet.
What this looks like in the work.
None of this is a manifesto. It is the constraint set the implementation is held to. Codexify is the current expression of it: identity, memory, and retrieval held under operator authority, with provider governance treated as a first-class surface rather than an ambient detail. Its status is tracked, honestly, on its door and on the research page.