FDE BenchmarkPublic document reader
Available in sourcev0.1 · live public draft · official release pending

Canonical source view. This renders the bundled repository document as readable HTML. Source metadata remains in the repository, and relative document links remain inside this reader.

Aggregate-register privacy contract

Status: Proposed / Not authorized
Data in this package: Synthetic only
Public register: Not operational

1. Product boundary

The proposed register is a research publication surface for aggregate participation and evidence-process coverage. It is not a directory of people, a talent marketplace, a national comparison, or a capability league table.

A future aggregate may answer narrowly framed questions such as:

  • how many consented participants fall within a broad metro-level count band;
  • what share have a current corroboration event under a named protocol; or
  • what proportion of an aggregate is withheld, refresh-required, or awaiting review.

It may not publish a capability mean, aptitude by geography, rank, percentile, named profile, employer list, compensation proxy, or value-per-person measure.

2. Geographic constraints

  1. Geography MUST NOT be an integrity, access, progression, or scoring input.
  2. Public geographic units are limited to metro_area; the only permitted non-geographic view is global.
  3. Country, nationality, national origin, IP-derived location, and precise location fields are absent from the proposal schema.
  4. Metro assignment, if ever authorized, requires express publication consent and a coarse, documented method that is not inferred from a live network address.
  5. Every metro view must display its participation definition, time window, broad sample-size band, and sampling-bias notice in the chart itself.
  6. Metro cells must never be sorted into a rank or described as high- or low-performing.

3. Minimum privacy policy

The proposed public contract fixes conservative floors that may only become stricter after privacy review:

Control Proposal value
Minimum distinct consented subjects per published cell 30; a signed policy may be stricter
Minimum distinct organizations represented 5; a signed policy may be stricter
Maximum contribution from one organization 20%; a signed policy may be stricter
Minimum subjects in each published share numerator 30
Minimum subjects in each published share complement 30
Minimum organizations in each share numerator and complement 5
Maximum one-organization share in each numerator and complement 20%
Smallest public subject-count band 30–49
Query model Immutable, precomputed snapshot only
Arbitrary cross-filtering Prohibited
Named-person drill-down Prohibited
Public exact subject count Prohibited; broad bands only

The threshold is a disclosure-control proposal, not a statistical sufficiency claim. A cell with 30 people can still be unrepresentative and must carry the sampling-bias notice.

4. Suppression algorithm

Before a snapshot is approved, a protected pre-publication service must:

  1. bind the purpose, consent grant, population definition, snapshot window, and transformation version;
  2. deduplicate subjects and lineage groups;
  3. exclude withdrawn, expired-consent, disputed, quarantined, or ineligible records;
  4. test the active, digest-bound subject and organization floors rather than assuming the proposal defaults;
  5. validate that organization counts, largest-organization counts, and rounded dominance shares are arithmetically consistent;
  6. for every share measure, test the numerator and its complement independently against subject, organization-diversity, and dominance limits;
  7. run complementary suppression so totals and neighboring cells cannot reveal a suppressed cell;
  8. compare the candidate snapshot with every retained prior release for differencing and overlap attacks;
  9. coarsen eligible shares into approved percentage bands and suppress any share outside the public band vocabulary;
  10. coarsen or suppress unstable cells;
  11. produce an attestation digest without exporting underlying person-level data; and
  12. require privacy and publication approval for the complete immutable snapshot.

A failed test produces suppressed, never a zero. Suppressed cells expose no metric value, exact denominator, or reason detail that would aid re-identification. Permitted public reason categories are small_cell, organization_concentration, complementary_suppression, longitudinal_differencing_risk, and privacy_review_hold.

5. Safe public measure vocabulary

Only the following proposal measures are structurally permitted:

  • consented_participant_count_band
  • current_corroboration_participant_share
  • refresh_required_participant_share
  • human_review_pending_participant_share
  • aggregate_evidence_coverage_band

Public shares use only 10-24_percent, 25-49_percent, 50-74_percent, and 75-90_percent bands. Exact basis points are prohibited because combining an exact share with a narrow count band can recover small numerators or the exact denominator. Every public share binds a protected evaluation digest proving that both the numerator and complement met the active privacy policy. These are participation measures, not individual scores or capability estimates. Evidence coverage describes how much scope has eligible support; it does not describe quality.

Any new measure requires a schema revision, privacy analysis, measurement review, limitations statement, and governance approval. Free-form measure IDs are prohibited.

6. Snapshot and query controls

The proposal permits only signed or digested, immutable snapshots with a bounded set of predeclared cells. Interactive arbitrary filtering, exports of row-level data, public APIs that can enumerate people, and repeated live count queries are prohibited.

Every release candidate and public snapshot must bind:

  • population and inclusion policy;
  • consent and permitted-use policy;
  • measure definitions and denominators;
  • metro assignment and time-window policy;
  • transformation and suppression implementation versions;
  • current and prior-snapshot overlap analysis;
  • machine-readable privacy attestation;
  • visible sampling-bias and non-aptitude language;
  • correction, withdrawal, and appeal path; and
  • release approvers and a non-sensitive change record.

The machine proposal uses opaque synthetic identifiers and controlled copy IDs, not free-form public text. participation_only_not_capability_v1 resolves to the required notice below through a separately reviewed content registry. A valid JSON Schema result is necessary but insufficient: the deterministic proposal invariant gate also verifies candidate digests, candidate-to-public bindings, unique cells and measures, count bands, protected numerator/complement closure, organization plausibility, active policy floors, and snapshot digests.

7. Required on-chart language

Every future map or regional table must place this meaning next to the data, not behind a tooltip:

Participation only. This view shows consented coverage in this register, not capability, aptitude, workforce quality, or a representative estimate of the metro population. Small or concentrated cells are suppressed.

Canonical copy ID: participation_only_not_capability_v1.

No aggregate snapshot is authorized by this document.