Methods
Separating reader clearance
Specify who may inspect each value and its evidence, including passages that disclose restricted material.
Problem
A value may be safe to show while the passage proving it contains personal, licensed or commercially restricted information. Withholding every derived value because one source is restricted can also prevent legitimate work. Reader clearance must therefore be assessed at the level of assertion, evidence and intended use. A citation is not useful to a reader who cannot lawfully open it, and a visible value can still reveal protected facts through wording or context.
Steps
Classify the material
Identify access restrictions on each source, retained copy, excerpt and derived assertion. Record the basis, such as contractual licence, privacy duty or operational need-to-know, and its effective period. Do not assume a public URL makes a downloaded copy freely redistributable, or that a derived value inherits one simple clearance from every source.
Define reader purposes
Describe reader roles by authorized decisions and the minimum evidence they need. Separate permission to see a final value from permission to see a passage, full source or identity link. A role name is too coarse if readers within it have different cases or jurisdictions. Record who approves exceptions and how access changes are reviewed.
Test disclosure paths
For each reader, inspect visible value, citation text, locator, retained copy and export together. Check whether an excerpt reveals restricted names or two visible fields combine to disclose a protected fact. Where direct evidence cannot be shown, provide an authorized summary and disclose that underlying support is restricted rather than presenting an uncheckable citation as open.
Review and revoke
Record access decisions with effective dates and revisit them when licences, duties or reader assignments change. Test direct views and copied exports, since revoking current source access does not recall material already distributed. Preserve a trail of who could inspect which evidence at a given time. The purpose is accountable access to defensible values.
Checks
- Value, excerpt and full source have distinct access decisions.
- Reader purpose and permitted evidence level are explicit.
- Exports and combined fields are checked for disclosure.
- Access changes retain dates and grounds.
Pitfalls
- Assuming a public link permits redistribution.
- Granting source access whenever a value is visible.
- Forgetting that citations or exports may disclose restricted facts.
A worked example
A fictional record states that a supplier failed an inspection. The supporting passage is from a licensed database whose terms forbid redistribution, and it names an individual inspector. Three readers use the record: a purchasing manager, a quality auditor and an external regulator.
The purchasing manager may see the value and a licensed-source citation without the passage. The quality auditor may open the passage in the licensed viewer. The regulator receives an authorized summary and a statement that the underlying passage is available on request under the licence. The inspector's name is withheld from all but the auditor. Each exported view is tested: the export for the manager does not include the passage in a hidden field, and the summary does not reveal the inspector through a unique detail. The access decisions are recorded with their basis and dates.
Variations and edge cases
Aggregation can disclose what single fields do not. Two fields that are each harmless, such as a site name and a date of inspection, may identify an individual together. Review combinations, not only columns. Inference can also leak: a value whose only possible source is a restricted document reveals its existence. Where that matters, the unknown is declared as blocked without naming the source.
Access changes over time. A licence expires, a role changes, a duty to delete takes effect. The record must show who could see what at a given date, which reproduces the past access picture for audit. Revocation affects future views and does not retrieve material already distributed, so exports need to carry their own handling rules.
Principles to anchor the design
Access control guidance describes policies written over attributes of the user, the resource and the context, which maps naturally onto evidence levels and reader purposes. Privacy law expresses principles such as purpose limitation and data minimization, which support giving readers the minimum evidence they need. Control catalogues for security and privacy provide a vocabulary for assessing risk. A machine-readable policy language exists for expressing permissions and obligations over assets, and may be useful for sharing terms with partners. None of these replaces the analysis of what each source allows.
How the method is checked
Run disclosure tests as a hostile reader. For each role, try to obtain restricted content through the interface, the export, the search index, the error messages and the audit log. Check that the log shows who accessed what. Review a sample of access decisions with the owner of the licence or the data subject's representative. Test revocation by removing an entitlement and confirming that the next view omits the material.
See also
- Retaining source copies
- Reproducing a past state
- D-U-N-S Number
- CUSIP
- Need-to-know access
- Retention schedule
Further reading in the articles
References
- NIST SP 800-162. Guide to Attribute Based Access Control (ABAC) Definition and Considerations.
- NIST SP 800-53 Rev. 5. Security and Privacy Controls for Information Systems and Organizations.
- Regulation (EU) 2016/679, Article 5: principles relating to processing of personal data.
- W3C. ODRL Information Model 2.2.
Found an error on this page? See corrections for what counts as one, how to report it and the dated log.
Enquiry
Test this method on one entity.
Name an entity where "Separating reader clearance" would be checked in practice, with its sources and its readers. We reply with what a first record would cover and what it would need from you.
Or write to [email protected] in your own words.