Levels

Each entry in the record can be rendered at up to four levels. A grant sets a ceiling per domain; the compiler renders each entry at or below it.

A level is a ceiling, never a licence. A recipient MUST hold a valid grant for every domain it reads, including at L0, and a recipient without one receives no record content and no category-presence information. There is no level a recipient reaches by authenticating alone.

What L1 removes

Personal names. Exact dates of birth (age bands are returned instead). Detailed addresses. Phone numbers, email addresses, account and loyalty numbers. Employer and institution names. Safe roles and age bands may still be structured at L1; structure alone does not imply a higher level.

Free text

Automatic redaction is not approval, so for free-text values the L1 and L2 renderings are text the person approved, held in rendering_overrides. If there is none, the entry is omitted at L1 or L2 rather than falling back to raw text.

How a level is chosen

A request has one optional max_level, L3 when omitted, applied to each requested domain on its own. For each domain the compiler selects the highest level the key's vocabulary supports at or below both the grant's ceiling and the request's. If there is none, the entry is omitted. It never invents an intermediate rendering, and a request cannot widen the grant.

Keys that stop early

Not every key supports every level; the vocabulary states which. An email address, for example, has only L0 and L3, so a grant at L1 or L2 discloses no more than its category. At L0 a medical alert returns only its category, which is still disclosure, so L0 needs a grant of its own. L0 is reduced detail, not anonymity.

Written against edition 1.0-draft-1: A5 Disclosure and the compiler