Disclosure levels and the compiler

spec v0.1-draft

Every entry in the record MUST be renderable at up to four levels. A grant sets a ceiling per domain; the compiler MUST render each entry at or below that ceiling and MUST NOT return a rendering above it.

L0Categories

Categories only, no valuesWhether a permitted category is present, without its detailed values.

L1Preferences

Preferences and needs, no direct identifiersPreferences and needs with direct identifying details removed.

L2Named

First names and household relationshipsMore specific details, which can include first names and household relationships.

L3Identified

Identifying detailsIdentifying details held in the record, such as full names and contact information.

5.1 The levels

Entry	L0	L1	L2	L3
Household	Includes minors	Partner and two children under 10	Partner Sam; Ella (8), Noah (5)	Full names and dates of birth
Food allergy	Has a food allergy	Tree nuts, severe	Tree nuts, severe; carries an adrenaline pen	Plus the prescribing clinician
Coffee	Has a drink preference	Flat white, oat milk, extra shot	Same	Same
Mobility	Has an access need	Wheelchair user, needs step-free access	Plus chair dimensions	Plus a contact for assistance

An entry MUST NOT be returned at a level its key does not support. A coffee order has no L3; a medical alert has no L0 rendering beyond "has a medical alert". The domain vocabulary states which levels each key supports, and the vocabulary is normative.

5.2 What L1 removes

At L1 the compiler MUST remove:

Personal names.
Exact dates of birth. An age band MUST be returned in their place.
Addresses below region.
Phone numbers, email addresses, account and loyalty numbers.
Employer and institution names.

5.3 Free text

Automatic redaction of free text is not reliable. For a free-text value the L1 rendering MUST be a string the person approved, held in rendering_overrides.L1. Where no such string exists, the compiler MUST omit the entry at L1 rather than attempt a redaction.

5.4 Ordering

Safety-critical entries MUST be returned first at every level, so that a recipient truncating a response cannot drop an allergy or an access need.

5.5 The floor

L0 is the least detailed disclosure level. A recipient MUST hold a valid grant for every domain it reads, including at L0. A recipient without such a grant MUST receive no record content or category-presence information.

A level above L0 MUST be granted per domain rather than globally. The earlier draft treated L0 as a floor that authentication alone reached; that is withdrawn, because the presence of a category is itself disclosure.