Confidentiality flags
Every answer carries one of three levels, set by the person speaking.
At the end of each thing they share, the participant picks how far it can travel. The level is enforced all the way through: at storage, at synthesis, at the access key, and at the leadership read.
- GREENmanager_ok
My manager can see this.
Who sees it. Readable at the manager level and every level above it (department leadership, executives).When to pick it. For work the person is fine raising in a normal one-on-one with their manager. - YELLOWdepartment_only
Department leadership can see this.
Who sees it. Readable at the department level and the executive level.Who does not. Not readable at the manager level. Even if a manager runs the chat on this cycle, they never see yellow themes.When to pick it. For things the person wants leadership to know but not their direct manager. - REDexecutive_only
Only the executive who commissioned this should see this.
Who sees it. Readable only at the executive level.Who does not. Not at the department level, and not at the manager level. The model building manager-level and department-level themes never receives this response at all.When to pick it. For something the person wants to share only with the executive who started the cycle.
How enforcement works
Four layers, every read.
The level set during the interview is enforced at storage, at synthesis, at the access key, and at the leadership read. Each layer is independent, so a slip at one layer is caught by the next.
The participant sets the level, per answer.
At the end of each thing they share, the person picks one of the three levels. It travels with the response for good. Your operator cannot edit it, and leadership readers cannot see it.
Each access key has a maximum level.
When your operator issues a console key, that key is locked to one maximum level (manager, department, or executive). Your session inherits it. A request for content above your maximum returns an error, with no soft fail.
Synthesis is separated by level.
Three separate passes run per cycle, one per level. Each pass only receives the responses its level is allowed to see. A red response is never in the input for the manager or department pass. The model cannot leak text it never received.
Leadership reads match exactly one level.
A read returns exactly one level at a time, never a mix. A department lead reads department-level themes, not manager-level ones alongside. Each level's themes already include everything that level was allowed to see, so the exact match is both correct and complete.
Real bounds
Where the flags do not finish the job.
- The three-person threshold applies inside a level too. A theme without at least three distinct supporters is dropped at read time, whatever the level.
- Hard filtering inside a level can still narrow a small group to recognizable people. We accept this for now and tell the model to write generically. Stronger statistical protections are on the roadmap.
- A higher level sees only its own themes by default. If a leader wants a lower level's texture too, the operator can issue a separate key for it. The system does not cascade across levels in one read.
Need the rest of the picture?