Status: Proposed research mission; no field effectiveness established. Research orbit: ARTEMIS.
Original proposal · Domain model · Protocol
Thesis. Teams need to see the functional cost and privacy benefit of collecting less. System. Mirror a data-processing workflow using synthetic records, then vary fields, retention periods and aggregation levels. Model service utility, privacy exposure and incident-investigation coverage as separate objectives; display the Pareto frontier rather than collapsing them to one score. Inputs. Generated datasets with explicitly controlled sensitive attributes and approved workflow descriptions. Falsifiable metric. Utility loss and re-identification/attribute-inference risk at each minimization setting, with confidence intervals. Limitation. A synthetic twin may miss rare real-world harms or correlations; privacy review remains necessary. See NIST Privacy Framework and NIST SP 800-226.
Treat the statement “Teams need to see the functional cost and privacy benefit of collecting less.” as a hypothesis with a comparator and a population, not as a demonstrated benefit. Implement the precise mechanism described above; preserve the original evidence boundary and endpoint. Use the domain model to state variables and units, but justify which assumptions apply to this particular mechanism rather than copying the model mechanically.
Observation contract: collect only the fields needed to estimate this mission's endpoint. Candidate domain fields are Actor pseudonym, resource class, task requirement, grant origin, expiry, revocation time, decision reason. Bind every record to source/version, valid-time interval, missingness reason and a fixture or collection permission. The domain resource is HELIOS deterministic local fixtures; its applicability is a candidate starting point, not an assertion that every field required by this mission exists there. When fields or labels are absent, design a synthetic or owned-system fixture and report the gap.
Baseline and falsification: use the original comparison stated above and at least one applicable simple baseline from Role template; permission union; periodic access review. Match information, tuning, observation and resource budgets. Define an absolute acceptance floor and minimum meaningful improvement before collecting the final test results. Reject the thesis if the benefit disappears on an untouched partition, if the resource-normalized baseline dominates it or if a declared invariant fails. Choose numerical floors with the mission owner; this dossier does not invent measured thresholds.
Adverse-case matrix: Revoked delegator; expired exception; changing task; partial federation outage; stale cache. Choose the cases relevant to this mechanism and explain any exclusion. Add a negative control in which the intervention should have no effect. Preserve ambiguous outcomes instead of assigning unsupported truth labels.
Graduate investigation: Context drift; exception authority; consent vs authentication confusion; indirect entitlement. Write a rival explanation for any apparent improvement; identify the smallest additional observation that distinguishes it from the proposed mechanism. Perform a sensitivity analysis over uncertain assumptions and a leave-one-environment/scenario-out evaluation. A performance difference within a synthetic fixture establishes only behavior of that fixture.
Review artifacts: model/assumption ledger; versioned input contract; baseline implementation; preregistered endpoint; adverse-case results with uncertainty; resource-use record; negative findings; independent review notes. The practical starting budget is Synthetic authorization graph, integer solver optional, identity owner and privacy reviewer. Independent reviewer sign-off remains pending.
Domain references and data caveats · Applicable resource ledger