Protection That Travels

Priya has asked her reading tool to remind her before she opens another paper. She has separately asked it to keep unrelated recommendations out of the reading view during the study session. Neither instruction governs her news or video services. When she moves to one of those, the recommendations return.

She now gives another instruction: For this evening’s study, keep new consensus-research recommendations out of the recommendation feeds in these two services. Leave search and direct opening available. End the rule when I finish the paper or end study, and by eight this evening in any case. She selects the services and accepts the scope.

That declaration supplies something the earlier rules did not: permission to apply this particular boundary elsewhere. It does not turn the reminder into a global restriction, or give every service access to the history of her study sessions.

The scene is constructed. Its question is architectural:

If a person has declared a communication boundary once, how can it be carried into another service without carrying the history that produced it?

Two principles guide the proposed answer:

A communication policy can travel farther than the history that produced it.

Portability does not permit reinterpretation.

Permission to travel

A rule’s existence does not authorise its use everywhere. Priya might want a quiet reading view and an unrestricted news feed at the same time. A mediator that extends the first rule because it recognises the same person in both places has changed her instruction.

The destination therefore belongs to the authority decision. The portable boundary must identify where it may apply, which communication it may alter, and for how long. A session overlay can activate that boundary when the accepted conditions hold. As in the previous chapter, it cannot invent the permission or enlarge it in transit.

Here is a small account of what Priya accepted:

Portable boundary — version 1

Origin:       Priya's explicit instruction
Destinations: The selected news and video services
Effect:       Keep new consensus-research recommendations
              out of their recommendation feeds
Preserve:     Search and direct opening
Override:     Show recommendations now for this view
End:          Paper finished, study ended, or 20:00 today
Persistence:  No durable preference promotion from this mode

This is an illustrative record, not a proposed interchange standard. Its purpose is to make the grant readable. “Keep me focused” would not supply the missing destinations, permitted intervention or exceptions.

The rule also has a reason Priya can recover: she asked for this during a particular study session. That reason must remain hers. Receiving services do not acquire a mandate to diagnose distraction or decide what would be better for her.

What travels and what stays

The news service needs to know which recommendations the rule covers and which feed controls it may use. It does not need the conversations that led to the request, how often Priya overrode earlier reminders, or what the system thinks those overrides mean.

The separation is:

retained history
      ↓
explicitly authorised boundary
      ↓
minimum information needed at this destination
      ↓
local application and a bounded receipt

Minimum information is not no information. The receiving service must have enough meaning to distinguish consensus-research recommendations from other material. If it needs a clarification, the mediator should expose that need. It must not send the whole conversation because deciding what to disclose is inconvenient.

Nor does preserving the user’s reason require exporting her personal explanation. The source of authority and a reference to the accepted rule can travel while the fuller explanation remains available to Priya where she supplied it. A receiver can know that she authorised a temporary feed boundary without knowing why finishing this paper matters to her.

The same discipline applies to expiry. A service may need an end signal; it does not thereby need a continuous account of her reading. The design question is what smallest signal can end the accepted effect, not how much activity can be collected under the heading of enforcement.

A faithful adapter

The rule arrives in services with different controls. An adapter maps the accepted effect onto what a particular service can actually do. It should be boring in its ambitions: understand the rule, preserve its limits, apply supported controls and report the remainder.

Three things must stay separate:

requested boundary
        ≠
available service control
        ≠
confirmed enforcement

A service limitation does not enlarge the user’s instruction.

Suppose the constructed news service has only an account-wide switch that hides all research content, including search results. Applying it would suppress consensus recommendations, but also remove other research and the direct access Priya explicitly preserved. It is not a faithful implementation.

The adapter must report: This service cannot apply the requested feed boundary. Its available control would also hide other research and search results. It leaves that broader control unapplied. Priya may accept a different rule for this service, but that is a new authority decision, with its own scope and version. It is not permission the adapter discovers inside the original instruction.

Now suppose the video service can filter the home recommendation feed but cannot filter recommendations beside a playing video. Applying the home-feed control may be a faithful partial application, provided it also supports the required override and end conditions. The uncovered surface remains visible in the report.

That distinction matters:

less of the authorised effect
        ≠
an effect beyond the authorisation

The honest outcomes are faithful enforcement, faithful partial enforcement, or cannot faithfully enforce. “Partly enforced” can describe less of the authorised effect. It cannot excuse an effect beyond the authorisation. A broader block does not become an acceptable partial implementation because it achieves some of the intended result.

Classification introduces another limit. A service’s label for “consensus research” may include different material from Priya’s instruction. The mapping needs to be inspectable and correctable; uncertainty is not permission to hide a larger category. A successful settings change says nothing by itself about the quality of that classification.

A receipt says what is known

Portable ≠ propagated ≠ verified.

A boundary being portable means it can travel with its meaning and limits intact. It does not establish that a particular version has reached every enforcement point. Nor does arrival establish support, application or a successful check. The stages must remain separate:

DECLARED ≠ CARRIED ≠ RECEIVED ≠ SUPPORTED ≠ ENFORCED ≠ VERIFIED

A service can receive a rule it cannot support. A supported control may not yet have been applied. An applied control may not have been checked. Each receipt must say which stage is known at the destination it names, rather than turn a portable declaration into a claim of protection everywhere.

Sending a rule, receiving an acknowledgement and checking an applied control are different events. A mediator that reports “protected” after the first has confused a request with an outcome.

An enforcement receipt should identify the rule version, destination, affected surface, checks made and limits still present. In the constructed video service it might say:

Receipt — video service, 18:10

Boundary:     Version 1, authorised by Priya
Status:       Partly applied
Confirmed:    Home-feed filter active; search unchanged;
              local override, expiry and temporary-learning
              limit configured
Unsupported:  Recommendations beside a playing video
Check basis:  Service setting read back after application
Content matching has not been independently checked

The last two lines prevent the receipt from becoming a certificate for more than was checked. Reading back a setting can establish that the setting is present. It does not prove that every future recommendation will be classified correctly, that no hidden learning route remains, or that the expiry will execute later. Those are different claims.

setting confirmed ≠ protection verified

The receipt should therefore make uncertainty legible alongside full, partial and unsupported application. If the service is unreachable after a change, the current state is unconfirmed. “Unsupported” means the relevant capability is unavailable; “unconfirmed” means the mediator does not know what happened. Neither should be presented as successful protection.

This is a proposed accountability mechanism, not evidence that the book has implemented cross-service enforcement. Its value here is the discipline it imposes on the claim: what changed, under whose instruction, where, and how do we know?

Receipts also need time. Yesterday’s confirmation cannot establish today’s state after a service changes its controls or Priya revises the rule. A useful display connects the latest known application to the current authorised version, and exposes a stale or missing confirmation.

Ending the rule everywhere

At seven, Priya finishes the paper. The boundary’s authority ends. Deleting it from the mediator is insufficient if a filter is still active in the video service.

Expiry belongs to each applied effect. An adapter must account for how the service will stop the control when the accepted condition ends. If a service supports a clock deadline but cannot receive the paper-complete signal, that limitation changes the offered arrangement. The adapter cannot quietly substitute eight o’clock for whichever end comes first and call the original rule enforced. Priya would have to accept the different lifetime.

The same issue appears when she revokes or revises a rule:

Revocation must travel through the same enforcement path as creation. Deleting the source rule is not evidence that its distributed effects have ended.

Suppose an authorised boundary has been applied at three enforcement points. After Priya revokes it centrally, one confirms removal, one is offline, and one still holds an older cached version. The central record can truthfully say boundary revoked. It cannot truthfully say the effects have ended everywhere. For a replacement rule, the same uncertainty prevents a claim that the new boundary is enforced everywhere.

A receipt for the old version remains evidence of an earlier application; it does not authorise that version now. The mediator must show which enforcement points confirmed removal or replacement, which reports are stale, and which changes are not yet confirmed. Revocation is an enforcement event as well as a change to the source record.

Ending the control also means preserving the service’s other settings. If Priya had an unrelated filter before this session, removing the temporary boundary must not erase it. The adapter needs to distinguish the change it made from policy it had no authority to revise.

An override has a narrower meaning. Show recommendations now for this view permits that view; it does not cancel the boundary in the other service, revise its future scope, or announce that Priya no longer wants to finish the paper. Repeated overrides can invite reconsideration under the previous chapter’s conditions. They cannot authorise stronger enforcement across more destinations.

Temporary effects must not become a person

The receiving service might observe that Priya opened fewer consensus recommendations while its feed filter was active. That behaviour was produced under the boundary. It cannot be treated as an unqualified declaration that she has lost interest in consensus research.

This is Chapter 24’s indirect-residue problem at another destination:

temporary boundary changes the feed
        ↓
changed feed changes behaviour
        ↓
behaviour becomes a lasting preference inference

Removing the filter would leave its effect behind if that inference continued to shape later feeds. A portable temporary boundary therefore carries a limit on promotion as well as a limit on presentation. Any legitimately retained observation must preserve the condition under which it arose; durable policy change requires a separate decision. Permission to apply the filter is not permission to build a lasting account of Priya from its effects.

A service unable to respect that limit does not satisfy the grant. The mediator must report the limitation and leave that arrangement unapplied unless Priya accepts a different boundary. Partial coverage of recommendation feeds is one thing; violating the conditions attached to that coverage is another. This adds an unresolved implementation obligation; it does not establish that arbitrary services can satisfy it.

Protection remains an accountable claim

An accepted user boundary should constrain the service behaviour it names, including defaults that would otherwise fill the feed. If a service will not honour it, the honest outcome is a reported refusal or unsupported application. A badge showing that the rule was received cannot substitute for the effect Priya requested.

The account remains narrow. It proposes carrying a communication boundary, its authority and its limits. It does not grant the mediator power to speak for Priya, make unrelated account changes, or resolve every privacy question raised by combining services. Even the minimal payload needs scrutiny: several small disclosures can reveal more together than separately. That wider problem belongs with the later questions about acting and speaking for someone.

Here, the requirement is already demanding enough. The destination must be authorised. Translation must preserve the effect and exceptions. Partial application must stay inside the grant. Expiry and revision must reach the actual controls. A receipt must report what is known without turning a local check into a claim of universal protection.

Priya can inspect the boundary she supplied or accepted and the receipt of its application. Yet enforcement still depends on representations inside the system: what it thinks the rule means, which scope it thinks applies, whether it thinks a service supports the rule, and what it thinks happened. Any of those beliefs can be wrong. A mistaken belief about support or application can change what the system suppresses or claims to protect.

The same issue extends to its interpretations of Priya. It may believe she knows the basics of consensus, prefers derivations, or is working on a particular project. Those beliefs can change what appears even within a faithfully enforced boundary. Making them visible would allow inspection; it would not make them valid or authorise their use.

The next question concerns these consequential beliefs: if an internal belief can change what the channel shows, suppresses, retains or enforces, what must the person be able to see?