Twelve governed principles covering legitimate need, affected people, data, authority, safeguards, tests, limitations, owners, review dates, and correction history. Each carries an honest implementation state — because adopting a principle is not the same as having implemented it.
Scope invariant
This page governs design conduct and public evidence. It never converts a complex social, employment, or jurisdictional judgment into a generic ethical score or a product-owned legal conclusion.
Binding product invariant
No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration.
Productivity, optimization, security, and analytics are all legitimate design goals. None of them creates a hidden exception to this. A feature that would require any of the prohibited collection is not redesigned around the invariant — it is not built.
Claim owner: Trust & Governance · Status: Current · Last reviewed 12 Jul 2026 · Next review 12 Jan 2027
This invariant does not remove your privacy, labor, or consultation obligations. It describes what is never collected — nothing more.
Twelve Governed Principles
A design can pass one principle and fail another. There is no combined score, because a combined score would hide exactly the release-blocking gap you need to see.
Design must not demean, coerce, or convert ordinary work into hidden behavioral surveillance.
Current safeguards
Product-wide collection prohibition enforced in architecture, not configuration.
Consequential outcomes require eligible human judgment. Flags, classifications, and summaries remain evidence for review.
Current safeguards
Eight human-only decision classes; separation of duties; no automation may hold final permission.
Affected people can understand records, inputs, rule versions, status, and reasons — and reach correction, challenge, and escalation.
Current safeguards
Own-record visibility, neutral states, correction path, linked appeal history.
Assess foreseeable differential impact, exclusion, proxy effects, and inconsistent treatment — without unnecessary sensitive-data collection.
Current safeguards
Context-specific differential-impact review at design gate; qualitative and accessibility evidence methods.
Stated gap: quantitative testing coverage varies by journey. Interim control is manual review at release gate. Review plan owned by Product governance.
Design, test, and operate inclusive journeys and alternatives across supported devices, assistive technologies, and contexts.
Current safeguards
WCAG 2.2 AA target, manual and automated testing, published known limitations, issue route.
Stated gap: conformance is asserted per surface, not platform-wide. Remediation status is published alongside each limitation.
No hidden consent, fake urgency, obstructive withdrawal, confirmshaming, coercive defaults, or commercial prioritization over public evidence and rights.
Current safeguards
No preselected consent anywhere; one-action unsubscribe; public evidence never gated behind a lead form.
Define the operational need, affected people, intended benefit, non-goals, alternatives, and why this intervention is proportionate.
Current safeguards
Need statement, baseline, alternatives considered, and non-goals required at design gate.
Collect, derive, retain, and expose only what is necessary — while preserving source, policy, jurisdiction, timezone, limitations, and evidence context.
Current safeguards
Field-level minimization, deny-by-default exposure, preserved lineage on every record.
Purpose limitation, least privilege, deny-by-default access, retention controls, safe logging, and secure change are built in.
Current safeguards
Design-gate privacy and security review; prohibited categories excluded from logs by architecture.
Unknown, partial, stale, and conflicting states stay visible. Rollback, recovery, reconciliation, and incident communication are designed before release.
Current safeguards
Explicit Unknown states, no optimistic fallback, reconciliation on recovery, published incident practice.
Stated gap: recovery test evidence is under review and not yet publishable. See Platform Reliability.
Make organizational responsibilities, worker rights, policy versions, legal variation, and consultation context visible — without making legal conclusions.
Current safeguards
Three-column responsibility model on trust destinations; policy version shown on records.
Stated gap: consultation materials remain evidence-gated pending legal review. Jurisdictional guidance is not published as legal advice.
Preserve owners, approvals, tests, limitations, incidents, feedback, corrections, supersession, and withdrawal as attributable history.
Current safeguards
Append-only evidence history; no silent overwrite; published correction records.
Approved ML scope, prohibited uses, and the Kairos boundary as a standalone destination.
Not yet approved for public release, so it is described here but not linked. The AI boundary itself is covered under ED-04 and on Human-in-Command Controls.
How principles are applied
Every material feature, workflow, policy-affecting change, data use, permission change, automation, or public claim maps to the relevant principle IDs. A principle may be marked Not Applicable only with a reason, a reviewer, and a scope — it can never be skipped silently. Residual limitations remain visible after approval and can trigger restricted availability, manual-only operation, additional notice, independent review, or non-release.
Need, Purpose & Proportionality
The hardest question is the second one: can a worker meaningfully refuse, understand, or challenge this — and could a manager use it outside its intended purpose?
| Dimension | The question that must be answered |
|---|---|
| Need & benefit | Whose problem is this? Who benefits, and who bears the burden? |
| Power & coercion | Can a worker meaningfully refuse, understand, or challenge? Could a manager repurpose this? |
| Privacy | Is each data element necessary? Is derivation, retention, and secondary use justified? |
| Security | Could misuse, privilege, leakage, or integration failure harm people or records? |
| Human authority | Could this output become an automatic or rubber-stamped consequential decision? |
| Fairness | Could missingness, proxies, schedule patterns, disability, location, or device create differential burden? |
| Accessibility | Can supported users complete essential journeys with assistive technology? |
| Reliability | What happens when sources are stale, delayed, conflicting, unavailable, or wrong? |
| Misuse & abuse | How could an administrator, manager, integration, or attacker repurpose this design? |
| Jurisdiction context | What policy, labor, consultation, or contractual context changes appropriate use? |
Human Authority & Contestability
Consequential payroll, discipline, employment, and legal outcomes require an eligible authorized person. Classifications and summaries are inputs to that judgment, never substitutes for it.
Human-in-Command ControlsPolicy-bound time classification is deterministic, versioned, and reviewable. Approved machine learning may flag anomalies or signal-quality concerns for human review. Kairos retrieves, summarizes, and explains governed data — and decides nothing.
Deterministic ClassificationED-06. Assess foreseeable differential burden without collecting sensitive attributes we do not need.
Limitations: averages do not erase materially worse outcomes for a subgroup, region, device, schedule pattern, or exception path — and we report the subgroup result rather than the average that hides it. No universal fairness claim is made, and quantitative coverage varies by journey.
ED-07. Inclusive journeys and tested alternatives are a release requirement, not a later fix.
Limitations: no perfect-conformance claim. Conformance is stated per surface rather than platform-wide, and known limitations are published alongside the position rather than after it. Any product claiming flawless accessibility has not tested honestly.
Purpose limitation, minimization, deny-by-default access, retention controls, and preserved context.
PrivacyLeast privilege, safe logging, secure change, and prohibited categories excluded architecturally.
SecurityUnknown, partial, stale, and conflicting states stay visible. No optimistic fallback anywhere.
System StatusED-12 · No Dark Patterns
Misuse & Abuse Review
How could an administrator, a manager, an integration, or an attacker repurpose this design for something it was not intended to do?
A feature that is safe as designed but trivially repurposed as a monitoring tool does not pass this gate.
Governed Design-Review Lifecycle
Evidence-backed need, affected people, intended benefit, non-goals, current process.
Data, authority, policies, jurisdictions, dependencies, power asymmetries, alternatives.
Benefits, harms, exclusion, coercion, misuse, differential impact, failure modes.
Minimization, safe defaults, permissions, human review, correction, alternatives.
Accessibility, privacy, security, fairness, reliability, usability, abuse, recovery.
Remaining limitations, evidence sufficiency, operating ownership, notices, training.
Eligible human authority with separation of duties. Blocking is a legitimate outcome.
With current evidence, monitoring thresholds, issue routes, and rollback capacity.
Feedback, incidents, complaints, differential outcomes, accessibility barriers, misuse.
Correct, restrict, roll back, supersede, withdraw, or retire — preserving history.
Unclear or illegitimate purpose, no accountable owner, or no affected-person analysis.
Prohibited surveillance data, or any hidden monitoring exception.
An automatic consequential decision, missing human review, or no correction and challenge path.
Unresolved high-impact privacy, security, accessibility, fairness, reliability, or abuse gap beyond the approved boundary.
Insufficient source context, stale evidence, or unsupported certainty for a consequential action.
No operating owner, incident route, support route, rollback, recovery, or correction capability.
A material jurisdiction or consultation dependency left unresolved, or represented as a product legal conclusion.
A public ethical, fairness, accessibility, or safety claim without current scoped evidence.
Ten release states
Blocked cannot be bypassed without an authorized, scoped, and time-bound exception policy. Monitoring does not imply failure, but it may restrict expansion.
Design Evidence Directory
Full text, required design commitment, and current implementation state for each.
Limitation: adoption state is not implementation evidence.
The eight gates and how exceptions are authorized, scoped, and time-bound.
Limitation: describes our process, not your deployment approval.
Tested journeys, methods, known limitations, and remediation status.
Limitation: per-surface, not platform-wide.
Dimension selection rationale, methods where attributes cannot be collected, reporting rules.
Access: governed request. Contains no worker-level data.
Need, alternatives considered, assessments, residual limitations, approval, and owner.
Access: governed request. Restricted design-record metadata withheld.
What changed, why, effective date, affected scope, and owner.
Unsafe or legally problematic claims may be removed first, with a retrospective record.
Results are never ranked by popularity or conversion. Restricted design-record metadata is not exposed, and search terms are never captured in analytics.
Feedback, Issue Reporting & Redress
Sending a design concern to a general feedback inbox is how it gets lost. Each category has an owner.
Confusing workflow, missing context, obstructive setting, poor error recovery.
Route
Product feedback or Help Center
Incorrect time, classification, status, or evidence relationship.
Route
Correction and Human-in-Command review
Unclear purpose, excessive collection, access, retention, or rights issue.
Route
Vulnerability, access-control issue, or unsafe disclosure.
Route
Keyboard, screen reader, contrast, zoom, motion, cognition, or alternative-channel barrier.
Route
Differential burden, proxy effect, punitive use, or lack of meaningful review.
Route
Governance concern or Enterprise Support
Stale state, delayed processing, reconciliation, or outage communication.
Route
System Status or Enterprise Support
Outdated claim, missing limitation, unsupported wording, or evidence gap.
Route
Nine issue states
Under review shows the owner and current state without blame. Action planned shows scope and status without an unapproved delivery promise. A declined issue receives a reason category and an escalation route where one is available.
Direct Answers
No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration. No design goal — productivity, optimization, security, or analytics — creates an exception. See Privacy.
