Direct answer

Begin by identifying exactly which inquiry data exists and who can use it. Then redesign the system to avoid identity linkage and durable raw records before relying on policy. Bind staff, vendors, and public authority to narrow purposes, deletion, notice, appeal, and sunset rules. Test those claims against all eighteen audit domains. Publish enough versioned evidence to make the result challengeable—without publishing or retaining the private inquiries the work is meant to protect.

Before stage one

Set four non-negotiable boundaries.

Inquiry is not confession.

A query, prompt, book, draft, topic, or controversial phrase does not by itself prove belief, character, ideology, dangerousness, or harmful intent.

Safety needs a defined harm.

Name the conduct or capability, evidence, likelihood, severity, affected population, and less intrusive alternatives before collecting more information.

Architecture outranks promises.

A system that never creates a general inquiry dossier provides stronger protection than a policy promising not to misuse one.

Evidence must remain contestable.

No favorable label should conceal missing evidence, failed critical gates, unresolved limitations, lifecycle changes, or unavailable remedies.

NAV-CL-P001-S01

Stage 1 of 5 · Threat model

Define the inquiry, the actor, and the harm before selecting controls.

Separate lawful curiosity and unfinished thought from demonstrated harmful conduct; identify who can observe, infer, retain, disclose, or act on inquiry data.

Pathway top ↑

Decision questions

What inquiry data exists, including queries, prompts, reading history, drafts, clicks, embeddings, moderation labels, and inferred traits?
Which actors can link that data to a person, device, account, household, institution, or downstream decision?
What concrete harm is being prevented, what evidence supports it, and what less intrusive alternatives exist?
What would be unacceptable even if technically possible: permanent dossiers, viewpoint scoring, secret risk labels, or general identity requirements?

Required outputs

Data-flow and actor map
Named threat scenarios with likelihood and severity
Explicit protected-inquiry boundary
List of prohibited secondary uses

Open the authority map for this stage

Mechanisms

Organizations

Standards

Researchers

RES-CL-003Neil Richards

Implementation kits

Audit domains

Public research guides

Exact report-section basis

These protected report pointers explain the crosswalk. They are research inputs, not external endorsements or independently verified universal claims.

Surveillance and Epistemic Conformity(1).md#the-chilling-effect-surveillance-epistemic-conformity-and-the-erosion-of-intellectual-privacy
Search Privacy Legal Frameworks(1).md#the-architecture-of-modern-search-systems-processing-retention-and-secondary-uses

NAV-CL-P001-S02

Stage 2 of 5 · Least-intrusive architecture

Remove identity, retention, and centralized observation before adding policy promises.

Design the service so it cannot routinely produce the cognitive dossier that policy later claims it will not misuse.

Pathway top ↑

Decision questions

Can authorization be separated from civil identity or persistent accounts?
Can sensitive processing happen locally or through oblivious, encrypted, federated, or compartmentalized components?
Can raw inquiry data be avoided, transformed, aggregated, or deleted before it becomes a durable record?
Which safeguards fail if two intermediaries collude, an endpoint is compromised, or logs are copied downstream?

Required outputs

Least-data architecture diagram
Retention and deletion schedule
Identity-separation design
Failure and collusion analysis

Open the authority map for this stage

Mechanisms

Organizations

Standards

Technology

Implementation kits

Audit domains

Public research guides

Exact report-section basis

These protected report pointers explain the crosswalk. They are research inputs, not external endorsements or independently verified universal claims.

Cognitive Liberty Privacy Directory.md#the-jurisprudence-and-cryptographic-architecture-of-cognitive-liberty
Surveillance-Free Safety Engineering(2).md#part-5-reference-patterns-for-privacy-preserving-safety

NAV-CL-P001-S03

Stage 3 of 5 · Institutional policy

Bind people, vendors, and public authority to narrow purposes and real consequences.

Translate the architecture into enforceable procurement, access, disclosure, deletion, appeal, and emergency rules that survive personnel and vendor changes.

Pathway top ↑

Decision questions

Who may access inquiry data, under what authority, for which documented purpose, and with what approval?
Do contracts prohibit secondary use, model training, sensitive-trait inference, advertising, sale, and silent downstream retention?
What notice, contest, correction, deletion, and human-review rights exist when inquiry data affects an outcome?
What emergency power exists, what evidence threshold triggers it, and what audit, sunset, and deletion duties end it?

Required outputs

Approved privacy and inquiry policy
Vendor and procurement clauses
Access and disclosure matrix
Appeal, correction, deletion, and emergency procedures

Open the authority map for this stage

Mechanisms

Organizations

Standards

Researchers

Implementation kits

Audit domains

Public research guides

Exact report-section basis

These protected report pointers explain the crosswalk. They are research inputs, not external endorsements or independently verified universal claims.

Intellectual Freedom and Cognitive Liberty.md#library-freedom-and-national-library-associations
AI Procedural Rights Framework Design(2).md#4-the-doctrine-of-epistemic-due-process

NAV-CL-P001-S04

Stage 4 of 5 · Audit questions

Test actual behavior across all eighteen domains instead of accepting a single score.

Use provider-neutral questions, critical gates, and evidence classes to expose gaps between policy, implementation, and lived operation.

Pathway top ↑

Decision questions

Can the institution produce evidence for each claim without relying only on policy language or vendor assurances?
Do critical mental-privacy, inquiry, proportionality, due-process, and deletion failures block a favorable conclusion?
Can affected people reproduce the complaint, receive reasons, challenge evidence, and obtain correction or deletion?
Are lifecycle changes, superseded standards, vendor transitions, and unresolved limitations visible rather than silently normalized?

Required outputs

Completed AUDIT-CL-001 domain record
Critical-gate findings
Remediation owners and due dates
Retest plan and residual-risk statement

Open the authority map for this stage

Mechanisms

Organizations

Standards

STD-CL-009NIST Privacy FrameworkCurrent · Revision in development · as of 2026-09-04

Technology

TECH-CL-004Nix & NixOSActive · Supported stable release · as of 2026-09-04

Researchers

Implementation kits

Audit domains

Public research guides

Exact report-section basis

These protected report pointers explain the crosswalk. They are research inputs, not external endorsements or independently verified universal claims.

Cognitive Liberty Audit Framework(1).md#the-cognitive-liberty-audit-framework-standardizing-the-evaluation-of-ai-systems-and-digital-platforms
Cognitive Liberty AI Audit Framework(2).md#worldwide-cognitive-liberty-audit-framework-for-artificial-intelligence-and-search-systems

NAV-CL-P001-S05

Stage 5 of 5 · Evidence and maintenance

Publish inspectable evidence, preserve limitations, and schedule the next challenge.

Make claims testable over time without exposing private inquiry records or pretending that a one-time review proves future behavior.

Pathway top ↑

Decision questions

Which evidence is public, which is independently reviewable under confidentiality, and which remains unavailable?
Can a reviewer trace claims to versions, configurations, logs, tests, contracts, deletion receipts, decisions, and accountable owners?
What changed since the last review, which standard or project lifecycle states shifted, and which assumptions expired?
What must be rechecked after a material incident, vendor change, law change, model change, or maintenance transition?

Required outputs

Evidence register with provenance and limits
Public findings and non-certification statement
Lifecycle and change record
Scheduled re-review and incident-trigger rules

Open the authority map for this stage

Mechanisms

Organizations

Standards

Technology

TECH-CL-004Nix & NixOSActive · Supported stable release · as of 2026-09-04

Researchers

RES-CL-003Neil Richards

Implementation kits

Audit domains

Public research guides

Exact report-section basis

These protected report pointers explain the crosswalk. They are research inputs, not external endorsements or independently verified universal claims.

Censorship-Resistant Archives Technical Report.md#designing-the-freedom-archive-a-blueprint-for-global-distributed-preservation
AI Cognitive Liberty Ecosystem Map.md#gap-1-absence-of-procedural-due-process-in-automated-refusals-and-account-enforcement

Completion record

A complete pathway leaves evidence, not a badge.

Record each item below with an accountable owner, version or date, evidence location, known limitation, and next review trigger. Do not attach raw query, prompt, reading, or draft histories merely to prove that privacy work occurred.

Named accountable owner and decision authority