Identifying without exposing

Minimal disclosure, then policy

The second layer is minimization. Even a permitted response should say no more than its purpose needs. Document 08 sets a floor for a successful JSON identity response — rid, kind, identityStatus, and resolutionStatus — and makes everything else conditional on disclosure policy: a name, a space, an authority, representations, provenance. Where a field is withheld, it is simply absent.

For a public place such as the fictional Cedar Creek watershed, a permitted response might carry a name, the stewarding space, and a landing page. For a person such as Anika, even a permitted requester might receive only the canonical RID, the kind, and the identity status from the identity layer, with every further statement left to the spaces that hold claims about her and to whatever consent she has given. The identity layer stays thin so that it never becomes the place where a person's profile is assembled.

Indistinguishable absence

The third layer is what an unauthorized requester sees: the same response an unknown identifier would produce. Same status, same body, same headers — and, as far as reasonably controllable, the same timing and caching behaviour. This is the property that defeats probing. A requester holding a list of candidate identifiers learns nothing about which of them belong to protected people, because every protected one looks exactly like one that was never issued.

Caches are the easiest place to break it. A shared cache that stored a permitted response for an authorized principal and served it to the next requester would undo the policy entirely. Document 08 therefore requires principal-specific or restricted representations to use Cache-Control: private, no-store or equivalent non-shared controls, and requires caches to be invalidated when disclosure rules change (§18.8).

What randomness protects, and what it does not

RID suffixes are generated from eighty independent random bits (§3.3). The specification's stated purpose is uniqueness without relying on timestamps, counters, titles, or content hashes. A side effect is that identifiers are not sequential, so one cannot walk from a known RID to its neighbours, and guessing a particular issued RID at random is improbable. That is useful, but it is not a security guarantee and should never be described as one. An RID is an identifier, not a secret: it is meant to be written into records, shared between systems, and cited. Once an RID is known to someone, its randomness protects nothing; only disclosure policy does.

A worked case

An unauthenticated requester asks a conforming gateway for GET /451.9J0RFXDGKFYE4CXS — Anika's illustrative RID. Policy does not permit acknowledging person records to the public, so the gateway returns the same 404 problem response it gives for an identifier that was never issued. A researcher from the soil observatory, authenticated and permitted by policy, makes the same request and receives a minimal identity response marked private, no-store, after which the observatory's own space decides which of its observations attributed to Anika it may show. The site's resolver demonstration shows the unauthenticated half of this exchange using its restricted sample, labelled as simulated.

What remains open

Document 08 fixes the disclosure obligations but not the surrounding protections. Rate limiting is permitted as a transport outcome, not specified as a defence. Consent mechanisms, the evidence a requester must present, audit of authorized lookups, and protection against insiders with legitimate access are governance and implementation questions. A complete threat model for personal discovery, aliases, enumeration, impersonation, recovery, and consent is recorded as SPEC-02. Until it exists, the safe reading is the strict one: default to non-discoverable, disclose minimally, and make absence indistinguishable everywhere a response can be observed.