Chapter 113: The Redaction Index
A black box could protect a witness or protect a lie; the index had to show which one.
On Monday, KRR projected the public-package prototype in its read-only demonstration room.
I had been invited to test whether an ordinary reader could follow the redactions.
I could not approve them.
The first sample contained an employee statement with a home address removed.
Instead of a silent black bar, the margin named the reason: personal address, irrelevant to responsibility.
The index linked that reason to the privacy rule and the independent ruling date. It also showed whether the removal covered one field, one sentence, or a repeated identifier across the file.
It did not reveal the address beneath it.
The next sample removed a current employer's private contact information.
The public text preserved the witness's relevant job history and observed process.
A third removed family details that did not verify any company action.
Each redaction had its own numbered entry, source category, scope, and reviewer. A reader could compare that entry with the methods note without receiving access to the protected text.
Whole pages could not disappear behind one generic label.
Samuel showed a draft that had used `confidential` for twelve different reasons.
The word explained nothing.
KRR replaced it with specific grounds: personal address, protected employment detail, account information, legal advice, or unrelated third-party identity.
Responsibility evidence required a separate analysis. The reviewer had to state whether removal would make an approval path, decision date, or accountable role impossible to understand.
A person's name could remain when necessary to understand an authorized company act.
A medical detail could still be excluded even when the person held public responsibility.
The index also identified every source type without exposing its protected contents. Its labels described custody and format, not whether KRR considered the source favorable to any participant.
Readers could see whether a passage came from a native document, independent log, named witness, or limited audio reference.
No category automatically proved a conclusion alone.
I asked how a reader could challenge an overbroad redaction.
The reviewer opened the appeal path.
It accepted an entry number and a reasoned scope challenge, not demands for an entire private file.
Every ruling would enter the version log. Successful and denied appeals would appear under the same entry number, with the deciding reviewer and date.
The original evidence would remain unchanged regardless of the public-copy decision.
I tested the index on a document containing three different removals.
The first protected a bank account number.
The second protected an unrelated employee's name.
The third removed a sentence KRR had determined fell outside the tested scope.
The screen explained each difference instead of presenting one wall of black.
I suggested moving the reason legend ahead of the first document.
Samuel accepted the readability change after the reviewer confirmed it altered no ruling.
I suggested shortening `personally identifying location information` to `home address` where accurate.
That change was accepted for plain language.
I could not change a person's protection category because the shorter phrase looked cleaner.
At 4:09, KRR adopted the item-level index, reason legend, and privacy appeal route.
The version log recorded my role as usability tester only. It showed each suggestion I made and whether the reviewer, not I, accepted it.
That separation let readers inspect my participation without mistaking it for authority over the privacy result.
The public would be able to distinguish a protected witness from a protected decision-maker.
That distinction cost the package some of the dramatic completeness people expected.
It also stopped privacy from becoming a slogan that erased responsibility.
The reviewer then opened the remaining entity objections.
WMG had accepted the removal of addresses, account details, and unrelated employee identities. Those requests fit the same published grounds already applied to witnesses and participants outside the company.
Its final request used a different theory.
The company labeled Andrew a deceased employee whose privacy required removing his name from every approval record.
If accepted, the public would see that an executive approved the action and never learn which one.