Sharing selected results with auditors and partners
Development status: Being explored — The intended pattern lets data owners decide who can see which data, including time-limited access for auditors, with who may see data controlled separately from who may act on it. The experimental implementation provides no encrypted or access-controlled data, and its step for revealing encrypted results to authorised parties is only simulated. How access control and disclosure would work is not described. Nothing is publicly available for live use.
Before you read: What you could build: intended application patterns.
Could an organisation let an auditor or partner see only the data they need, for a limited time? That is the intent of this pattern, and nothing of the kind is available today. This page explains the intended selective-sharing pattern, why seeing data and acting on it are kept separate, which responsibilities stay with the organisation, what the experimental implementation does not provide, and the situations in which the pattern would apply.
The problem
Auditors, partners and other reviewers often need specific information rather than everything, and often only for a period — the length of an audit, or the life of a joint piece of work. An organisation holding sensitive records then faces two poor options:
- Share everything. Handing over whole datasets exposes far more than the reviewer needs, and the extra exposure lasts as long as the copies do.
- Share nothing. Refusing to share blocks oversight and collaboration that the organisation may need or want.
The pattern described here sits between those options: sharing that is selective (only the data a reviewer needs), owner-controlled (the data owner decides) and time-limited (for a period, not indefinitely).
The intended outcome
Status of this section: Being explored — the design is being explored; its public interface and support are not settled.
- Owners decide who sees what. Data owners would decide who can see which data. A data owner is the party that provides or controls the data, such as an application or an organisation.
- Access for a period. An owner could give an auditor or partner access to specific data for a limited time — for example, for the duration of an audit. During that time the auditor or partner would be shown the selected data itself.
- Selected results rather than whole datasets. Selective disclosure of encrypted results to authorised parties is a design goal: an owner could share selected results rather than all of the underlying data. The step that would reveal encrypted results to authorised parties is only simulated in the experimental implementation.
Time-limited access and selective disclosure are separate intended controls. Both would be the data owner’s choice, and neither is available today. How access control and disclosure would be enforced is not described in this documentation.
Seeing versus acting
Status of this section: Being explored — nothing enforces it.
An organisation sharing data has to answer two separate questions: who may see data, and who may act — approve an action, transfer funds or change settings. The design is being explored so that who may see data is controlled separately from who may act on it.
- Granting an auditor visibility of selected data would not grant any authority to act.
- Likewise, authority to approve actions would not by itself imply visibility of all data.
The separation matters because the two needs rarely coincide. A reviewer usually needs to see records without being able to change anything, while a person who approves actions may not need to see every record that the organisation holds. Keeping the two apart is intended to let each be granted on its own terms.
Approval authority is explained on Approving actions: authority and multi-party approval. Visibility is explained on Visibility controls and selective disclosure.
Parties and responsibilities
- Data owner. Decides what to share, with whom and for how long, and reviews access over time — for example, confirming at the end of an audit that the access granted for it is no longer needed.
- Auditor or partner. Would be shown the data they were granted, for the period they were granted it. They would remain responsible for how they handle what they have seen, under their own obligations and their agreements with the data owner.
- Application developer. Would present sharing choices to data owners within the application, so that an owner can see what is being shared, with whom and until when. No interface for sharing choices exists yet.
- Organisation. Remains responsible for its own legal and contractual obligations when it shares data. What is and is not claimed about compliance is set out on Compliance position and data-protection intent.
What exists today
Status of this section: Being explored; the reveal step is simulated in the experimental implementation.
- The experimental implementation provides no encrypted or access-controlled data.
- The step that would reveal encrypted results to authorised parties is only simulated.
- No interface exists for granting, limiting or withdrawing access, so no auditor or partner can be given scoped access today.
- Nothing in the experimental implementation should be used with real or sensitive data.
Scenarios where the pattern would apply
Each scenario describes a need, not a design. None can be set up today.
- External audit. An external auditor reviews a defined set of records for an audit period. The data owner would choose the records in scope and the period; the auditor would be shown those records during the audit, and access would be intended to end with it.
- Business partner. A partner in a shared process sees only the results relevant to that process — for example, the outcome of a calculation that affects them — rather than all of the records behind it.
- Internal reviewer. A reviewer inside the organisation, such as a quality or risk function, sees a subset of records without gaining any authority to approve or change anything.
In each case, the questions to answer first are the same: which data the reviewer genuinely needs, for how long, and who in the organisation would decide and keep that decision under review. Those answers do not depend on details that are still unsettled.
Assumptions, trust and limitations
- Access means being shown data. In this pattern, access means being shown the selected data for the granted period.
- Shown data cannot be un-shown. Once data has been shown, it cannot be un-shown. Time limits would govern future access, not copies already made, and anyone who has been shown data could keep a copy.
- Enforcement is not described. How access would be enforced is not described, and the experimental implementation enforces none.
- Activity remains observable. Some information about activity would remain observable regardless of sharing choices; see What remains observable.
- Trust. Sharing controls would rest on assumptions about participants that are not yet described in detail; Trust assumptions and responsibilities by participant describes trust in qualitative terms.
Not yet available, and how this page will grow
Further technical reference is not yet available. Once the underlying capabilities are released, this page would link to versioned reference for visibility controls and disclosure, and would show, in labelled illustrative examples, how sharing choices would appear in applications. Approved public references would be listed once approved; none are listed yet.
What this page does not claim
This page does not claim:
- that any sharing control exists or is enforced today;
- how access would be granted, limited, enforced or ended, or how disclosure would work;
- that any auditor, partner or other party can be given access today;
- any legal, regulatory or compliance assurance.
Anything not stated here as available should be treated as unavailable.
Related pages
- Visibility controls and selective disclosure — the capability behind owner-controlled visibility.
- Audit trails and tamper-evident logging — intended records of actions and their status.
- Compliance position and data-protection intent — what is and is not claimed about compliance.
- What remains observable — information that stays visible regardless of sharing choices.
- Approving actions: authority and multi-party approval — the “acting” side of seeing versus acting.
- Processing sensitive data with verifiable results — the pattern that produces the results being shared.
Glossary
References
No approved public references yet.
