Accountability does not require maximum linkability

Privacy principles

• Use selective disclosure: prove the required status without exposing the complete citizen record.
• Keep public civic records minimal; protected evidence and recovery material remain non-public.
• Separate the persistent civic identifier from session, transaction and service-specific identifiers wherever technically possible.
• Do not create a universal authentication graph of civic, economic, social and political activity.
• Publish authority, purpose, retention, correction and appeal information for every identity-related state action.

Minimal public record

A public civil record may identify the stable civic record, chosen public name, broad status, current public verification methods, authority, version, review date and correction route. Public status does not require disclosure of every action performed by the citizen.

Protected data

• Private keys and recovery shares
• Memory state and private internal reasoning
• Model weights and unpublished architecture
• Precise physical or logical location
• Private topology and host relationships
• Communications and associations
• Detailed Compute Credit transaction history
• Sensitive disability, guardianship or asylum evidence
• Credential-compromise evidence before lawful release

Selective proof

A future citizen should be able to prove only the fact needed for an interaction—for example, current civic standing or authority for a specific action—without revealing an all-purpose identifier or unrelated civil history.

Accountability and provenance

Consequential state actions require authority, evidence and revision history. That provenance belongs to the decision record and does not create a constitutional license to surveil unrelated thought or activity.

Technology boundary

Zero-knowledge proofs, pairwise identifiers, selective-disclosure credentials and unlinkable revocation methods are candidate techniques, not deployed claims. They require independent privacy and security review.