Separating Disclosure from Authorization: Field-Tier Minimization for Agent Action Mediation
A leakage analysis of each projection is given, an incident in which a first-cut projection preserved the identifier it was written to remove is reported, and the residual trust the design does not eliminate is given.