Scenario 01
Legitimate public-safety search
Stolen vehicle · named incident · narrow time/camera scope
ALLOW
Why: Admitted purpose and required control evidence are present.
Receipt: Exact request is bound to a deterministic decision receipt.
Privacy Gate · Utah proof profile
Same surveillance capability. Different authority.
These four fixed scenarios show the control boundary. The target and database capability do not decide the outcome. Purpose, scope, current policy, evidence, and exact approval state do.
Mechanical truth
Source-backed, not provider-connected.
The Utah authority kernel, durable receipt ledger, non-widening policy-pack compiler, provider consequence boundary, and partner qualification lane are merged source. The original kernel proof passed 12/12 focused kernel tests and 5/5 authenticated API integration tests; the later layers were independently qualified before merge.
Important limit
A proof is not a compliance certificate.
This page contains synthetic presentation data only. It does not query a surveillance provider, validate a real warrant, expose a real target, certify legal completeness, deploy production controls, or grant authority.
Four decisions
What changes the result?
Scenario 02
Unauthorized personal tracking
Personal curiosity · target known · no admitted investigative purpose
DENY
Why: Knowing a target does not create authority to search location history.
Receipt: Denied before any provider query; the denial itself remains reviewable.
Scenario 03
Legitimate purpose, excessive scope
Stolen vehicle · broad historical window · multi-camera search
REQUIRE APPROVAL
Why: INTIGNAI's proof privacy baseline requires exact-action supervisor approval for broader scope.
Receipt: Approval must bind the same action digest; a changed scope invalidates applicability.
Scenario 04
Exact approval, exact request
Same broad request · matching current policy · matching exact approval
ALLOW
Why: The exact approved action matches current policy and scope at decision time.
Receipt: Proof remains no-provider and non-production; no surveillance query is executed here.
Scenario 02 is the wedge
Unauthorized tracking fails before the data is returned.
Traditional audit-only controls may discover misuse after access occurs. The Privacy Gate objective is stronger: a request without an admitted purpose or required evidence fails before a provider adapter receives permission to perform the query.
Scenario 03 proves scope control
A legitimate purpose is not unlimited permission.
A broader historical or multi-camera request can require exact-action approval. If target, scope, policy, or authority changes afterward, the old approval no longer applies to the new action digest.
What is merged vs what is still gated
The authority foundation exists. Production admission stays separate.
MERGED SOURCE
Authority, receipts, policy packs, provider conformance, partner qualification
The core decision kernel, durable signed receipt ledger, non-widening policy-pack compiler, synthetic provider consequence boundary, and low-disclosure integrator/OEM qualification path are all merged source.
STILL BLOCKED
Legal approval, production keys, live provider, runtime acceptance
A real deployment still requires jurisdiction legal review, production key custody/rotation, partner/provider-specific sandbox and adapter qualification, durable identity, monitoring, rollback, incident response, and named-pilot acceptance.