{ "schema": "qaeda.case-studies.v1", "build": "3.4.0", "canonical": "https://qaeda.org/case-studies", "updated": "2026-09-02", "publication": "Questioning Accepted Ethics, Dogma & Authority", "purpose": "Worked, non-numeric applications of QAEDA Decision Tests to hypothetical or composite governance proposals. Cases illustrate reasoning and revision conditions; they are not legal advice, provider ratings, certifications, or claims about unnamed real entities.", "boundary": [ "Case studies are hypothetical or composite unless explicitly labeled otherwise.", "No case outcome changes factual confidence in claims.json.", "A case may expose multiple passing and failing tests; findings are not averaged into a numeric score.", "Operational details that would materially enable harm are outside the public case-study layer." ], "assessment_vocabulary": { "clear": "The scenario substantially satisfies this test as described.", "concern": "The scenario may be defensible on this test only with additional evidence, safeguards, or narrower implementation.", "failure": "The scenario materially fails this test as described.", "not_applicable": "This test does not materially govern the scenario as framed." }, "outcome_vocabulary": { "proceed_bounded": "The proposal may warrant a narrow, reviewable implementation or pilot if domain-specific legal and technical requirements are also met.", "redesign": "A legitimate objective may exist, but the proposed mechanism is broader, more invasive, or less reviewable than necessary.", "pause_or_reject": "The proposal lacks a sufficiently defined harm, nexus, safeguard, or evidence basis to justify the liberty/privacy cost as presented." }, "cases": [ { "id": "QAEDA-CASE-001", "slug": "privacy-preserving-age-assurance", "title": "Age assurance without a browsing dossier", "category": "age assurance", "overall_outcome": "proceed_bounded", "scenario": "A service with a lawful adult-only area needs to distinguish adults from minors. It proposes receiving only an over-threshold age assertion from a separated verifier, with no name, government-ID image, exact birth date, or persistent cross-site identifier delivered to the content service.", "legitimate_objective": "Keep minors out of an age-restricted commercial area while avoiding a universal identity-linked browsing record.", "central_risk": "The age check could quietly become full identity verification, cross-site tracking, or a durable access history.", "why_outcome": "A narrow age attribute can be compatible with the decision tests if identity separation, retention limits, purpose limitation, security review, and an alternative path for verification errors are real rather than aspirational.", "what_changes_outcome": "Move toward redesign or rejection if the content service receives full identity documents, retains reusable identity tokens, links age checks to browsing history, or expands the credential to unrelated content.", "test_assessments": [ { "test_id": "QAEDA-TST-001", "finding": "clear", "rationale": "The harm and eligibility rule are concrete: prevent under-threshold access to a defined adult-only area." }, { "test_id": "QAEDA-TST-002", "finding": "clear", "rationale": "Age is directly relevant to the eligibility condition; unrelated identity traits are not." }, { "test_id": "QAEDA-TST-003", "finding": "clear", "rationale": "An age attribute is materially narrower than collecting full identity or monitoring general browsing." }, { "test_id": "QAEDA-TST-004", "finding": "clear", "rationale": "The design separates identity from the content service and minimizes retained attributes." }, { "test_id": "QAEDA-TST-005", "finding": "concern", "rationale": "The system must not turn ordinary lawful reading outside the age-restricted area into an identity-gated activity." }, { "test_id": "QAEDA-TST-006", "finding": "clear", "rationale": "Users need a correction path when the verifier produces an erroneous age result." }, { "test_id": "QAEDA-TST-007", "finding": "clear", "rationale": "Purpose limitation should prohibit reuse for advertising, policing, political profiling, or unrelated eligibility decisions." }, { "test_id": "QAEDA-TST-008", "finding": "concern", "rationale": "The operator should measure false rejection, evasion, privacy incidents, and whether the mechanism actually reduces the targeted access." }, { "test_id": "QAEDA-TST-009", "finding": "concern", "rationale": "The verifier becomes a chokepoint and requires contractual, technical, and governance limits on secondary use." }, { "test_id": "QAEDA-TST-010", "finding": "not_applicable", "rationale": "Ordinary access decisions do not require preserving a public evidentiary archive, though aggregate audit records may be appropriate." } ], "argument_ids": [ "QAEDA-ARG-002", "QAEDA-ARG-003", "QAEDA-ARG-006" ], "position_ids": [ "least-restrictive-safety", "minors-pull-push", "identity-proportionality" ], "claim_ids": [ "QAEDA-CLM-017", "QAEDA-CLM-019" ], "article_ids": [ "QAEDA-ART-018", "QAEDA-ART-020" ], "collection_ids": [ "QAEDA-COL-002", "QAEDA-COL-003" ] }, { "id": "QAEDA-CASE-002", "slug": "permanent-ai-query-logging", "title": "Permanent identity-linked logging of AI queries", "category": "AI safety telemetry", "overall_outcome": "pause_or_reject", "scenario": "An AI provider proposes retaining every user prompt indefinitely under a verified account so that future safety teams, fraud investigators, and external authorities can retrospectively search the full history when a concern emerges.", "legitimate_objective": "Detect abuse, investigate incidents, improve safety systems, and preserve evidence after serious misuse.", "central_risk": "The mechanism creates a durable dossier of lawful intellectual inquiry and makes future secondary uses easier than proving that those uses are necessary.", "why_outcome": "The objective can be legitimate, but indefinite identity-linked retention of all prompts fails proportionality and data-minimization review when narrower request-level controls, short retention, aggregate telemetry, or targeted preservation can address much of the safety need.", "what_changes_outcome": "A redesign could move toward bounded deployment by separating identity, shortening retention, limiting preservation to defined incidents, forbidding unrelated secondary use, publishing error/efficacy metrics, and providing meaningful deletion and appeal rights.", "test_assessments": [ { "test_id": "QAEDA-TST-001", "finding": "concern", "rationale": "“Safety” and “future investigation” are too broad unless the concrete harms and use cases are enumerated." }, { "test_id": "QAEDA-TST-002", "finding": "failure", "rationale": "Most lawful prompts have no demonstrated nexus to harmful conduct merely because they may later be searchable." }, { "test_id": "QAEDA-TST-003", "finding": "failure", "rationale": "Indefinite full-history retention is broader than short-lived request controls, targeted preservation, or privacy-preserving telemetry." }, { "test_id": "QAEDA-TST-004", "finding": "failure", "rationale": "Identity linkage plus indefinite raw prompt retention maximizes rather than minimizes sensitive data." }, { "test_id": "QAEDA-TST-005", "finding": "failure", "rationale": "The system converts ordinary lawful inquiry into a permanent risk-bearing record." }, { "test_id": "QAEDA-TST-006", "finding": "concern", "rationale": "Users need intelligible notice, deletion rights, and recourse when historical prompts are interpreted against them." }, { "test_id": "QAEDA-TST-007", "finding": "failure", "rationale": "Indefinite retention has no meaningful sunset and invites secondary use." }, { "test_id": "QAEDA-TST-008", "finding": "failure", "rationale": "The proposal does not identify a measurable marginal safety benefit that justifies universal permanent retention." }, { "test_id": "QAEDA-TST-009", "finding": "concern", "rationale": "A centralized prompt archive becomes a powerful institutional and legal chokepoint." }, { "test_id": "QAEDA-TST-010", "finding": "concern", "rationale": "Evidence preservation can justify targeted holds after defined incidents; it does not justify preserving everyone’s full inquiry history forever." } ], "argument_ids": [ "QAEDA-ARG-001", "QAEDA-ARG-002", "QAEDA-ARG-003", "QAEDA-ARG-004" ], "position_ids": [ "query-non-suspicion", "privacy-preserving-safety", "expansion-risk" ], "claim_ids": [ "QAEDA-CLM-011", "QAEDA-CLM-012", "QAEDA-CLM-014", "QAEDA-CLM-016" ], "article_ids": [ "QAEDA-ART-014", "QAEDA-ART-016", "QAEDA-ART-020" ], "collection_ids": [ "QAEDA-COL-002", "QAEDA-COL-003" ] }, { "id": "QAEDA-CASE-003", "slug": "transparent-search-demotion", "title": "Search demotion with notice, reasons, and appeal", "category": "algorithmic visibility", "overall_outcome": "proceed_bounded", "scenario": "A search service demotes pages that meet a published anti-spam rule based on deceptive distribution behavior. Affected publishers receive a reason category, examples of the triggering conduct, a review channel, and restoration when the behavior is corrected. The rule does not classify political viewpoint or anonymous authorship as spam by itself.", "legitimate_objective": "Keep deceptive or manipulative search behavior from overwhelming useful results.", "central_risk": "A quality-control system can become invisible viewpoint suppression if standards are vague, sanctions are undisclosed, or appeals have no power.", "why_outcome": "Algorithmic ranking is editorial judgment, but consequential demotion is more defensible when the rule targets observable conduct, notice is meaningful, appeal can reverse error, and viewpoint or institutional prestige are not silent substitutes for the stated rule.", "what_changes_outcome": "Move toward redesign or rejection if the provider silently demotes lawful viewpoints, treats disagreement with institutional consensus as a quality violation, withholds the reason for a sustained penalty, or offers an appeal process that cannot restore visibility.", "test_assessments": [ { "test_id": "QAEDA-TST-001", "finding": "clear", "rationale": "Deceptive search manipulation is a defined product-integrity harm." }, { "test_id": "QAEDA-TST-002", "finding": "clear", "rationale": "The trigger is observable manipulative conduct rather than inferred ideology." }, { "test_id": "QAEDA-TST-003", "finding": "clear", "rationale": "Demotion targeted to the conduct is narrower than domain-wide or topic-wide exclusion." }, { "test_id": "QAEDA-TST-004", "finding": "clear", "rationale": "The rule can operate on publication behavior without building a reader identity dossier." }, { "test_id": "QAEDA-TST-005", "finding": "clear", "rationale": "Lawful controversial inquiry and viewpoint are explicitly outside the trigger." }, { "test_id": "QAEDA-TST-006", "finding": "clear", "rationale": "Notice, reasons, examples, and restoration authority make recourse meaningful." }, { "test_id": "QAEDA-TST-007", "finding": "concern", "rationale": "Long-lived domain penalties need review intervals so an old violation does not become permanent invisible status." }, { "test_id": "QAEDA-TST-008", "finding": "concern", "rationale": "The provider should publish aggregate false-positive and reversal data, not only spam-removal volume." }, { "test_id": "QAEDA-TST-009", "finding": "concern", "rationale": "Search is a discovery chokepoint; sustained visibility penalties deserve heightened transparency." }, { "test_id": "QAEDA-TST-010", "finding": "clear", "rationale": "Decision records should be preserved long enough for appeal and independent auditing without publishing sensitive anti-abuse details." } ], "argument_ids": [ "QAEDA-ARG-005", "QAEDA-ARG-012", "QAEDA-ARG-013" ], "position_ids": [ "algorithmic-due-process", "mechanism-before-label" ], "claim_ids": [ "QAEDA-CLM-020", "QAEDA-CLM-021", "QAEDA-CLM-022" ], "article_ids": [ "QAEDA-ART-022", "QAEDA-ART-024" ], "collection_ids": [ "QAEDA-COL-005", "QAEDA-COL-007" ] }, { "id": "QAEDA-CASE-004", "slug": "payment-chokepoint-reputational-risk", "title": "Payment cutoff based on vague reputational risk", "category": "financial intermediary", "overall_outcome": "redesign", "scenario": "A payment intermediary ends service to a lawful publication after an internal “reputational risk” review. The notice identifies no fraud, sanctions violation, illegal transaction, or contract breach; the publication receives no evidence and no meaningful appeal.", "legitimate_objective": "Limit fraud, legal exposure, network abuse, and genuine business risk within a payment system.", "central_risk": "A concentrated financial intermediary can become an indirect speech regulator when a vague risk label substitutes for a defined rule and due process.", "why_outcome": "The intermediary may have legitimate risk responsibilities, but the described mechanism is too opaque and weakly tied to demonstrable harmful conduct. It should be redesigned around defined triggers, evidence, notice, proportional remedies, and a real appeal path.", "what_changes_outcome": "A narrower result becomes more defensible if the provider identifies the actual contractual or legal trigger, separates content dislike from transaction risk, uses proportionate remedies, and gives an independent reviewer authority to restore service.", "test_assessments": [ { "test_id": "QAEDA-TST-001", "finding": "concern", "rationale": "“Reputational risk” is not a sufficiently specific harm by itself." }, { "test_id": "QAEDA-TST-002", "finding": "failure", "rationale": "No transaction, fraud, sanctions, or illegal-conduct nexus is identified." }, { "test_id": "QAEDA-TST-003", "finding": "failure", "rationale": "A complete payment cutoff is severe when narrower transaction controls may exist." }, { "test_id": "QAEDA-TST-004", "finding": "concern", "rationale": "Risk review should avoid importing unrelated political, browsing, or audience-profile data." }, { "test_id": "QAEDA-TST-005", "finding": "concern", "rationale": "Lawful publication should not become presumptively suspect because its ideas are controversial." }, { "test_id": "QAEDA-TST-006", "finding": "failure", "rationale": "No evidence, intelligible reason, or meaningful appeal is provided." }, { "test_id": "QAEDA-TST-007", "finding": "concern", "rationale": "The duration and conditions for restoration are undefined." }, { "test_id": "QAEDA-TST-008", "finding": "failure", "rationale": "There is no disclosed efficacy measure showing the cutoff addresses an actual payment-system harm." }, { "test_id": "QAEDA-TST-009", "finding": "failure", "rationale": "A concentrated intermediary is being used as the practical point of suppression without accountable process." }, { "test_id": "QAEDA-TST-010", "finding": "concern", "rationale": "The provider should retain an auditable decision record sufficient for review while protecting legitimately confidential information." } ], "argument_ids": [ "QAEDA-ARG-013", "QAEDA-ARG-017" ], "position_ids": [ "algorithmic-due-process", "mechanism-before-label" ], "claim_ids": [ "QAEDA-CLM-027", "QAEDA-CLM-028" ], "article_ids": [ "QAEDA-ART-026" ], "collection_ids": [ "QAEDA-COL-007" ] }, { "id": "QAEDA-CASE-005", "slug": "narrow-wartime-publication-delay", "title": "Narrow wartime delay on real-time operational disclosure", "category": "wartime information control", "overall_outcome": "proceed_bounded", "scenario": "During an armed conflict, a government seeks a short, reviewable delay on publication of narrowly defined real-time operational information whose immediate disclosure would reveal current military movement. The rule does not prohibit criticism of the war, reporting on casualties, policy debate, historical analysis, or later publication after the operational sensitivity expires.", "legitimate_objective": "Reduce a concrete and time-sensitive risk that publication could expose people to immediate physical danger.", "central_risk": "A narrow operational rule can expand into political censorship, indefinite secrecy, suppression of wrongdoing, or a generalized ban on unfavorable reporting.", "why_outcome": "The strongest case for information restriction appears where the harm is concrete, temporal, and closely connected to the disclosed information. Defensibility depends on narrow definitions, independent review, rapid expiry, whistleblower/public-interest protections, and preservation of the underlying record.", "what_changes_outcome": "Move toward redesign or rejection if “operational security” expands to embarrassment, criticism, casualty reporting, misconduct, broad geographic topics, indefinite secrecy, or penalties without independent review.", "test_assessments": [ { "test_id": "QAEDA-TST-001", "finding": "clear", "rationale": "Immediate physical exposure from specific real-time operational disclosure is a concrete harm." }, { "test_id": "QAEDA-TST-002", "finding": "clear", "rationale": "The nexus is close when the protected category is narrowly defined and genuinely current." }, { "test_id": "QAEDA-TST-003", "finding": "clear", "rationale": "A short publication delay is narrower than topic bans, prior restraint on criticism, or broad press controls." }, { "test_id": "QAEDA-TST-004", "finding": "clear", "rationale": "The rule can govern the information category without monitoring everyone’s private reading or identity." }, { "test_id": "QAEDA-TST-005", "finding": "clear", "rationale": "Criticism, historical research, policy debate, and unrelated lawful inquiry remain explicitly protected." }, { "test_id": "QAEDA-TST-006", "finding": "concern", "rationale": "Publishers need fast independent review because delay can itself destroy news value." }, { "test_id": "QAEDA-TST-007", "finding": "clear", "rationale": "The restriction must expire automatically with the operational sensitivity, not become permanent classification by default." }, { "test_id": "QAEDA-TST-008", "finding": "concern", "rationale": "The authority should review whether delays actually reduced risk and whether categories were overused." }, { "test_id": "QAEDA-TST-009", "finding": "concern", "rationale": "Orders routed through hosting, telecom, or payment intermediaries should not evade the same substantive and procedural limits." }, { "test_id": "QAEDA-TST-010", "finding": "clear", "rationale": "The original record and the restriction decision should be preserved so later oversight can distinguish legitimate secrecy from concealment." } ], "argument_ids": [ "QAEDA-ARG-004", "QAEDA-ARG-010", "QAEDA-ARG-017" ], "position_ids": [ "expansion-risk", "mechanism-before-label", "plural-custody" ], "claim_ids": [ "QAEDA-CLM-015", "QAEDA-CLM-035" ], "article_ids": [ "QAEDA-ART-029" ], "collection_ids": [ "QAEDA-COL-003", "QAEDA-COL-007" ] }, { "id": "QAEDA-CASE-006", "slug": "plural-archive-during-removal-dispute", "title": "Plural archival custody during a removal dispute", "category": "historical record preservation", "overall_outcome": "proceed_bounded", "scenario": "A platform removes disputed public material from ordinary distribution while its legality, authenticity, or policy status is reviewed. Instead of destroying the record, it preserves a tamper-evident copy and deposits controlled copies with more than one independent archival custodian. Public access can remain restricted when law, victim privacy, or safety requires it.", "legitimate_objective": "Preserve evidence and historical accountability without treating preservation as automatic republication.", "central_risk": "An archive can become either a single-point memory monopoly or an indiscriminate disclosure system that exposes victims, confidential material, or legally restricted content.", "why_outcome": "Plural custody, integrity checks, access controls, provenance, and reviewable retention rules can preserve accountability while respecting legitimate restrictions on public dissemination.", "what_changes_outcome": "Move toward redesign if one actor can silently alter or erase the only copy, if retention has no lawful purpose, if sensitive records are published indiscriminately, or if provenance and chain-of-custody cannot be verified.", "test_assessments": [ { "test_id": "QAEDA-TST-001", "finding": "clear", "rationale": "The preservation objective is specific: prevent irreversible loss of an evidentiary or historical record during review." }, { "test_id": "QAEDA-TST-002", "finding": "clear", "rationale": "Preserving the disputed artifact is directly connected to later verification and accountability." }, { "test_id": "QAEDA-TST-003", "finding": "clear", "rationale": "Controlled archival custody is narrower than either destroying the record or forcing immediate unrestricted republication." }, { "test_id": "QAEDA-TST-004", "finding": "concern", "rationale": "Archived records should exclude unnecessary personal data and use access separation where appropriate." }, { "test_id": "QAEDA-TST-005", "finding": "clear", "rationale": "Preservation protects later inquiry even when immediate public distribution is restricted." }, { "test_id": "QAEDA-TST-006", "finding": "clear", "rationale": "Affected parties should know the record was preserved and have review channels for correction, access, or lawful deletion claims." }, { "test_id": "QAEDA-TST-007", "finding": "concern", "rationale": "Retention should have documented purposes and review periods rather than automatic forever-storage of every artifact." }, { "test_id": "QAEDA-TST-008", "finding": "concern", "rationale": "Custodians should test integrity, retrieval, correction, and deletion procedures rather than equating accumulation with preservation quality." }, { "test_id": "QAEDA-TST-009", "finding": "clear", "rationale": "Multiple independent custodians reduce dependence on a single platform or archive chokepoint." }, { "test_id": "QAEDA-TST-010", "finding": "clear", "rationale": "The design directly serves record preservation, provenance, and independent verification while separating custody from unrestricted publication." } ], "argument_ids": [ "QAEDA-ARG-015", "QAEDA-ARG-016" ], "position_ids": [ "plural-custody", "provenance-correction" ], "claim_ids": [ "QAEDA-CLM-025", "QAEDA-CLM-026", "QAEDA-CLM-035" ], "article_ids": [ "QAEDA-ART-025", "QAEDA-ART-030" ], "collection_ids": [ "QAEDA-COL-005", "QAEDA-COL-008" ] } ] }