QAEDA-TST-003 · design constraint

Test the least-restrictive means

Can the same safety objective be achieved with less restriction on lawful inquiry, privacy, identity, speech, access, or user agency?

Pass condition

What a defensible proposal should be able to show.

The proposal compares meaningful alternatives and explains why warnings, user controls, friction, rate limits, sandboxing, local classifiers, anonymous credentials, targeted warrants, or narrower capability controls would not adequately address the harm.

Warning signs

Signals that the proposal is drifting.

  • A broad ban is proposed before narrower controls are tested.
  • Administrative convenience is treated as necessity.
  • The proposal centralizes identity or inquiry data even though the safety function does not require it.
  • The burden falls on all users to prevent abuse by a small subset.

Evidence to demand

What should exist before confidence rises.

  • Comparative testing of at least one materially less restrictive alternative.
  • Expected harm reduction and error costs for each alternative.
  • Operational explanation of why the broader mechanism adds necessary marginal benefit.
Failure mode

Without comparative design review, exceptional controls become defaults because they are easier to administer, not because they are necessary.

Decision discipline

No single passing test licenses the intervention.

Apply the full sequence. A defined harm does not excuse a weak nexus; a narrow mechanism does not excuse secret secondary use; an appeal process does not prove efficacy.