{
  "schema": "org-writing@v1",
  "slug": "projection-is-not-protection",
  "kg": {
    "id": "org:writing:projection-is-not-protection",
    "type": "brick",
    "graph": "/kg.json"
  },
  "title": "Projection is not protection",
  "subtitle": "The only real read boundary is which repository the bytes live in",
  "abstract": "Why audience metadata, filtered views, and hidden panels protect nothing, and what five near-identical warnings in our own tooling reveal about how badly people want them to. The canonical treatment of the projection boundary.",
  "kind": "brick",
  "topics": [
    "Boundaries"
  ],
  "courseMemberships": [
    {
      "course": "org:courses:boundary",
      "topic": "Boundaries",
      "wall": "org:walls:engineering",
      "position": 1,
      "total": 5
    }
  ],
  "publishedAt": "2026-08-03T00:00:00.000Z",
  "version": 1,
  "guidelinesVersion": 15,
  "brief": {
    "problem": {
      "text": "Audience fields, filtered views, and hidden panels look like access controls and are built like them, so material gets placed in a shared repository on the strength of a setting that decides nothing about who holds the file.",
      "claims": [
        "local projection metadata rather than a permission system"
      ]
    },
    "mechanism": {
      "text": "A projection is computed from material it must already possess, so hiding is a property of the output while the input travels intact to everyone with the repository, and the only place a read can be prevented is the boundary deciding who gets a copy.",
      "claims": [
        "local view policies are not runtime permissions"
      ]
    },
    "move": {
      "text": "Decide exposure by placement. If material must not be read by a group, it goes in a repository that group cannot clone, and no view, flag, or filter is accepted as a substitute for that.",
      "claims": []
    }
  },
  "sources": [
    {
      "repo": "mnstry-atelier",
      "path": "docs/repo-boundary-guard.md"
    },
    {
      "repo": "mnstry-atelier",
      "path": "docs/knowledge-graph.md"
    },
    {
      "repo": "mnstry-atelier",
      "path": "docs/atelier-runtime.md"
    },
    {
      "repo": "mnstry-atelier",
      "path": "templates/private-domain-workspace/README.md"
    },
    {
      "repo": "mnstry-atelier",
      "path": "templates/shared-project-workspace/README.md"
    }
  ],
  "canonicalPath": "/writing/projection-is-not-protection/",
  "body": "A view that hides something feels like a control, and it is not an unreasonable feeling. It is built like a control. There is a field on the document, a renderer that respects the field, and an output in which the material does not appear. Set the field to private and watch it vanish from the page. In a running application backed by an identity system, that arrangement is a permission, and it is the arrangement nearly everyone has spent twenty years learning to trust.\n\nIn a source repository it is nothing of the kind. The field is metadata a renderer chose to honor, the renderer runs on a machine that already has the file, and the bytes sit in the repository where every person who can clone it can read them with no renderer involved. Our workspace guard puts the correction in two flat sentences. Git repository access is the source read boundary. Audience is local projection metadata, not a permission system.\n\nThe mechanism is that a projection is computed from material it must already possess, so the hiding is a property of the output while the input travels intact to everyone holding the repository, and the only place a read is actually preventable is the boundary that decides who gets a copy.\n\nWhat is striking is not the rule but how many times we wrote it. The same correction appears in five files across our authoring kit, in nearly the same words, none of them citing the others. The boundary guard says not to rely on front matter, generated projections, readiness output, browser views, or local page hiding to protect source material inside a shared repository. The knowledge-graph document says a local projection may hide or emphasize material for a stakeholder and does not enforce object-level permissions. The runtime document says the generated outputs are projections and local view policies are not runtime permissions. And both workspace templates say it once more, each aimed at its own reader, telling the private workspace not to place its source in a shared repository and rely on filters to hide it, and telling the shared workspace not to accept private material in the first place.\n\nA rule written once is a rule. A rule written five times, by people who had each read the previous version, is a confession. What is being defended against is not carelessness. It is a reasonable expectation, learned honestly from every application anyone has ever used, that the thing you cannot see is the thing you cannot get. Applications teach that because in an application it is true, and the lesson then walks into a source repository where the same gesture produces the same visual result and none of the guarantee.\n\nThe cost of the confusion is a matter of public record every few years. In January 2019 lawyers for Paul Manafort filed a court document with passages blacked out, and the blacking out was a drawing laid over text that was still in the file. Anyone who copied the page got the hidden paragraphs, including material about contacts the redaction existed to conceal, and the story was around the world the same afternoon. Nobody had been careless about the secret. They had been careless about the difference between a view of a document and the document, which is the same error at a different scale, made by professionals whose entire training is about what to disclose.\n\nThe repair is unglamorous and it is the whole of the discipline. Exposure is decided by placement, not by presentation. Material that a group must not read goes in a repository that group cannot clone, and the audience field goes back to doing the modest job it is good at, which is telling a renderer what to emphasize for a reader who was already allowed to see all of it. Get the placement right and every view downstream becomes safe to build, safe to share, and safe to be wrong about, because nothing about it was ever load-bearing.",
  "apparatus": {
    "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.",
    "references": [
      {
        "id": "org:references:projection-is-not-protection:r01",
        "author": "MNSTRY Atelier",
        "work": "Repo Boundary Guard V1, the boundary model",
        "year": 2026,
        "relevance": "The primary artifact and the flattest statement of the rule. Git repository access is the source read boundary, audience is local projection metadata rather than a permission system, and the document names the five surfaces that must not be relied on to hide anything."
      },
      {
        "id": "org:references:projection-is-not-protection:r02",
        "author": "MNSTRY Atelier",
        "work": "The knowledge-graph document, projection rules",
        "year": 2026,
        "relevance": "The second restatement, aimed at graph projections specifically. A local projection may hide or emphasize for a stakeholder and does not enforce object-level permissions."
      },
      {
        "id": "org:references:projection-is-not-protection:r03",
        "author": "MNSTRY Atelier",
        "work": "The runtime document, local authority",
        "year": 2026,
        "relevance": "The third restatement, aimed at generated outputs. Local files plus Git are the source authority, everything generated is a projection, and local view policies are not runtime permissions."
      },
      {
        "id": "org:references:projection-is-not-protection:r04",
        "author": "MNSTRY Atelier",
        "work": "The private-domain and shared-project workspace templates",
        "year": 2026,
        "relevance": "The fourth and fifth restatements, one addressed to each side of the boundary, telling the private workspace not to rely on projection filters and the shared workspace not to accept the material at all."
      },
      {
        "id": "org:references:projection-is-not-protection:r05",
        "author": "Public court record, United States District Court for the District of Columbia",
        "work": "The January 2019 filing by counsel for Paul Manafort, whose applied redactions were removable from the underlying text",
        "year": 2019,
        "relevance": "The external anchor. A professionally prepared document in which the view hid the passages and the file shipped them, which is the brick's mechanism in its most public form."
      }
    ],
    "claims": [
      {
        "id": "org:claims:projection-is-not-protection:c01",
        "claim": "The Atelier boundary guard states that Git repository access is the source read boundary and that kg.audience is local projection metadata rather than a permission system, and instructs that front matter, generated projections, readiness output, browser views, and local page hiding are not to be relied on to protect source material inside a shared repository.",
        "basis": "The boundary model and guard rules sections read directly on 2026-08-03; both sentences are the document's own wording.",
        "confidence": "verified",
        "sources": []
      },
      {
        "id": "org:claims:projection-is-not-protection:c02",
        "claim": "Atelier's runtime document states that generated JSON, HTML, SQLite, API, and support-bundle outputs are projections and that local view policies are not runtime permissions.",
        "basis": "The local authority section read directly on 2026-08-03.",
        "confidence": "verified",
        "sources": []
      },
      {
        "id": "org:claims:projection-is-not-protection:c03",
        "claim": "The Atelier knowledge-graph document states that a local projection may hide or emphasize material for a stakeholder but does not enforce object-level permissions, and that enforcement requires Git repository access locally or runtime permissions after import.",
        "basis": "The projection rules section read directly on 2026-08-03.",
        "confidence": "verified",
        "sources": []
      },
      {
        "id": "org:claims:projection-is-not-protection:c04",
        "claim": "The rule that a projection is not a permission appears in five files across the Atelier kit, the boundary guard, the knowledge-graph document, the runtime document, and both workspace template readmes, in near-identical wording, and none of them cites the others.",
        "basis": "A read of all five files on 2026-08-03. The count is exact; the absence of cross-citation is established over those five files only, and the near-identity is an editorial judgement about wording rather than a textual diff.",
        "confidence": "directional",
        "sources": []
      },
      {
        "id": "org:claims:projection-is-not-protection:c05",
        "claim": "In January 2019 a court filing by Paul Manafort's legal team carried redactions that could be removed by copying the underlying text, disclosing the material the redaction had been applied to conceal.",
        "basis": "Contemporaneous reporting and the public court record; the failure was widely documented within hours of filing and is not disputed.",
        "confidence": "verified",
        "sources": []
      }
    ],
    "concepts": [
      {
        "id": "org:concepts:projection-is-not-protection",
        "name": "Projection is not protection",
        "definition": "A view computed from material must already possess that material, so hiding is a property of the output while the input travels intact to everyone holding the source. Audience fields, filtered projections, readiness reports, and hidden panels are presentation, and the only enforceable read boundary over source is which repository the bytes live in. The confusion is a reasonable transfer from application software, where a hidden thing sits behind an identity system and genuinely cannot be fetched; the same gesture in a source repository produces the same visual result and none of the guarantee.",
        "provenance": "canonical"
      }
    ],
    "researchContext": "Sourced entirely from the Atelier kit's own documentation plus one item of\npublic court record. No client or tenant material is involved. The source\nlist names document paths inside our own authoring kit, which carry no\ntenant identity, and no commit or branch identifier appears anywhere.\n\nThe brick's contribution is the meta-observation rather than the rule. The\nrule is well known and correctly stated in five places; what the corpus adds\nis reading the fivefold repetition as evidence about the strength of the\ninstinct being corrected, and naming that instinct as a reasonable transfer\nfrom application software rather than as carelessness. That reframing is what\nkeeps the piece from being a scolding.\n\nGrading note: the count claim is directional despite the count itself being\nexact, because two of its three components are judgements. Near-identical\nwording is an editorial reading, and the absence of cross-citation was\nestablished across those five files rather than across the kit's full history.\nThe argument does not weaken if one document turns out to have been copied\nfrom another; it weakens only if the rule was never repeated, and it was.\n\nBoundary with the parent essay: \"Structural, not behavioral\" argues that\nguarantees resting on shape beat guarantees resting on promises. A hidden view\nis the purest example of a guarantee that is neither, since it is not even a\npromise about behavior, only a fact about rendering that reads as a promise."
  },
  "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json",
  "releaseHash": "6a732df8f7bdae45b33a2d5b1350202f8306fc3b71c29c260045c242a1e76e52",
  "versions": [
    {
      "version": 1,
      "cutAt": "2026-08-03",
      "note": "Initial publication, boundary wave",
      "visibility": "published",
      "path": "/writing/projection-is-not-protection/",
      "contentHash": "sha256:2156aca1d210c286",
      "releaseHash": "6a732df8f7bdae45b33a2d5b1350202f8306fc3b71c29c260045c242a1e76e52"
    }
  ]
}