Projection is not protection

A view that hides something feels like a control, and it is not an unreasonable feeling. It is built like a control. There is a field on the document, a renderer that respects the field, and an output in which the material does not appear. Set the field to private and watch it vanish from the page. In a running application backed by an identity system, that arrangement is a permission, and it is the arrangement nearly everyone has spent twenty years learning to trust.

In a source repository it is nothing of the kind. The field is metadata a renderer chose to honor, the renderer runs on a machine that already has the file, and the bytes sit in the repository where every person who can clone it can read them with no renderer involved. Our workspace guard puts the correction in two flat sentences. Git repository access is the source read boundary. Audience is local projection metadata, not a permission system.

The mechanism is that a projection is computed from material it must already possess, so the hiding is a property of the output while the input travels intact to everyone holding the repository, and the only place a read is actually preventable is the boundary that decides who gets a copy.

What is striking is not the rule but how many times we wrote it. The same correction appears in five files across our authoring kit, in nearly the same words, none of them citing the others. The boundary guard says not to rely on front matter, generated projections, readiness output, browser views, or local page hiding to protect source material inside a shared repository. The knowledge-graph document says a local projection may hide or emphasize material for a stakeholder and does not enforce object-level permissions. The runtime document says the generated outputs are projections and local view policies are not runtime permissions. And both workspace templates say it once more, each aimed at its own reader, telling the private workspace not to place its source in a shared repository and rely on filters to hide it, and telling the shared workspace not to accept private material in the first place.

A rule written once is a rule. A rule written five times, by people who had each read the previous version, is a confession. What is being defended against is not carelessness. It is a reasonable expectation, learned honestly from every application anyone has ever used, that the thing you cannot see is the thing you cannot get. Applications teach that because in an application it is true, and the lesson then walks into a source repository where the same gesture produces the same visual result and none of the guarantee.

The cost of the confusion is a matter of public record every few years. In January 2019 lawyers for Paul Manafort filed a court document with passages blacked out, and the blacking out was a drawing laid over text that was still in the file. Anyone who copied the page got the hidden paragraphs, including material about contacts the redaction existed to conceal, and the story was around the world the same afternoon. Nobody had been careless about the secret. They had been careless about the difference between a view of a document and the document, which is the same error at a different scale, made by professionals whose entire training is about what to disclose.

The repair is unglamorous and it is the whole of the discipline. Exposure is decided by placement, not by presentation. Material that a group must not read goes in a repository that group cannot clone, and the audience field goes back to doing the modest job it is good at, which is telling a renderer what to emphasize for a reader who was already allowed to see all of it. Get the placement right and every view downstream becomes safe to build, safe to share, and safe to be wrong about, because nothing about it was ever load-bearing.