{ "schema": "org-writing@v1", "slug": "the-parameter-is-a-policy", "kg": { "id": "org:writing:the-parameter-is-a-policy", "type": "brick", "graph": "/kg.json" }, "title": "The parameter is a policy", "subtitle": "Some decisions are made once, numerically, by an engineer, and then govern everyone the system touches", "abstract": "How a privacy budget, a classification threshold, or a decay constant becomes an unreviewed ruling about people, and the disclosure that converts it back into a decision someone can be held to. The canonical treatment of a parameter as policy.", "kind": "brick", "topics": [ "Care" ], "courseMemberships": [ { "course": "org:courses:instruments-of-care", "topic": "Care", "wall": "org:walls:ethics", "position": 4, "total": 5 } ], "publishedAt": "2026-08-03T00:00:00.000Z", "version": 1, "guidelinesVersion": 15, "brief": { "problem": { "text": "A number set once in a configuration file can decide how much of one person's exposure buys how much of everyone else's accuracy, and it ships as a default that nobody subject to it can read.", "claims": [ "a privacy-loss budget of epsilon 19.61" ] }, "mechanism": { "text": "Epsilon fixes in a single value how much noise shields an individual record and therefore how much accuracy every user of the results gives up, so whoever picks it is ruling on a trade between two parties who are both absent.", "claims": [ "Epsilon bounds how much any single person's record can change" ] }, "move": { "text": "For any number that trades one group's interest against another's, write down who gains, who pays, who chose, and where the choice is recorded.", "claims": [] } }, "sources": [ { "repo": "mnstry-research", "path": "_restricted/spiritual-ai-relocation-2026-08-03/spiritual-03-privacy-ethics-framework.md" }, { "repo": "mnstry-org", "path": "editorial/notes/spiritual-corpus-review.md" } ], "canonicalPath": "/writing/the-parameter-is-a-policy/", "body": "Somewhere in a configuration file there is a number that decides how much of one person's exposure buys how much of everyone else's accuracy, and it was set once, by whoever was closest to the code. The received view is that this is tuning. Parameters are engineering detail, chosen by the people who understand the mathematics, adjusted when the output looks wrong, and not the sort of thing a governance conversation has any purchase on. For most parameters that is exactly right. For one class it is a category error, and the cleanest instance of that class is a Greek letter.\n\nOn June 9, 2021, the United States Census Bureau's Data Stewardship Executive Policy Committee announced the settings for the system protecting the 2020 census redistricting file, and the headline setting was a privacy-loss budget of epsilon equal to 19.61, split as 17.14 for the persons file and 2.47 for housing units. The committee had raised the figure after data users objected that the earlier demonstration products distorted counts for small places, tribal areas, and race and ethnicity statistics. Alabama had already sued in March to stop the method, and a three-judge court denied its request for a preliminary injunction on June 29 before the case was dropped that September. A number in a statistical pipeline had become a federal lawsuit, and nobody involved was confused about why.\n\nEpsilon is unusual only in making the trade explicit. In the formulation Cynthia Dwork, Frank McSherry, Kobbi Nissim and Adam Smith published in 2006, epsilon bounds how much any single person's record can change what the released statistics say, and the bound is purchased with noise. A smaller epsilon means more noise, a stronger guarantee for the individual, and worse numbers for everyone who uses the results to draw a district or fund a school. Whoever picks the value is therefore ruling on a trade between two parties' interests, both real and neither of them in the room, and the ruling arrives as a decimal rather than as a sentence somebody could disagree with.\n\nThat is the shape to look for elsewhere, because the same structure is everywhere and almost never labeled. A retention window is a ruling about whose past stays recoverable. A classification threshold is a ruling about how many false accusations buy how many catches, issued by whoever set the cutoff. A decay constant decides how long a judgment about a person keeps its force. Each is chosen once, numerically, and then governs everyone the system touches, and each looks from inside the codebase like a knob. Our corpus already has a position on constraints that nothing enforces and on the scope a claim quietly leaves out. This is a third thing and it is the opposite failure. The decision was genuinely made and is genuinely binding, and it was never written anywhere a person subject to it could read it.\n\nThe remedy has already been drafted by the people closest to the mathematics. Dwork, with Nitin Kohli and Deirdre Mulligan, argued in 2019 under a title that is itself the whole instruction, expose your epsilons, for a public registry of the values that real deployments actually use, on the grounds that a guarantee whose parameter is secret is not a guarantee anyone outside can evaluate. Generalize it past differential privacy and it becomes an ordinary disclosure test. For every number in a system that trades one group's interest against another's, name who gains, who pays, who chose, and where the choice is recorded. Most parameters fail the test by being boring, which is the point, because the handful that survive it were governing people all along, and a team that can name them out loud has turned an unreviewed default back into a decision it can be held to.", "apparatus": { "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.", "references": [ { "id": "org:references:the-parameter-is-a-policy:r01", "author": "Cynthia Dwork, Frank McSherry, Kobbi Nissim, Adam Smith", "work": "Calibrating Noise to Sensitivity in Private Data Analysis (Theory of Cryptography Conference)", "year": 2006, "relevance": "The origin of the epsilon formulation. Privacy is preserved by adding noise calibrated to a query's sensitivity, and epsilon is the parameter bounding how much any one record may influence the released answer." }, { "id": "org:references:the-parameter-is-a-policy:r02", "author": "United States Census Bureau, Data Stewardship Executive Policy Committee", "work": "Census Bureau Sets Key Parameters to Protect Privacy in 2020 Census Results", "year": 2021, "relevance": "The public parameter decision. A named committee set the privacy-loss budget for the redistricting file at epsilon 19.61, raising it from the demonstration level after data users objected to accuracy losses for small places, tribal areas, and race and ethnicity statistics." }, { "id": "org:references:the-parameter-is-a-policy:r03", "author": "State of Alabama and others v. United States Department of Commerce", "work": "Three-judge federal panel, Middle District of Alabama, challenge to the 2020 census disclosure avoidance system", "year": 2021, "relevance": "The litigation. Filed March 2021, preliminary injunction denied June 29, 2021, dismissed without prejudice in September 2021. Evidence that the parameter choice was contested as policy rather than as engineering." }, { "id": "org:references:the-parameter-is-a-policy:r04", "author": "Cynthia Dwork, Nitin Kohli, Deirdre Mulligan", "work": "Differential Privacy in Practice: Expose your Epsilons! (Journal of Privacy and Confidentiality 9(2))", "year": 2019, "relevance": "The remedy the brick generalizes. A proposed public Epsilon Registry recording the values real deployments use, on the argument that an undisclosed parameter makes a guarantee unevaluable from outside." } ], "claims": [ { "id": "org:claims:the-parameter-is-a-policy:c01", "claim": "The Census Bureau's Data Stewardship Executive Policy Committee announced on June 9, 2021 a privacy-loss budget of epsilon 19.61 for the 2020 census redistricting file, split as 17.14 for the persons file and 2.47 for housing units.", "basis": "Census Bureau press release of June 9, 2021 and the accompanying disclosure avoidance system production parameter documentation; verified against census.gov during the spiritual-harvest wave, 2026-08-03.", "confidence": "verified", "sources": [] }, { "id": "org:claims:the-parameter-is-a-policy:c02", "claim": "Epsilon bounds how much any single person's record can change a released statistic, so a smaller value buys a stronger individual guarantee with more noise and less accurate results.", "basis": "Dwork, McSherry, Nissim and Smith (TCC 2006) and the standard differential privacy literature; the direction of the trade is definitional rather than empirical.", "confidence": "verified", "sources": [] }, { "id": "org:claims:the-parameter-is-a-policy:c03", "claim": "Alabama sued to stop the Census Bureau's use of differential privacy in March 2021, a three-judge court denied its motion for a preliminary injunction on June 29, 2021, and the case was dismissed without prejudice that September.", "basis": "Case dockets and contemporaneous coverage; verified during the spiritual-harvest wave, 2026-08-03.", "confidence": "verified", "sources": [] }, { "id": "org:claims:the-parameter-is-a-policy:c04", "claim": "Dwork, Kohli and Mulligan proposed a public Epsilon Registry in 2019, recording the epsilon values real deployments use.", "basis": "Differential Privacy in Practice: Expose your Epsilons!, Journal of Privacy and Confidentiality 9(2), 2019.", "confidence": "verified", "sources": [] } ], "concepts": [ { "id": "org:concepts:parameter-as-policy", "name": "Parameter as policy", "definition": "A numeric setting that resolves a conflict of interest between two parties, chosen once by whoever was nearest the code and thereafter binding on everyone the system touches. Differential privacy's epsilon is the legible case, because the trade between one person's exposure and everyone else's accuracy is written into the mathematics; retention windows, classification thresholds, and decay constants are the same object with the trade left implicit. Distinct from a requested constraint, which is a rule nothing checks, and from an undisclosed exclusion, which is a boundary nobody stated. A parameter is a decision genuinely made and genuinely binding, recorded where no affected person can read it.", "provenance": "canonical" } ], "researchContext": "Sourced from the spiritual-corpus review's first-ranked candidate. The\nunderlying research file states, in one line, that the epsilon parameter\nchoice is a moral decision rather than a technical one; that line is the\nwhole of what was taken. Everything else in that file, its cross-tradition\nethics table, its layered privacy stack, and its framing of the data class as\nsacred, is stripped, and none of it appears here or in the brick. The file is\nrecorded as a provenance path only.\n\nThe external anchor is entirely new work. The review named epsilon as the\ncanonical case and required verification; the Census Bureau's 2021 parameter\ndecision, the litigation around it, and the Epsilon Registry proposal were\nlocated and verified during this wave rather than carried from the source,\nwhich contains none of them. The generalization from epsilon to retention\nwindows, classification thresholds, and decay constants is the brick's\ncontribution, as is the placement of this class of failure beside the\ncorpus's existing positions on unenforced constraints and undisclosed scope.\nThe distinction is deliberate. A requested constraint is a rule nothing\nchecks, and an excluded claim is a boundary nobody stated. A parameter is a\ndecision that was genuinely made, is genuinely binding, and was recorded\nsomewhere no affected person can read." }, "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json", "releaseHash": "6ed70940bdb0245b44e7104af07fb9bea1f42baf3239cab65bef82df758b12eb", "versions": [ { "version": 1, "cutAt": "2026-08-03", "note": "Initial publication, spiritual-harvest wave", "visibility": "published", "path": "/writing/the-parameter-is-a-policy/", "contentHash": "sha256:c2a3ce8c2ea986d7", "releaseHash": "6ed70940bdb0245b44e7104af07fb9bea1f42baf3239cab65bef82df758b12eb" } ] }