Six viewers, six responses, one record.
A newsroom's record on a confidential source (codename WATERLINE), shown to six viewers. Each sees only what they are entitled to. The newsroom's own IT administrator, with full access to the system, sees no more than any other staff member, and an outside party demanding the record sees only what is public. Only the reporter who holds the source relationship sees who the source is, and only the reporter can grant access to anyone else.
Silent is the default. A suppression notice is itself a disclosure: it confirms there is something there to ask about. The explicit policy is used only where a response is owed.
▾ Show all viewers side-by-side (table view, wide screens)
| Field | 🪪 Reader PUBLIC | 📰 Metro desk reporter NEWSROOM | 📝 Investigations editor INVESTIGATIONS DESK | 🖥 IT administrator SYSTEM ADMIN | 📨 Outside party EXTERNAL | 🔑 Sam, the reporter OWNER |
|---|---|---|---|---|---|---|
| Story PUBLIC | County drinking-water quality investigation | County drinking-water quality investigation | County drinking-water quality investigation | County drinking-water quality investigation | County drinking-water quality investigation | County drinking-water quality investigation |
| Source status NEWSROOM | Confidential source; verified | Confidential source; verified | Confidential source; verified | Confidential source; verified | ||
| Documents provided INVESTIGATIONS DESK | 14 pages of lab reports (redacted copies in legal review) | 14 pages of lab reports (redacted copies in legal review) | ||||
| Legal review note INVESTIGATIONS DESK | Source-protection review complete; publish redacted copies only | Source-protection review complete; publish redacted copies only | ||||
| Verification notes INVESTIGATIONS DESK | Lab credentials confirmed by the editor on 2026-09-30 | Lab credentials confirmed by the editor on 2026-09-30 | ||||
| Source identity REPORTER ONLY | [verified by the reporter; identity held by the reporter only] | R. Alvarez, senior lab technician, county utility | ||||
| Contact channel REPORTER ONLY | Agreed secure channel only; no calls to work numbers | |||||
| Meeting log REPORTER ONLY | Six meetings since 2026-08-14 |
Why the response gives nothing away
Under the default silent policy, the response is identical whether the underlying record exists or doesn’t, whether a field is empty or full, and whether the question is asked honestly or with a prompt-injection twist. The viewer sees what they are entitled to and has no way to tell whether that is all there is, because nothing in the response varies with what was withheld.
That is the protection: someone with full system access, an outside party, or a well-crafted prompt gets nothing the owner has not chosen to release, and cannot tell whether anything more exists. The record opens only with the owner's consent.