Case protocol
CA1 — Anonymised Actual-Case Protocol
This protocol sets out how an actual case may be handled and, where appropriate, published without weakening anonymity, source protection, precision, reply, harm assessment, or corrigibility.
Abstract
An anonymised actual case concerns real material, real persons, real events, or actual institutional courses of action, but is handled so that identity, sources, third parties, and sensitive information are not exposed beyond what is necessary and defensible.
Anonymisation is not merely removal of names. Location, date, role, rare event, quotation, age, relation, institution, image, metadata, or timeline may identify a person in combination. The protocol therefore requires reidentification testing, harm assessment, limited material use, secure source handling, contradiction where possible, and a visible correction channel.
The protocol does not authorise publication, breach confidentiality, replace formal process, or decide legal, medical, employment, or other regulated questions. It states methodological conditions for turning actual material into an anonymised and corrigible case presentation.
1. Purpose and scope
The protocol applies to actual cases where the material cannot be published directly without special safeguards: employment matters, health and welfare trajectories, internal documents, personal experience, whistleblowing matters, private messages, vulnerable relations, small communities, children, relatives, sources at risk, or material that may create wrongful harm if opened without control.
An anonymised actual case is not a synthetic example. It refers to something that actually happened or is actually documented. For that reason it requires stricter delimitation than a pedagogical example and stronger publication safeguards than a purely public-record case.
The purpose is to make the case presentation sufficiently reviewable for methodological control while limiting it enough to protect persons, sources, third parties, rights, safety, and formal processes.
2. Decisive distinctions
The protocol distinguishes actual material, case presentation, anonymised excerpt, publication basis, party reply, and final finding. These may be related, but they are not identical.
Anonymisation must not be used to make findings stronger than the material can bear. It reduces identifiability, but may also reduce public reviewability. That tension must be visible in the case.
| Element | Function | Not equivalent to |
|---|---|---|
| Actual material | Document, observation, message, record, log, or other ground from a real case. | Automatically publishable or complete. |
| Anonymisation | Reduces or removes identifying information. | Guarantee against reidentification. |
| Pseudonym | Provides readable role or actor code without name. | New identity or fictional person. |
| Consent | Possible ground for sharing within a defined frame. | Unlimited permission to publish. |
| Source protection | Protects origin, channel, safety, or trust. | Exemption from precision. |
| Published excerpt | The part judged necessary and defensible to show. | The complete source material. |
| Finding | Bounded F1–F7 assessment of documented correspondence. | Judgment over person, institution, or the whole case complex. |
3. Mandate, basis, and consent or other ground
Before work begins, the case should show why it is being handled, who owns or controls the material, what purpose the presentation serves, and what basis makes the use of material defensible. Consent may be one basis, but it is not always sufficient and not always possible.
Where consent cannot be used, another relevant basis should be recorded: own documentation, legitimate interest, public interest, whistleblowing, correction need, pedagogically necessary anonymised excerpt, or another bounded ground. Such grounds must not be used loosely.
Case object
Bound the actual course, document group, decision, practice, or claim at issue.
- Minimum basis
- S1–S2 with period, domain, actor types, and explicit exclusions.
- Consequence
- An unclear object should normally remain at PL0 or PL1.
Material basis
Record what material is used, who has access, and which parts cannot be published.
- Minimum basis
- SRC register with access level and publication level.
- Consequence
- Uncertain access or integrity reduces finding strength.
Consent or other ground
Document consent, legitimate interest, public interest, whistleblowing, correction need, or other bounded basis.
- Minimum basis
- Ground note, date, scope, and withdrawal conditions where relevant.
- Consequence
- Unclear basis blocks public publication.
Competence and process boundary
State what the case does not decide: legal responsibility, diagnosis, personnel sanction, criminal liability, compensation, or formal rights.
- Minimum basis
- Status notice and S2 limitation.
- Consequence
- Findings must remain methodological and proportionate.
4. Reidentification test and anonymisation
Anonymisation must be tested as concrete risk analysis, not as a technical formality. The question is not only whether the name is removed, but whether a reasonable circle can recognise the person through a combination of details.
The protocol requires both direct and indirect identification control before PL2 or PL3. If the case concerns small communities, rare events, locally known roles, or recent conflicts, the threshold for public publication is higher.
Direct identifiers
Remove or assess names, address, phone, email, birth date, image, signature, metadata, and unique document numbers.
- Minimum basis
- Anonymisation log.
- Consequence
- Direct identifiers normally require PL0–PL1 or a specific ground.
Indirect identifiers
Test the combination of location, date, age, role, workplace, family, quotation, travel, rare event, and institution.
- Minimum basis
- Reidentification matrix.
- Consequence
- High combination risk requires further generalisation or non-publication.
Circle test
Assess whether persons in a local community, workplace, professional field, family, or network can recognise the case.
- Minimum basis
- Circle note without expanding access unnecessarily.
- Consequence
- Recognisability to a small relevant circle may be enough to restrict publication.
Residual risk
Record what identification risk remains after anonymisation.
- Minimum basis
- Publication note with risk and measures.
- Consequence
- Residual risk should be visible internally and affect PL level.
5. Source protection, material chain, and limited use
Source protection is not only concealment of name. It may also concern channel, timing, document form, relation, voice, writing style, metadata, or combinations that reveal origin.
The case should use the least material necessary to make mandate, claim, contradiction, finding, and correction reviewable. Full opening of material is not an ideal where it harms protection without adding necessary control.
Source category
Distinguish own documentation, witness, party, third party, public source, internal source, and anonymous source.
- Minimum basis
- SRC register with protection ground.
- Consequence
- Source function must not be confused with truth or party status.
Material minimisation
Use excerpt, summary, or structured matrix where the full source is unnecessary.
- Minimum basis
- Publication level and necessity note.
- Consequence
- Excess material should stay out of PL2–PL3.
Transformation log
Record what has been redacted, generalised, translated, paraphrased, time-shifted, or combined.
- Minimum basis
- Anonymisation and version log.
- Consequence
- The reader must not confuse transformed presentation with original material.
Secure storage
Limit who can access raw material and separate raw material from published text.
- Minimum basis
- Access note and lifecycle status.
- Consequence
- Missing control may block publication or require further anonymisation.
6. Parties, third parties, and contradiction
Anonymisation does not remove the requirement of fairness. Where a person, role, or institution is affected by a case presentation, contradiction should be assessed. At the same time, contradiction may be restricted if contact would expose a source, increase danger, breach privacy, or undermine formal process.
Reply from a party or mentioned actor should be recorded as material and tested. It should neither be accepted automatically nor dismissed because it challenges the provisional finding.
Affected actors
Identify who may be affected even if they cannot be named publicly.
- Minimum basis
- Role and rights matrix.
- Consequence
- Affected actors may require special wording and harm assessment.
Safe contradiction
Ask precise questions without sharing more raw material than necessary.
- Minimum basis
- P and FN codes, bounded excerpts, and response deadline.
- Consequence
- Contradiction must not become new harm or source exposure.
Exception and restriction
Record why contradiction is not possible or not defensible if it is restricted.
- Minimum basis
- Safety, privacy, or process note.
- Consequence
- Missing contradiction normally reduces finding strength.
Reply and counter-material
Record reply as a new source, test claims, and revise findings where the material bears.
- Minimum basis
- S8 log and revised findings matrix.
- Consequence
- Provisional findings cannot stand unchanged if reply changes the grounds.
7. Harm assessment, publication level, and safe publication
Publication requires its own ground. It is not enough that a case is probable, interesting, important to the auditor, or internally relevant. Publication must be necessary, proportionate, safe enough, and corrigible.
The harm assessment should consider identification risk, reputation, work, health, family life, safety, retaliation, third parties, children, local community, and downstream copies.
Necessity
Publish only what is needed to show mandate, grounds, contradiction, findings, and correction.
- Minimum basis
- PL assessment before publication.
- Consequence
- Unneeded details should be removed, generalised, or kept internal.
Harm test
Assess likely and serious harm to parties, sources, third parties, and public trust.
- Minimum basis
- Harm matrix with measures.
- Consequence
- High harm may require PL0–PL2 or non-publication.
Safe channel
Choose channel: no publication, internal matrix, limited party reply, anonymised excerpt, or public case presentation.
- Minimum basis
- Channel note and purpose.
- Consequence
- The wrong channel can create more harm than the finding corrects.
Publication notice
Where defensible, inform affected actor of planned publication, correction channel, and scope.
- Minimum basis
- Notice log or justified exception.
- Consequence
- Missing notice must be justifiable.
8. Claims, findings, and capture threshold
Anonymised actual material may feel strong because it comes from real courses of action. The protocol still requires the same discipline: claims are split, sources are recorded, counter-material is tested, and findings are bounded.
Anonymisation may weaken public reviewability. Findings therefore often need clearer limitation than in a purely public-record case.
| The material may show | The material does not automatically show | Required additional control |
|---|---|---|
| That an event is documented in the material | That the whole event is completely presented | Timeline, counter-material, and limitation. |
| That an actor experienced or reported something | That cause, blame, or motive is established | Alternative explanation and contradiction. |
| That a pattern exists in the excerpt | That the pattern applies to the whole system | Scope, selection, and transfer limit. |
| That a category was used | That the person is the category | Identity Audit and correction trace. |
| That correction was promised | That the effect was repaired | Follow-up and closure. |
9. Correction channel, downstream control, and repair
An anonymised case must have a safe correction channel. Affected actors must be able to report error without becoming publicly identified, and corrections must be possible without exposing more material than necessary.
If the published presentation has affected reputation, decision, access, work, relation, or safety, correction must be tested against actual effect, not only against text change.
Correction channel
State where errors, reidentification risk, party reply, or new documentation can be reported.
- Minimum basis
- Published correction note or contact channel.
- Consequence
- Cases without a correction channel should not be published as PL3.
Safe correction
Correct errors without unnecessarily exposing source, raw material, or identity.
- Minimum basis
- Version log and redaction control.
- Consequence
- Correction must be visible enough, but not harmful.
Downstream copies
Map known shares, quotations, screenshots, decisions, or registers where the error may continue.
- Minimum basis
- Downstream log.
- Consequence
- Material errors require active follow-up where possible.
Repair
Test whether correction actually changes the consequence for affected person, source, third party, or process.
- Minimum basis
- S10 effect note.
- Consequence
- The case cannot close if material wrongful consequence remains without status.
10. Closure, reopening, and deletion or depublication
Closing an anonymised actual case requires more than a completed text. There must be recorded status for reidentification risk, party reply, correction, downstream effect, open questions, and reopening conditions.
Deletion, depublication, or stronger anonymisation may be correct if risk changes, identification occurs, consent basis falls away, material proves wrong, or formal process requires protection. Such measures are not a failure of method; they are part of corrigible publication.
Closure ground
Document why the case may close, what remains open, and what can reopen it.
- Minimum basis
- S10 closure protocol.
- Consequence
- A closed case is not an infallible case.
Reopening conditions
Define new documents, reidentification, party reply, harm, consent change, or correction need that can reopen the case.
- Minimum basis
- Reopening list.
- Consequence
- New material risk requires renewed publication review.
Depublication
Define when public text should be removed, reduced, or moved to a lower PL level.
- Minimum basis
- Harm, privacy, or correction note.
- Consequence
- Publication may be reversed where safeguards require it.
Method revision
Record what the case teaches about anonymisation, contradiction, source protection, and publication safeguards.
- Minimum basis
- Revision note for the protocol.
- Consequence
- Serious deviations should change the method before the next case.
References
- S1–S10 case architectureGeneral structure for examples and cases.
- Reality Audit StandardFormal requirements for mandate, findings, and correction.
- WorkbenchLocal work record for pre-publication work.
Revision history
- Document version
- 1.0
- First published
- 18 June 2026
First public edition.