Who sees what, and who decides?

Two questions come up again and again in security reviews, and different people usually ask them. The security officer wants to know who can see what. The legal department wants to know who decides. We think they are one question seen from two sides: who is responsible for what happens to a piece of information.

Seeing less, working together

Security engineers have a name for the first rule: least privilege. Each person sees what their work needs, and no more. The list of security controls published by NIST, the United States standards institute, puts it in one sentence: allow “only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks”.

The rule is often read as a restriction. In practice it is what makes shared work possible. A fraud unit, a compliance team and internal audit can rely on the same records only if each of them sees its own part. Without that rule, the cautious answer is to give every team its own copy of the data, and copies soon stop agreeing with each other.

A decision needs a name

The second rule matters more as software grows more capable. A platform can match records, find links and draft an answer far faster than any team. It is tempting to let it take one step more and decide.

European law draws a line here, and it is a useful example wherever you work. The GDPR gives people “the right not to be subject to a decision based solely on automated processing” when that decision has legal effects on them, or effects as serious. Even where the law allows such a decision, under a contract or with clear consent, people keep “at least the right to obtain human intervention”: a person must look at it, hear their side and let them contest it.

We see more in this than a legal duty. An alert is a reason to look, not a reason to act. A decision that no one has signed is a decision that no one can explain, defend or correct. Institutions answer for what they decide, to their own management, to a supervisor, sometimes before a judge. They can only do so if they know who decided, and on what.

What Datasight does

Datasight brings the records together and shows how they connect and where each fact comes from. Who sees what is not decided for you in advance. We set it with each client, to fit the way its teams really work: by role, by team, or down to a single case when the work calls for it. Several teams can then share one platform without each of them seeing everything.

The decision stays with a person. The platform puts the facts in order. Someone entitled to decide reads them and decides, and the platform records who it was. That is deliberate. The institutions we work for hold powers that belong to them: to investigate, to sanction, to pay or to refuse. Our part is to put solid facts in front of them, not to use those powers in their place.