Access Control and Anonymization
Access control governs who can read or change data; anonymization removes identifying detail so data can be shared more openly.
Sharing without oversharing
Not all data can be open to everyone. Some is sensitive, some is confidential to an organization, and some can be shared only after identifying detail is removed. Access control decides who may do what with data; anonymization transforms data so it reveals less. Together they let a program be as open as possible while protecting what must be protected.
Access control models
- Role-based (RBAC): permissions attach to roles, and users get roles.
- Attribute-based (ABAC): access depends on attributes of user, data, and context.
- Principle of least privilege: grant only the access needed for the task.
- Separation of duties: no single actor can complete a sensitive action alone.
Anonymization techniques
- Removal: drop identifying fields entirely.
- Aggregation: report only group-level summaries.
- Perturbation: add controlled noise to obscure individuals.
- Generalization: coarsen precise values into ranges.
The re-identification risk
Removing obvious identifiers is not always enough. Combinations of seemingly harmless fields can uniquely single out a record, allowing re-identification by linking to other data. Formal frameworks such as k-anonymity and differential privacy quantify and bound this risk, rather than relying on the false comfort that a name column was deleted.
Firewalls in a research program
For a program with both a public record and confidential material, access control enforces a firewall: sensitive and business-confidential content is kept out of public systems entirely, not merely hidden. The Kronos published record is designed to contain the scientific evidence while excluding restricted detail and any economic content by policy. Openness and protection are engineered together, not traded off ad hoc. See the open published record.