A worked example of dual-lifecycle tier separation, audit-without-PII, and supervised citizen-tier access in the government records variant of the ABT methodology family.
The ABT-G variant applies the foundational envelope-tier architecture to government records, with an individual tax return as the canonical scenario. The variant-specific architectural elements are: dual-lifecycle tier separation, in which the same underlying record is projected into an authority tier (full PII, accessible for routine tax administration) and an audit tier (aggregate figures only, inaccessible to the authority tier key); aggregate-only audit processing, in which the audit function conducts population-level analysis and flags statistical outliers without ever accessing a citizen's name, address, or identifying number; and supervised citizen-tier access escalation, in which access to PII by the audit function requires separate institutional authorisation, is logged to a tamper-evident chain, and is therefore auditable by the data subject. This memorandum follows Lena Marchetti's return from filing through routine administration, statistical flagging, and supervised escalation.
Marchetti's device constructs a single envelope containing two independent tier projections: one addressed to the authority tier key (full PII), one addressed to the audit tier key (aggregate figures only). Neither projection enables decryption of the other.
| Actor | Endpoint | Holds at filing |
|---|---|---|
Lena Marchetti Citizen · taxpayer · first party | Personal device / filing portal | Persistent root return key rk_marchetti; constructs envelope locally before submission; derives filing token rk_marchetti_2025 |
National Tax Office Revenue authority · second party | Central tax administration | Authority tier key; can decrypt citizen projection (full PII); holds sealed audit projection |
Office of Tax Compliance Audit function · institutional third party | Separate compliance infrastructure | Audit tier key; can decrypt audit projection (aggregates only); cannot access citizen projection |
Record Registry Neutral witness | Independent oversight | Witnesses filing event; records hash-chained log entry; holds no decryption material for either tier |
Routine tax administration — assessment, payment matching, refund processing — operates entirely within the authority tier projection. The audit tier remains sealed to the authority tier key. The audit function has no access to citizen PII at this stage.
The audit function performs population-level analysis across audit projections for the 85K–100K income bracket. It identifies a statistical outlier in Marchetti's return: deduction ratio 0.31 against a bracket average of 0.19. The citizen tier remains sealed throughout this analysis.
The flag AF-2025-0081 references rk_marchetti_2025 — the filing token — not Marchetti's name or TIN. The audit function at this point does not know that this return belongs to Lena Marchetti. It knows only that a return in the relevant bracket, carrying filing token rk_marchetti_2025, has a deduction ratio 1.8 standard deviations above the bracket mean.
Having flagged rk_marchetti_2025, the audit function submits a citizen-tier access request. The request references the filing token and the audit flag basis. A designated authorising official approves the request. Only then is the citizen tier key released for this specific return.
Marchetti provides supporting documentation. Home office deduction (€ 18,400) and professional development (€ 11,000) are substantiated. The audit closes without adjustment. The access log permanently records both the flag and the closure.
The audit close event is appended to the hash chain as a separate entry: audit flag AF-2025-0081, status: closed without adjustment, documentation verified, date. Marchetti's future interaction with the tax system is unaffected — no persistent flag survives the audit closure.
What the registry holds at audit close: two hash-chained entries — (1) citizen-tier access authorised under AUTH-2025-0081, (2) audit flag AF-2025-0081 closed without adjustment. No PII appears in either registry entry. The entries reference only tokens and authorisation codes.
The following properties hold by cryptographic construction.
| Property | Guarantee | Legal relevance |
|---|---|---|
| Dual-lifecycle tier separation | Authority tier (full PII) and audit tier (aggregates) are encrypted to independent keys; neither key can decrypt the other's projection | Structural purpose limitation; each institutional function accesses only the data adequate for its role |
| Aggregate-only audit processing | Population-level analysis and statistical flagging proceed without PII access; flags reference filing tokens, not citizen identities | Proportionality of surveillance; audit achieves its aim without the disproportionate measure of mass PII access |
| Supervised escalation | Citizen-tier access by audit function requires separate institutional authorisation, referencing the filing token and flag basis | Accountability architecture; access is not unilateral, not invisible, and not unlogged |
| Tamper-evident access log | Every citizen-tier access event is hash-chained; cannot be altered without breaking chain integrity | GDPR Article 15 right of access; data subject can verify when and under what authorisation their record was opened |
| No PII in audit tier | A subpoena to the audit function for citizen PII cannot be satisfied — the audit tier does not contain identifying information | Limits compelled production to data actually held; audit function cannot produce what its tier key cannot decrypt |