Abstract
We specify subject-released attestation: a market where a third party pays to ask a binary question about a person, the person is paid for permitting it, and the record's operator sells only its vouching. The defining property is negative — the operator cannot structurally answer about a named person alone — making an institution's refusal to sell personal records a fact about the machinery, not a promise about its management. This paper contributes the market rules deciding what that inability sells, and to whom.
Five rules constitute it: (1) the two-good split — release and vouching separately owned, neither party able to sell the other's; (2) the farm-proof schema rule, admitting only attributes bounded per person and never monotone in volume, threshold or bit included; (3) one posted price per buyer market, identical for every subject, binary release; (4) the buyer-class exclusion, barring any buyer whose business is pricing, scoring, ranking or gating a necessity — placed on the buyer because an answer's use is unobservable, and an uncheckable rule is not a rule; and (5) anti-aggregation by asker — a live release per answer bound to a named asker, expiring answers, rate-limited askers, subject receipts, and no enumerable directory.
We state the condition under which the central property is true rather than rhetorical: it holds only where the record is stored as a commitment the operator cannot read out, from issuance onward. Where plaintext is stored, cannot degrades to will not, and the weaker words should be used.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Ly, Thon, "Subject-Released Attestation: A Market Design in Which the Operator Cannot Answer", Technical Disclosure Commons, (September 24, 2026)
https://www.tdcommons.org/dpubs_series/11863