Chapter 17 — Control and feedback basics

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Feedback loops"]
  N2["17.2 Choosing signals"]
  N3["17.3 Stability"]
  N4["17.4 Gaming"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Feedback loops"]
  N2["17.2 Choosing signals"]
  N3["17.3 Stability"]
  N4["17.4 Gaming"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Feedback loops]
    |
    v
[17.2 Choosing signals]
    |
    v
[17.3 Stability]
    |
    v
[17.4 Gaming]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) model privacy controls as feedback loops; (2) choose measurable signals; (3) avoid unstable or gamed control.

17.1 Feedback loops

Control engineering uses feedback: measure an output, compare with a target, adjust. Zara models Pellmore's retention process this way. The output is the number of records past retention; the target is zero; the controller is the deletion job. If the count rises, the job runs more often or a person investigates. Without measurement there is no feedback, which explains why Pellmore's paper policy failed. She draws the loop and labels each element, which helps managers see that monitoring is part of the control, not an extra.

17.2 Choosing signals

A feedback loop needs a signal that reflects the goal. For access control Zara considers the number of record views without a booked appointment. A rising count could indicate snooping by staff. For consent, the share of patients whose consent record is missing. She chooses signals that are cheap to compute, hard to fake and directly related to harm. She learns from Chapter 29 of her plan, which she reads ahead, that measurement design will become a full topic later, but even simple signals change behaviour.

17.3 Stability

Badly tuned loops oscillate. If the deletion job deletes aggressively whenever the count rises, it might remove records under legal hold or overload the database. Zara adds limits: deletion caps per run, an exclusion list and an alert if the count rises suddenly, which usually signals a fault rather than ordinary growth. She explains that in privacy, as in physical control, stability matters more than speed: a slow, predictable process is better than a fast one that occasionally destroys records it should keep.

17.4 Gaming

Any measured target can be gamed. If managers are judged on the number of overdue records, someone might change the category of records to one with a longer period. Zara adds a second signal that tracks category changes and requires approval for them. Prof. Holm reminds the class of the general warning that when a measure becomes a target it can cease to be a good measure. Combining signals and keeping a human review of anomalies reduces, though it never removes, the risk of gaming.

Worked example

Zara models retention as a feedback loop, chooses signals for snooping and missing consent, adds limits for stability and a second signal to detect gaming.

Synthetic case. Signals and thresholds are synthetic.

Errors and limits

Signals can generate false alarms; review thresholds after the first months of data.

Exercises

• EX049 — Missing feedback. Why did the paper retention policy fail in control terms?
  Show marking criteria

  Rubric: 3 = there was no measurement, so no feedback adjusted the process;; 2 = mentions monitoring;; 1 = other cause;; 0 = none.
• EX050 — Snooping signal. What signal might reveal staff snooping?
  Show marking criteria

  Rubric: 3 = record views without a booked appointment;; 2 = mentions views;; 1 = vague;; 0 = none.
• EX051 — Gaming defence. How does Zara guard against category gaming?
  Show marking criteria

  Rubric: 3 = track and require approval for category changes;; 2 = mentions monitoring;; 1 = vague;; 0 = none.

Synthesis

Chapter 17 frames privacy as control. Chapter 18 designs architecture.

Continue studying — chapter 17 of 50

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →