Observability Without Surveillance

Plain-English summary

Observability helps operators understand whether systems are healthy and whether a defined incident is occurring. Surveillance appears when the same collection becomes permanent, person-centered, cross-context, predictive, or useful for unrelated control. VNWO recommends a staged ladder so each increase in visibility is justified and reversible.

Monitoring ladder

Level 0

No collection

Use: No operational need has been established.

Required controls: Default for unnecessary fields and dormant features.

Level 1

Aggregate health

Use: Capacity, uptime, broad error rates, and service reliability.

Required controls: Coarse aggregation, no participant-level history.

Level 2

Local event features

Use: Detect anomalies without centralizing raw logs or payloads.

Required controls: Local extraction, narrow features, short retention.

Level 3

Incident-scoped flow data

Use: Investigate a defined reliability or security incident.

Required controls: Case ID, approval, target scope, expiry, access log.

Level 4

Exceptional content access

Use: Narrow diagnosis where lower levels cannot answer the incident question.

Required controls: Explicit approval, minimization, time limit, independent review, evidence retirement.

Level 5

Closure and retirement

Use: End exceptional collection and account for retained evidence.

Required controls: Return to lower level, delete or retire case material, publish outcome summary where appropriate.

Privacy-preserving implementation options

Secure aggregation

Combine measurements so an operator receives a useful aggregate without receiving each participant’s raw contribution. Threat model, minimum cohort, collusion risk, and failure behavior still require review.

Differential privacy

Add calibrated uncertainty to aggregate reports to limit what can be learned about one participant. The privacy budget, composition, utility loss, and disclosure must be documented.

Local-first analysis

Compute features or alerts near the source and transmit only the narrow result needed for the operational question.

Split review authority

Separate the ability to collect, decrypt, interpret, decide, and sanction so one operator cannot silently turn telemetry into unilateral judgment.

VNWO does not implement or guarantee these techniques. They are architecture options whose protections depend on correct deployment and independent review.

Escalation governance

Name the incident or operational question before increasing visibility.
Record why the current monitoring level cannot answer that question.
Define affected systems, participants, fields, reviewers, and maximum duration.
Separate incident evidence from unrelated ranking, training, advertising, or reputation systems.
Provide correction and appeal when monitoring-derived judgments materially affect a participant.
Return to a lower level and retire elevated evidence when the purpose ends.

Monitoring-escalation receipt

Every increase in visibility should have a case-specific receipt. The receipt explains the trigger, approving role, scope, fields collected, expiry, review, appeal, and final disposition.

case_id: INCIDENT-EXAMPLE
trigger: aggregate_error_rate_exceeded
approving_role: incident_review_lead
scope: community-api
fields_collected:
  - request_timestamp_bucket
  - service_route
  - response_class
payload_access: false
expires_utc: 2026-06-18T04:00:00Z
review_path: /repair-and-appeals/
appeal_available: true
disposition: retire_after_case_closure
claim_boundary: VNWO documents the receipt pattern; it does not collect telemetry or approve escalation.

Open the community incident worked case.

Copyable monitoring policy

Observability without surveillance\n\nDefault posture:\n- Collect only the least revealing signal needed for a named operational purpose.\n- Keep routine health monitoring separate from participant profiling and content review.\n- Use staged escalation; do not jump from aggregate counters to payload inspection.\n- Require a case ID, scope, approval, expiry, and review owner for elevated collection.\n- Record why lower-observation levels were insufficient.\n- End elevated collection automatically and account for retained evidence.\n- Do not reuse incident data for unrelated ranking, advertising, training, or reputation scoring without a separately disclosed and justified rule.\n\nBoundary: VNWO publishes this policy pattern; it does not collect telemetry or certify monitoring systems.

Observability QA checklist

Routine monitoring is clearly separated from exceptional incident collection.
Each escalation has a case, scope, reason, expiry, review owner, and closure record.
Payload access is not the default and cannot persist after the case closes.
Monitoring data is not silently repurposed into participant ranking or training data.
Participants can challenge material decisions derived from telemetry.