Client work stays private. Studio reasoning is published.
Essays on privacy-respecting interface design, and reference builds: hypothetical products, worked as if they were real, that show how we work.
369 HertzCONSENT · PRIVACY UX DENSE INTERFACES · PRACTICE
01 · REFERENCE BUILDS
Hypothetical products, real reasoning.
Three pieces built for ourselves, working through problems we keep meeting in regulated products. The products don't exist. The design arguments do, and each one is published when its argument is finished, not on a schedule.
BUILD 01 · DENSE TELEMETRY READ-OUTA REFERENCE BUILD · A WORKED EXAMPLE, NOT CLIENT WORK
The problem. One technician covers 43 channels for twelve hours. Every reading carries the same visual weight, so the anomaly has to be searched for. A channel that stopped reporting an hour ago still shows its last number in the same grey as the healthy ones.
The move. A channel has three independent facts, not one status: is the signal arriving, is there a band, where does the value sit in it. Nine states fall out of the combinations, and every one carries its justification in the row.
The decision that cost the most. Rank by deviation, but refuse to express it by moving anything. Rows keep plant order permanently; type size, height and glyph carry severity. A channel in the worst state can be off-screen. That is the price, and the escalation strip is what pays it.
The problem. Consent screens show on or off. The record underneath holds a history: who asked, on what basis, for what purpose, when it was given, when it lapses. When the switch and the record disagree, nobody notices until a subject-access request lands.
The move. Replace the switch with four named states (granted, withdrawn, expired, never asked), each displayed next to the one line of stored fact that backs it up. Withdrawn keeps the original grant, because the operator may have to prove what was lawful when.
What it cost.Four named states are slower to scan than a green dot, and the expiry date adds a line the operator can't skip. Slower to skim, much harder to get wrong.
The problem. Permission tools answer yes or no. That is useless for the only thing an on-call engineer needs to do next, which is change it: inherited, direct, expired and denied-elsewhere all render as yes, and each needs a different command to undo.
The move. Every claim is followed by its because lines, one hop per line, each carrying its own author, date and expiry. Nothing changes without --apply, and every apply prints what a revoke cannot undo.
The decision that cost the most. No prompt, no --yes, no --force. A refusal prints what would have happened instead, which means it costs a full plan computation and discloses what the role carries.
xterm-256color · 80×24 · theme unknown4 of 8 base colours in use
$ warrant explain priya.raman write on pg:prod-eu/paymentsANSWER yes, write is in effect ^3 inherited, 3 hops^3priya.raman has write on pg:prod-eu/payments/* because priya.raman is a member of group:eng-payments added 2026-03-02 by n.falk · membership has no expiry because group:eng-payments holds role:payments-writer granted 2026-01-14 by s.adeyemi · reason "team charter" because role:payments-writer allows write on this resource role last edited 2026-05-30 by s.adeyemi · 8 permissions also on record, not in effect now:xdirect grant of write, expired 6d ago (2026-07-21) granted 2026-04-21 by m.dahl · reason "KES-4417"!DENY of delete, rule r-2208, active (not write) written 2026-02-19 by s.adeyemi3 hops · 1 group · 1 role · 41 objects matchedverified against 2 providers, both answered (12ms, 31ms)
One of nine sessions. The full build renders every session in colour, with NO_COLOR set, and piped with no TTY. Invented org, invented principals.
02 · RECORD INDEX
10 RECORDS · 7 ESSAYS · 3 BUILDS
Everything the studio publishes, in one index.
Written from practice, not opinion: every record traces back to a problem we've shipped through.
Every essay and reference build the studio has published, newest first. Columns: record number, type, title, topic, date, status.