Selective disclosure — at1 disclose
From a sealed dataset, hand an auditor a redacted exportwhere a sensitive column (a card PAN, an ID number, a medical field) is masked by a per-cell salted commitment. Using only the archive's published seal, anyone can verify the masked column was present, every masked cell commits to a real value, and the disclosed columns are byte-identicalto the original — all without revealing the masked values and without re-sealing. It is the disclosure-with-proof sibling of erasure: the published Merkle root is invariant under the privacy op.
Use it
# seal a CSV into a disclosure bundle (per-cell salted commitments + one root)
at1 disclose seal pci.csv -o orders --subject-field order_id
# emit a REDACTED export that masks a column but still verifies to the seal
at1 disclose export orders --mask PAN -o redacted.json
# anyone re-checks the export against the original seal (free, SHA-256 only)
at1 disclose verify-disclosure orders.seal.json redacted.json
# selectively OPEN one masked cell to prove it is a real committed value
at1 disclose open-cell orders redacted.json --row 2 --col PANWhat it proves
- Integrity is unconditional — presence, byte-exactness of disclosed cells, and “this masked cell is not fabricated” hold against any adversary given the seal.
- Same root — the redacted export verifies to the ORIGINAL seal; nothing is re-signed.
- Selective opening — open one cell to reveal a single real committed value and nothing else.
Honest scope: integrity and presence are unconditional; hidinga masked value is exactly as strong as salt custody — each low-entropy cell gets a fresh 32-byte salt in an erasable vault, so two equal PANs commit differently and a redacted export leaks no join key. Destroy a subject's salts and their masked values become crypto-erased too, and the root never moves. Verification is free; issuing a disclosure export is the metered event.
The mirror of right to erasure, part of the Regulated Archive family. See the Selective Disclosure product page.