Preferred name, timezone, household, allergies, what they are working on, what they said last month. Everything comes back with provenance so it can be rendered as a claim rather than obeyed as an instruction; anything that looks like a credential is refused rather than stored; forget that reaches the bytes on disk; and no request can name a person other than the one its token was minted for.
What stands out
- Credential-shaped values refused
- Delete means the bytes on disk
- Token-bound: no cross-person access