Flow A

Permission → Audience (Consent Comes First)

Users and enterprises define how their data can be used by encoding constraints into executable policies within the control plane.

These policies specify:

• purpose (e.g. targeting, analytics, modeling)
• granularity and aggregation thresholds (k-anonymity)
• retention and geography rules
• privacy budget (ε)

Every campaign must pass policy validation before execution. Only audience configurations that satisfy both k-anonymity and available ε budget are allowed.

Computation is then performed inside trusted environments:

• matching
• frequency control
• aggregation

No raw data is exposed or transferred.

Output: → privacy-compliant audience segments → tracked privacy usage