1  # Circle Trust Policies: Privacy vs Accountability
 2  
 3  > **Security Model — Configurable Group Dynamics**
 4  > *Source: CIRCLE_TRUST_POLICIES.md*
 5  
 6  ---
 7  
 8  ## 1. The Core Tension
 9  
10  Abzu acknowledges a fundamental trade-off in group messaging:
11  
12  - **Activists** need safety (anonymity, deniability).
13  - **Communities** need moderation (accountability, audit trails).
14  
15  A "one size fits all" trust model fails one group. Abzu solves this with **Tiered Trust Policies**.
16  
17  ---
18  
19  ## 2. Policy Tiers
20  
21  Circles are created with an immutable `TrustPolicy` that dictates what metadata is stored.
22  
23  ### 2.1 Anonymous (Default)
24  
25  *Use Case: Activism, Whistleblowing, High-Risk Coordination*
26  
27  - **No Invite Tree**: The node does not record who invited whom.
28  - **No Prune Logs**: Removals leave no trace.
29  - **Minimal Metadata**: Only the member list is stored.
30  - **Defense**: Even if a device is seized, the social graph cannot be reconstructed.
31  
32  ### 2.2 Private
33  
34  *Use Case: Friend Groups, Clubs*
35  
36  - **Invite Tree**: Stored locally to allow functional pruning ("ban Alice and everyone she invited").
37  - **Private Log**: No permanent ledger, but current relationships are tracked.
38  - **Balance**: Enables moderation tools without a permanent audit trail.
39  
40  ### 2.3 Accountable
41  
42  *Use Case: Public Servers, Organizations, DAOs*
43  
44  - **Full Ledger**: Permanent record of every join, leave, invite, and vouch.
45  - **Audit Trail**: "Who brought this person in?" is always answerable.
46  - **Immutable**: Ledger cannot be deleted without breaking the circle's chain.
47  
48  ---
49  
50  ## 3. Pruning Dynamics
51  
52  When removing a member, the policy determines the fate of their invitees:
53  
54  | Prune Mode | Behavior | Philosophy |
55  |------------|----------|------------|
56  | **Cascade** | Bans target + all their invitees | "Fruit of the poisonous tree" |
57  | **Orphan** | Bans target, keeps invitees (marked as orphan) | "Punish the individual, not the network" |
58  | **Reassign** | Transfeers invitees to the founder | "Founder takes responsibility" |
59  
60  > **Default**: `Orphan`. Cascade is too destructive for most social groups.
61  
62  ---
63  
64  ## 4. Implementation Details
65  
66  The policy is enforced by the `Circle` struct and the `TrustPolicy` enum.
67  
68  ```rust
69  // Rust Definition
70  pub enum TrustPolicy {
71      Accountable { ledger: LedgerMode, prune: PruneMode },
72      Private { prune: PruneMode },
73      Anonymous, // Zero logs, zero trees
74  }
75  ```
76  
77  **Security Guarantee**: The `Anonymous` policy physically prevents the storage of `invited_by` fields in the database. It is not just a UI flag; it is a schema constraint.
78  
79  ---
80  
81  ## 5. System Architecture (Reference Implementation)
82  
83  The Circles feature is integrated into the Abzu stack as of Jan 2026:
84  
85  ### 5.1 Frontend (Sovereign Dashboard)
86  
87  - **UI Component**: `CirclesPanel` (Flutter).
88  - **State Management**: `CirclesNotifier` (Riverpod) handles optimistic updates and error handling.
89  - **Identity**: Uses `NodeInfo` to distinguish "Me" vs "Them" in chat interfaces.
90  
91  ### 5.2 Backend (Sovereign Agent)
92  
93  - **RPC Interface**:
94    - `list_circles()`: Retrieves active subscriptions.
95    - `post_circle_message(circle_id, content)`: Cryptographically signs and gossips the message.
96    - `create_circle(policy)`: Instantiates a new topic on the DHT (Planned).
97  - **Data Model**: Messages are locally stored in `sled` (embedded DB) and synced via the gossip mesh.